# Flog Txt Version 1
# Analyzer Version: 2.3.0
# Analyzer Build Date: Apr 12 2018 14:32:59
# Log Creation Date: 01.07.2018 18:25:18.885
Process:
id = "1"
image_name = "kryptotrojaner.exe"
filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe"
page_root = "0x5121f000"
os_pid = "0x964"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "analysis_target"
parent_id = "0"
os_parent_pid = "0x0"
cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe\" "
cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:000104d7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 1
start_va = 0x10000
end_va = 0x2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 2
start_va = 0x30000
end_va = 0x33fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 3
start_va = 0x40000
end_va = 0x40fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 4
start_va = 0x1f0000
end_va = 0x2effff
entry_point = 0x0
region_type = private
name = "private_0x00000000001f0000"
filename = ""
Region:
id = 5
start_va = 0x1330000
end_va = 0x136bfff
entry_point = 0x1330000
region_type = mapped_file
name = "kryptotrojaner.exe"
filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe")
Region:
id = 6
start_va = 0x77c50000
end_va = 0x77df8fff
entry_point = 0x77c50000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 7
start_va = 0x7efe0000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007efe0000"
filename = ""
Region:
id = 8
start_va = 0x7ffe0000
end_va = 0x7ffeffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 9
start_va = 0x7fefff70000
end_va = 0x7fefff70fff
entry_point = 0x7fefff70000
region_type = mapped_file
name = "apisetschema.dll"
filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")
Region:
id = 10
start_va = 0x7fffffb0000
end_va = 0x7fffffd2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000007fffffb0000"
filename = ""
Region:
id = 11
start_va = 0x7fffffd9000
end_va = 0x7fffffd9fff
entry_point = 0x0
region_type = private
name = "private_0x000007fffffd9000"
filename = ""
Region:
id = 12
start_va = 0x7fffffde000
end_va = 0x7fffffdffff
entry_point = 0x0
region_type = private
name = "private_0x000007fffffde000"
filename = ""
Region:
id = 145
start_va = 0x140000
end_va = 0x1bffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000140000"
filename = ""
Region:
id = 146
start_va = 0x77a30000
end_va = 0x77b4efff
entry_point = 0x77a30000
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 147
start_va = 0x7fef82a0000
end_va = 0x7fef830efff
entry_point = 0x7fef82a0000
region_type = mapped_file
name = "mscoree.dll"
filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll")
Region:
id = 148
start_va = 0x7fefde60000
end_va = 0x7fefdecafff
entry_point = 0x7fefde60000
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 149
start_va = 0x10000
end_va = 0x1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 150
start_va = 0x50000
end_va = 0xb6fff
entry_point = 0x50000
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 151
start_va = 0x120000
end_va = 0x12ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000120000"
filename = ""
Region:
id = 152
start_va = 0x2f0000
end_va = 0x3effff
entry_point = 0x0
region_type = private
name = "private_0x00000000002f0000"
filename = ""
Region:
id = 153
start_va = 0x590000
end_va = 0x60ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000590000"
filename = ""
Region:
id = 154
start_va = 0x7efe0000
end_va = 0x7f0dffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007efe0000"
filename = ""
Region:
id = 155
start_va = 0x7f0e0000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007f0e0000"
filename = ""
Region:
id = 156
start_va = 0x7fefefb0000
end_va = 0x7feff0dcfff
entry_point = 0x7fefefb0000
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 157
start_va = 0x7feff210000
end_va = 0x7feff2aefff
entry_point = 0x7feff210000
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 158
start_va = 0x7feff2b0000
end_va = 0x7feff38afff
entry_point = 0x7feff2b0000
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 159
start_va = 0x7feff390000
end_va = 0x7feff3aefff
entry_point = 0x7feff390000
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 160
start_va = 0x3f0000
end_va = 0x4effff
entry_point = 0x0
region_type = private
name = "private_0x00000000003f0000"
filename = ""
Region:
id = 161
start_va = 0x570000
end_va = 0x57ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000570000"
filename = ""
Region:
id = 162
start_va = 0x7fef4580000
end_va = 0x7fef4618fff
entry_point = 0x7fef4580000
region_type = mapped_file
name = "mscoreei.dll"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll")
Region:
id = 163
start_va = 0x77b50000
end_va = 0x77c49fff
entry_point = 0x77b50000
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 164
start_va = 0x7feff3b0000
end_va = 0x7feff3bdfff
entry_point = 0x7feff3b0000
region_type = mapped_file
name = "lpk.dll"
filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")
Region:
id = 165
start_va = 0x7feff910000
end_va = 0x7feff976fff
entry_point = 0x7feff910000
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 166
start_va = 0x7feff980000
end_va = 0x7feff9f0fff
entry_point = 0x7feff980000
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 167
start_va = 0x7feffe90000
end_va = 0x7fefff58fff
entry_point = 0x7feffe90000
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")
Region:
id = 168
start_va = 0x610000
end_va = 0x797fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000610000"
filename = ""
Region:
id = 169
start_va = 0x7feff3c0000
end_va = 0x7feff3edfff
entry_point = 0x7feff3c0000
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 170
start_va = 0x7feffa00000
end_va = 0x7feffb08fff
entry_point = 0x7feffa00000
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 171
start_va = 0x20000
end_va = 0x20fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 172
start_va = 0xc0000
end_va = 0xc0fff
entry_point = 0x0
region_type = private
name = "private_0x00000000000c0000"
filename = ""
Region:
id = 173
start_va = 0x7a0000
end_va = 0x920fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000007a0000"
filename = ""
Region:
id = 174
start_va = 0x1370000
end_va = 0x276ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001370000"
filename = ""
Region:
id = 175
start_va = 0x7fefcd60000
end_va = 0x7fefcd6bfff
entry_point = 0x7fefcd60000
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")
Region:
id = 176
start_va = 0xd0000
end_va = 0xd0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000d0000"
filename = ""
Region:
id = 177
start_va = 0x9a0000
end_va = 0xa1ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000009a0000"
filename = ""
Region:
id = 178
start_va = 0x757b0000
end_va = 0x75878fff
entry_point = 0x757b0000
region_type = mapped_file
name = "msvcr80.dll"
filename = "\\Windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\\msvcr80.dll")
Region:
id = 179
start_va = 0x7fef3890000
end_va = 0x7fef422cfff
entry_point = 0x7fef3890000
region_type = mapped_file
name = "mscorwks.dll"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorwks.dll")
Region:
id = 180
start_va = 0xe0000
end_va = 0xe2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000e0000"
filename = ""
Region:
id = 181
start_va = 0xf0000
end_va = 0xf0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000f0000"
filename = ""
Region:
id = 182
start_va = 0x100000
end_va = 0x11ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000100000"
filename = ""
Region:
id = 183
start_va = 0xb10000
end_va = 0xb1ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000b10000"
filename = ""
Region:
id = 184
start_va = 0xb20000
end_va = 0xc1ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000b20000"
filename = ""
Region:
id = 185
start_va = 0xde0000
end_va = 0xedffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000de0000"
filename = ""
Region:
id = 186
start_va = 0x7fefe180000
end_va = 0x7fefef07fff
entry_point = 0x7fefe180000
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 187
start_va = 0x7ff00030000
end_va = 0x7ff0003ffff
entry_point = 0x0
region_type = private
name = "private_0x000007ff00030000"
filename = ""
Region:
id = 188
start_va = 0x7ff00040000
end_va = 0x7ff0004ffff
entry_point = 0x0
region_type = private
name = "private_0x000007ff00040000"
filename = ""
Region:
id = 189
start_va = 0x7ff00050000
end_va = 0x7ff000effff
entry_point = 0x0
region_type = private
name = "private_0x000007ff00050000"
filename = ""
Region:
id = 190
start_va = 0x7ff000f0000
end_va = 0x7ff000fffff
entry_point = 0x0
region_type = private
name = "private_0x000007ff000f0000"
filename = ""
Region:
id = 191
start_va = 0x7ff00100000
end_va = 0x7ff0016ffff
entry_point = 0x0
region_type = private
name = "private_0x000007ff00100000"
filename = ""
Region:
id = 192
start_va = 0x7fffffdc000
end_va = 0x7fffffddfff
entry_point = 0x0
region_type = private
name = "private_0x000007fffffdc000"
filename = ""
Region:
id = 193
start_va = 0x130000
end_va = 0x130fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000130000"
filename = ""
Region:
id = 194
start_va = 0x7fefdf70000
end_va = 0x7fefe172fff
entry_point = 0x7fefdf70000
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 195
start_va = 0xee0000
end_va = 0x11aefff
entry_point = 0xee0000
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 196
start_va = 0x7fefdba0000
end_va = 0x7fefdbaefff
entry_point = 0x7fefdba0000
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 197
start_va = 0x4f0000
end_va = 0x56cfff
entry_point = 0x4f0000
region_type = mapped_file
name = "rpcss.dll"
filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")
Region:
id = 198
start_va = 0xc20000
end_va = 0xd20fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000c20000"
filename = ""
Region:
id = 199
start_va = 0x2770000
end_va = 0x1a76ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002770000"
filename = ""
Region:
id = 200
start_va = 0x1a770000
end_va = 0x1ae3ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001a770000"
filename = ""
Region:
id = 201
start_va = 0x1ae50000
end_va = 0x1af4ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001ae50000"
filename = ""
Region:
id = 202
start_va = 0x7fef29b0000
end_va = 0x7fef388bfff
entry_point = 0x7fef29b0000
region_type = mapped_file
name = "mscorlib.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll")
Region:
id = 203
start_va = 0x7fffffda000
end_va = 0x7fffffdbfff
entry_point = 0x0
region_type = private
name = "private_0x000007fffffda000"
filename = ""
Region:
id = 204
start_va = 0x4f0000
end_va = 0x56cfff
entry_point = 0x4f0000
region_type = mapped_file
name = "rpcss.dll"
filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")
Region:
id = 205
start_va = 0x7fefda90000
end_va = 0x7fefda9efff
entry_point = 0x7fefda90000
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")
Region:
id = 206
start_va = 0x7fefc4c0000
end_va = 0x7fefc515fff
entry_point = 0x7fefc4c0000
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 207
start_va = 0x1af50000
end_va = 0x1b16ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001af50000"
filename = ""
Region:
id = 208
start_va = 0xa20000
end_va = 0xafefff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000a20000"
filename = ""
Region:
id = 209
start_va = 0x1c0000
end_va = 0x1c2fff
entry_point = 0x1c0000
region_type = mapped_file
name = "l_intl.nls"
filename = "\\Windows\\System32\\l_intl.nls" (normalized: "c:\\windows\\system32\\l_intl.nls")
Region:
id = 210
start_va = 0x1d0000
end_va = 0x1d0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001d0000"
filename = ""
Region:
id = 211
start_va = 0x1b1d0000
end_va = 0x1b2cffff
entry_point = 0x0
region_type = private
name = "private_0x000000001b1d0000"
filename = ""
Region:
id = 212
start_va = 0x7fef1df0000
end_va = 0x7fef1f73fff
entry_point = 0x7fef1df0000
region_type = mapped_file
name = "mscorjit.dll"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorjit.dll")
Region:
id = 213
start_va = 0x7fef1f80000
end_va = 0x7fef29a2fff
entry_point = 0x7fef1f80000
region_type = mapped_file
name = "system.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system\\adff7dd9fe8e541775c46b6363401b22\\system.ni.dll")
Region:
id = 214
start_va = 0x7fef4370000
end_va = 0x7fef457cfff
entry_point = 0x7fef4370000
region_type = mapped_file
name = "microsoft.visualbasic.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualbas#\\684eae3bcd28cb6d1e6997e6497056e2\\microsoft.visualbasic.ni.dll")
Region:
id = 215
start_va = 0x7ff00170000
end_va = 0x7ff0017ffff
entry_point = 0x0
region_type = private
name = "private_0x000007ff00170000"
filename = ""
Region:
id = 216
start_va = 0x7fffff10000
end_va = 0x7fffff1ffff
entry_point = 0x0
region_type = private
name = "private_0x000007fffff10000"
filename = ""
Region:
id = 217
start_va = 0x7fffff20000
end_va = 0x7fffffaffff
entry_point = 0x0
region_type = private
name = "private_0x000007fffff20000"
filename = ""
Region:
id = 218
start_va = 0x7fffffd7000
end_va = 0x7fffffd8fff
entry_point = 0x0
region_type = private
name = "private_0x000007fffffd7000"
filename = ""
Region:
id = 219
start_va = 0x1e0000
end_va = 0x1effff
entry_point = 0x0
region_type = private
name = "private_0x00000000001e0000"
filename = ""
Region:
id = 220
start_va = 0x4f0000
end_va = 0x4fffff
entry_point = 0x0
region_type = private
name = "private_0x00000000004f0000"
filename = ""
Region:
id = 221
start_va = 0x500000
end_va = 0x50ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000500000"
filename = ""
Region:
id = 222
start_va = 0x510000
end_va = 0x514fff
entry_point = 0x510000
region_type = mapped_file
name = "sorttbls.nlp"
filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp")
Region:
id = 223
start_va = 0x520000
end_va = 0x560fff
entry_point = 0x520000
region_type = mapped_file
name = "sortkey.nlp"
filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp")
Region:
id = 224
start_va = 0x580000
end_va = 0x580fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000580000"
filename = ""
Region:
id = 225
start_va = 0x11b0000
end_va = 0x12affff
entry_point = 0x0
region_type = private
name = "private_0x00000000011b0000"
filename = ""
Region:
id = 226
start_va = 0x642ff4a0000
end_va = 0x642ff4a9fff
entry_point = 0x642ff4a0000
region_type = mapped_file
name = "culture.dll"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\culture.dll")
Region:
id = 227
start_va = 0x580000
end_va = 0x58ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000580000"
filename = ""
Region:
id = 228
start_va = 0x930000
end_va = 0x983fff
entry_point = 0x930000
region_type = mapped_file
name = "mscorrc.dll"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorrc.dll")
Region:
id = 229
start_va = 0x7ff00180000
end_va = 0x7ff001bffff
entry_point = 0x0
region_type = private
name = "private_0x000007ff00180000"
filename = ""
Region:
id = 230
start_va = 0x7fef0b10000
end_va = 0x7fef1ba5fff
entry_point = 0x7fef0b10000
region_type = mapped_file
name = "system.windows.forms.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Forms\\6c352ff9e3603b0e69d969ff7e7632f5\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.windows.forms\\6c352ff9e3603b0e69d969ff7e7632f5\\system.windows.forms.ni.dll")
Region:
id = 231
start_va = 0x7fef1bb0000
end_va = 0x7fef1de6fff
entry_point = 0x7fef1bb0000
region_type = mapped_file
name = "system.drawing.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.drawing\\5910828a337dbe848dc90c7ae0a7dee2\\system.drawing.ni.dll")
Region:
id = 232
start_va = 0x990000
end_va = 0x99ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000990000"
filename = ""
Region:
id = 233
start_va = 0x7ff001c0000
end_va = 0x7ff001cffff
entry_point = 0x0
region_type = private
name = "private_0x000007ff001c0000"
filename = ""
Region:
id = 234
start_va = 0xd30000
end_va = 0xd40fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000d30000"
filename = ""
Region:
id = 235
start_va = 0xb00000
end_va = 0xb0ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000b00000"
filename = ""
Region:
id = 236
start_va = 0xd50000
end_va = 0xd5ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000d50000"
filename = ""
Region:
id = 237
start_va = 0xd60000
end_va = 0xd61fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000d60000"
filename = ""
Region:
id = 238
start_va = 0xd70000
end_va = 0xd7ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000d70000"
filename = ""
Region:
id = 239
start_va = 0x7fef0a10000
end_va = 0x7fef0b0cfff
entry_point = 0x7fef0a10000
region_type = mapped_file
name = "system.runtime.remoting.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\System.Runtime.Remoting.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.runtime.remo#\\0fde44651bdf14a3988b955dd94aa318\\system.runtime.remoting.ni.dll")
Region:
id = 240
start_va = 0x7ff001d0000
end_va = 0x7ff001dffff
entry_point = 0x0
region_type = private
name = "private_0x000007ff001d0000"
filename = ""
Region:
id = 241
start_va = 0xd80000
end_va = 0xdbffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000d80000"
filename = ""
Region:
id = 242
start_va = 0x7fefc2a0000
end_va = 0x7fefc4b4fff
entry_point = 0x7fefc2a0000
region_type = mapped_file
name = "gdiplus.dll"
filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll")
Region:
id = 245
start_va = 0x12b0000
end_va = 0x12fffff
entry_point = 0x0
region_type = private
name = "private_0x00000000012b0000"
filename = ""
Region:
id = 246
start_va = 0xdc0000
end_va = 0xddafff
entry_point = 0xdc0000
region_type = mapped_file
name = "gdipfontcachev1.dat"
filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat")
Region:
id = 247
start_va = 0x1b300000
end_va = 0x1b3fffff
entry_point = 0x0
region_type = private
name = "private_0x000000001b300000"
filename = ""
Region:
id = 248
start_va = 0x7fffffd5000
end_va = 0x7fffffd6fff
entry_point = 0x0
region_type = private
name = "private_0x000007fffffd5000"
filename = ""
Region:
id = 249
start_va = 0x1af50000
end_va = 0x1b04ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001af50000"
filename = ""
Region:
id = 250
start_va = 0x1b0f0000
end_va = 0x1b16ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001b0f0000"
filename = ""
Region:
id = 251
start_va = 0x1b400000
end_va = 0x1b4aafff
entry_point = 0x1b400000
region_type = mapped_file
name = "tahoma.ttf"
filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf")
Region:
id = 252
start_va = 0x1b400000
end_va = 0x1b4aafff
entry_point = 0x1b400000
region_type = mapped_file
name = "tahoma.ttf"
filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf")
Region:
id = 253
start_va = 0x1b400000
end_va = 0x1c8a8fff
entry_point = 0x1b400000
region_type = mapped_file
name = "msjh.ttf"
filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf")
Region:
id = 254
start_va = 0x1b400000
end_va = 0x1c8a8fff
entry_point = 0x1b400000
region_type = mapped_file
name = "msjh.ttf"
filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf")
Region:
id = 255
start_va = 0x1b400000
end_va = 0x1c8c2fff
entry_point = 0x1b400000
region_type = mapped_file
name = "msyh.ttf"
filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf")
Region:
id = 256
start_va = 0x1b400000
end_va = 0x1c8c2fff
entry_point = 0x1b400000
region_type = mapped_file
name = "msyh.ttf"
filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf")
Region:
id = 257
start_va = 0x1b400000
end_va = 0x1b822fff
entry_point = 0x1b400000
region_type = mapped_file
name = "malgun.ttf"
filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf")
Region:
id = 258
start_va = 0x1b400000
end_va = 0x1b822fff
entry_point = 0x1b400000
region_type = mapped_file
name = "malgun.ttf"
filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf")
Region:
id = 259
start_va = 0x1b830000
end_va = 0x1ba2ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001b830000"
filename = ""
Region:
id = 260
start_va = 0x1b050000
end_va = 0x1b0effff
entry_point = 0x1b050000
region_type = mapped_file
name = "micross.ttf"
filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf")
Region:
id = 261
start_va = 0x1b050000
end_va = 0x1b0effff
entry_point = 0x1b050000
region_type = mapped_file
name = "micross.ttf"
filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf")
Region:
id = 262
start_va = 0x1b050000
end_va = 0x1b0cefff
entry_point = 0x1b050000
region_type = mapped_file
name = "segoeui.ttf"
filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf")
Region:
id = 263
start_va = 0x1b050000
end_va = 0x1b0cefff
entry_point = 0x1b050000
region_type = mapped_file
name = "segoeui.ttf"
filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf")
Region:
id = 264
start_va = 0x12b0000
end_va = 0x12bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000012b0000"
filename = ""
Region:
id = 265
start_va = 0x12c0000
end_va = 0x12e2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000012c0000"
filename = ""
Region:
id = 266
start_va = 0x12f0000
end_va = 0x12fffff
entry_point = 0x0
region_type = private
name = "private_0x00000000012f0000"
filename = ""
Region:
id = 267
start_va = 0x1b410000
end_va = 0x1b41ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001b410000"
filename = ""
Region:
id = 268
start_va = 0x1b420000
end_va = 0x1b42ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001b420000"
filename = ""
Region:
id = 269
start_va = 0x1b430000
end_va = 0x1b43ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001b430000"
filename = ""
Region:
id = 270
start_va = 0x1b450000
end_va = 0x1b45ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001b450000"
filename = ""
Region:
id = 271
start_va = 0x1b530000
end_va = 0x1b72ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001b530000"
filename = ""
Region:
id = 272
start_va = 0x1b7d0000
end_va = 0x1b7dffff
entry_point = 0x0
region_type = private
name = "private_0x000000001b7d0000"
filename = ""
Region:
id = 273
start_va = 0x1ba30000
end_va = 0x1bc2ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001ba30000"
filename = ""
Region:
id = 274
start_va = 0x7ff001e0000
end_va = 0x7ff001effff
entry_point = 0x0
region_type = private
name = "private_0x000007ff001e0000"
filename = ""
Region:
id = 275
start_va = 0x7ff001f0000
end_va = 0x7ff001fffff
entry_point = 0x0
region_type = private
name = "private_0x000007ff001f0000"
filename = ""
Region:
id = 276
start_va = 0x7fefc090000
end_va = 0x7fefc0a7fff
entry_point = 0x7fefc090000
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")
Region:
id = 277
start_va = 0x7fefc670000
end_va = 0x7fefc863fff
entry_point = 0x7fefc670000
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll")
Region:
id = 278
start_va = 0x4f0000
end_va = 0x4f0fff
entry_point = 0x4f0000
region_type = mapped_file
name = "windowsshell.manifest"
filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")
Region:
id = 279
start_va = 0x500000
end_va = 0x501fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000500000"
filename = ""
Region:
id = 280
start_va = 0x1ba30000
end_va = 0x1bb2ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001ba30000"
filename = ""
Region:
id = 281
start_va = 0x1bbb0000
end_va = 0x1bc2ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001bbb0000"
filename = ""
Region:
id = 282
start_va = 0x7fefc520000
end_va = 0x7fefc64bfff
entry_point = 0x7fefc520000
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")
Region:
id = 283
start_va = 0x7feffb10000
end_va = 0x7feffbe6fff
entry_point = 0x7feffb10000
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 284
start_va = 0x4f0000
end_va = 0x4f1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004f0000"
filename = ""
Region:
id = 285
start_va = 0x990000
end_va = 0x990fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000990000"
filename = ""
Region:
id = 286
start_va = 0x7fefef10000
end_va = 0x7fefefa8fff
entry_point = 0x7fefef10000
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 287
start_va = 0xb00000
end_va = 0xb00fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000b00000"
filename = ""
Region:
id = 288
start_va = 0x7fefcb60000
end_va = 0x7fefcb8cfff
entry_point = 0x7fefcb60000
region_type = mapped_file
name = "ntmarta.dll"
filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")
Region:
id = 289
start_va = 0x7feff730000
end_va = 0x7feff781fff
entry_point = 0x7feff730000
region_type = mapped_file
name = "wldap32.dll"
filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")
Region:
id = 290
start_va = 0xd50000
end_va = 0xd53fff
entry_point = 0xd50000
region_type = mapped_file
name = "cversions.1.db"
filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")
Region:
id = 291
start_va = 0xdc0000
end_va = 0xddefff
entry_point = 0xdc0000
region_type = mapped_file
name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"
filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")
Region:
id = 292
start_va = 0xd70000
end_va = 0xd70fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000d70000"
filename = ""
Region:
id = 293
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 294
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 295
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 296
start_va = 0xd50000
end_va = 0xd53fff
entry_point = 0xd50000
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 297
start_va = 0x1300000
end_va = 0x132ffff
entry_point = 0x1300000
region_type = mapped_file
name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db")
Region:
id = 298
start_va = 0x1ae40000
end_va = 0x1ae43fff
entry_point = 0x1ae40000
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 299
start_va = 0x1b050000
end_va = 0x1b0b5fff
entry_point = 0x1b050000
region_type = mapped_file
name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db")
Region:
id = 300
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 301
start_va = 0x1bd90000
end_va = 0x1be8ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001bd90000"
filename = ""
Region:
id = 302
start_va = 0x7fffffd3000
end_va = 0x7fffffd4fff
entry_point = 0x0
region_type = private
name = "private_0x000007fffffd3000"
filename = ""
Region:
id = 303
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 304
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 305
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 306
start_va = 0x7fefdc90000
end_va = 0x7fefdca9fff
entry_point = 0x7fefdc90000
region_type = mapped_file
name = "devobj.dll"
filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")
Region:
id = 307
start_va = 0x7fefde20000
end_va = 0x7fefde55fff
entry_point = 0x7fefde20000
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 308
start_va = 0x7feffbf0000
end_va = 0x7feffdc6fff
entry_point = 0x7feffbf0000
region_type = mapped_file
name = "setupapi.dll"
filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")
Region:
id = 309
start_va = 0x1b0c0000
end_va = 0x1b0c6fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000001b0c0000"
filename = ""
Region:
id = 310
start_va = 0x1b0d0000
end_va = 0x1b0d1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000001b0d0000"
filename = ""
Region:
id = 311
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 312
start_va = 0x1be90000
end_va = 0x1c282fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000001be90000"
filename = ""
Region:
id = 313
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 314
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 315
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 316
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 317
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 318
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 319
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 320
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 321
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 322
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 323
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 324
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 325
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 326
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 327
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 328
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 329
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 330
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 331
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 332
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 333
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 334
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 335
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 336
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 337
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 338
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 339
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 340
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 341
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 342
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 343
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 344
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 345
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 346
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 347
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 348
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 349
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 350
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 351
start_va = 0x1bc30000
end_va = 0x1bd30fff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc30000"
filename = ""
Region:
id = 352
start_va = 0x7fefa4f0000
end_va = 0x7fefa546fff
entry_point = 0x7fefa4f0000
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")
Region:
id = 353
start_va = 0x7fef7870000
end_va = 0x7fef78a3fff
entry_point = 0x7fef7870000
region_type = mapped_file
name = "shdocvw.dll"
filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll")
Region:
id = 354
start_va = 0x1c3c0000
end_va = 0x1c4bffff
entry_point = 0x0
region_type = private
name = "private_0x000000001c3c0000"
filename = ""
Region:
id = 355
start_va = 0x7feff790000
end_va = 0x7feff907fff
entry_point = 0x7feff790000
region_type = mapped_file
name = "urlmon.dll"
filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll")
Region:
id = 356
start_va = 0x7fffff0e000
end_va = 0x7fffff0ffff
entry_point = 0x0
region_type = private
name = "private_0x000007fffff0e000"
filename = ""
Region:
id = 357
start_va = 0x7feff0e0000
end_va = 0x7feff209fff
entry_point = 0x7feff0e0000
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")
Region:
id = 358
start_va = 0x7feff3f0000
end_va = 0x7feff648fff
entry_point = 0x7feff3f0000
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")
Region:
id = 359
start_va = 0x7fefdcb0000
end_va = 0x7fefde16fff
entry_point = 0x7fefdcb0000
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 360
start_va = 0x7fefdc40000
end_va = 0x7fefdc4efff
entry_point = 0x7fefdc40000
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 361
start_va = 0x7fefda60000
end_va = 0x7fefda84fff
entry_point = 0x7fefda60000
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 362
start_va = 0x1b0e0000
end_va = 0x1b0e0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000001b0e0000"
filename = ""
Region:
id = 363
start_va = 0x1c5b0000
end_va = 0x1c6affff
entry_point = 0x0
region_type = private
name = "private_0x000000001c5b0000"
filename = ""
Region:
id = 364
start_va = 0x7fffff0c000
end_va = 0x7fffff0dfff
entry_point = 0x0
region_type = private
name = "private_0x000007fffff0c000"
filename = ""
Region:
id = 392
start_va = 0x1b170000
end_va = 0x1b170fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000001b170000"
filename = ""
Region:
id = 474
start_va = 0x77e10000
end_va = 0x77e16fff
entry_point = 0x77e10000
region_type = mapped_file
name = "psapi.dll"
filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")
Region:
id = 475
start_va = 0x1bc50000
end_va = 0x1bd4ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001bc50000"
filename = ""
Region:
id = 476
start_va = 0x7fffff0a000
end_va = 0x7fffff0bfff
entry_point = 0x0
region_type = private
name = "private_0x000007fffff0a000"
filename = ""
Region:
id = 573
start_va = 0x1b180000
end_va = 0x1b180fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000001b180000"
filename = ""
Region:
id = 574
start_va = 0x516f00000
end_va = 0x516fc5fff
entry_point = 0x516f00000
region_type = mapped_file
name = "diasymreader.dll"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\diasymreader.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\diasymreader.dll")
Region:
id = 598
start_va = 0x748a0000
end_va = 0x74cfdfff
entry_point = 0x748a0000
region_type = mapped_file
name = "mscorlib.dll"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorlib.dll")
Region:
id = 599
start_va = 0x72c70000
end_va = 0x730cdfff
entry_point = 0x72c70000
region_type = mapped_file
name = "mscorlib.dll"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorlib.dll")
Region:
id = 600
start_va = 0x1b460000
end_va = 0x1b51ffff
entry_point = 0x1b460000
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")
Region:
id = 620
start_va = 0x7fef02c0000
end_va = 0x7fef0964fff
entry_point = 0x7fef02c0000
region_type = mapped_file
name = "system.xml.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml\\ee795155543768ea67eecddc686a1e9e\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.xml\\ee795155543768ea67eecddc686a1e9e\\system.xml.ni.dll")
Region:
id = 631
start_va = 0x7ff00200000
end_va = 0x7ff0020ffff
entry_point = 0x0
region_type = private
name = "private_0x000007ff00200000"
filename = ""
Region:
id = 632
start_va = 0x1b190000
end_va = 0x1b19ffff
entry_point = 0x0
region_type = private
name = "private_0x000000001b190000"
filename = ""
Region:
id = 633
start_va = 0x7fefbf20000
end_va = 0x7fefc049fff
entry_point = 0x7fefbf20000
region_type = mapped_file
name = "windowscodecs.dll"
filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll")
Region:
id = 634
start_va = 0x1b1a0000
end_va = 0x1b1a0fff
entry_point = 0x0
region_type = private
name = "private_0x000000001b1a0000"
filename = ""
Region:
id = 635
start_va = 0x1b1b0000
end_va = 0x1b1b0fff
entry_point = 0x0
region_type = private
name = "private_0x000000001b1b0000"
filename = ""
Region:
id = 636
start_va = 0x1c6b0000
end_va = 0x1cfdffff
entry_point = 0x1c6b0000
region_type = mapped_file
name = "staticcache.dat"
filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")
Region:
id = 637
start_va = 0x1b1c0000
end_va = 0x1b1c1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000001b1c0000"
filename = ""
Region:
id = 638
start_va = 0x1b1c0000
end_va = 0x1b1c0fff
entry_point = 0x1b1c0000
region_type = mapped_file
name = "msctf.dll.mui"
filename = "\\Windows\\System32\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msctf.dll.mui")
Region:
id = 639
start_va = 0x1b2d0000
end_va = 0x1b2d1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000001b2d0000"
filename = ""
Region:
id = 640
start_va = 0x1b2d0000
end_va = 0x1b2d2fff
entry_point = 0x0
region_type = private
name = "private_0x000000001b2d0000"
filename = ""
Region:
id = 644
start_va = 0x1b2d0000
end_va = 0x1b2d3fff
entry_point = 0x0
region_type = private
name = "private_0x000000001b2d0000"
filename = ""
Region:
id = 645
start_va = 0x1b2e0000
end_va = 0x1b2e0fff
entry_point = 0x0
region_type = private
name = "private_0x000000001b2e0000"
filename = ""
Region:
id = 646
start_va = 0x1b730000
end_va = 0x1b74cfff
entry_point = 0x0
region_type = private
name = "private_0x000000001b730000"
filename = ""
Region:
id = 647
start_va = 0x1b2f0000
end_va = 0x1b2f0fff
entry_point = 0x0
region_type = private
name = "private_0x000000001b2f0000"
filename = ""
Region:
id = 648
start_va = 0x1b2d0000
end_va = 0x1b2d6fff
entry_point = 0x0
region_type = private
name = "private_0x000000001b2d0000"
filename = ""
Thread:
id = 1
os_tid = 0x968
[0041.705] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0
[0043.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38
[0043.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x2edd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38
[0043.717] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2edc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26
[0043.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26
[0043.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2edd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26
[0043.758] GetVersionExW (in: lpVersionInformation=0x2edd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2edd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0043.789] GetVersionExW (in: lpVersionInformation=0x2edd70*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2edd70*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0047.994] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc13e
[0047.995] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc140
[0048.385] GetVersionExW (in: lpVersionInformation=0x2edb70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2edb70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0048.388] GetCurrentProcess () returned 0xffffffffffffffff
[0048.409] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x2edc08 | out: TokenHandle=0x2edc08*=0x190) returned 1
[0048.631] GetCurrentProcess () returned 0xffffffffffffffff
[0048.631] GetCurrentThread () returned 0xfffffffffffffffe
[0048.631] GetCurrentProcess () returned 0xffffffffffffffff
[0048.656] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x2edb40, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x2edb40*=0x18c) returned 1
[0048.675] GetCurrentThreadId () returned 0x968
[0048.800] GetSystemMetrics (nIndex=75) returned 1
[0049.103] lstrlenW (lpString="䅁") returned 1
[0049.193] GetModuleHandleW (lpModuleName="user32.dll") returned 0x77b50000
[0049.195] GetACP () returned 0x4e4
[0049.275] CoTaskMemAlloc (cb=0x10) returned 0x1ac490
[0049.275] GetProcAddress (hModule=0x77b50000, lpProcName="DefWindowProcW") returned 0x77c7b0ac
[0049.276] CoTaskMemFree (pv=0x1ac490)
[0049.289] GetStockObject (i=5) returned 0x1900015
[0049.291] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000
[0049.293] CoTaskMemAlloc (cb=0x4c) returned 0x18bbc0
[0049.293] RegisterClassW (lpWndClass=0x2ed830) returned 0xc136
[0049.293] CoTaskMemFree (pv=0x18bbc0)
[0049.293] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000
[0049.294] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffffffffffd, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x700f4
[0049.344] SetWindowLongPtrW (hWnd=0x700f4, nIndex=-4, dwNewLong=0x77c7b0ac) returned 0x9a150c
[0049.393] GetWindowLongPtrW (hWnd=0x700f4, nIndex=-4) returned 0x77c7b0ac
[0049.401] lstrlenW (lpString="䅁") returned 1
[0049.410] GetVersionExW (in: lpVersionInformation=0x2eba10*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2eba10*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0049.418] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x2ecac8 | out: phkResult=0x2ecac8*=0x198) returned 0x0
[0049.422] RegQueryValueExW (in: hKey=0x198, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x2eca4c, lpData=0x0, lpcbData=0x2eca48*=0x0 | out: lpType=0x2eca4c*=0x0, lpData=0x0, lpcbData=0x2eca48*=0x0) returned 0x2
[0049.424] RegQueryValueExW (in: hKey=0x198, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x2eca4c, lpData=0x0, lpcbData=0x2eca48*=0x0 | out: lpType=0x2eca4c*=0x0, lpData=0x0, lpcbData=0x2eca48*=0x0) returned 0x2
[0049.426] RegCloseKey (hKey=0x198) returned 0x0
[0049.428] SetWindowLongPtrW (hWnd=0x700f4, nIndex=-4, dwNewLong=0x9a155c) returned 0x77c7b0ac
[0049.429] GetWindowLongPtrW (hWnd=0x700f4, nIndex=-4) returned 0x9a155c
[0049.429] GetWindowLongPtrW (hWnd=0x700f4, nIndex=-16) returned 0x6c10000
[0049.432] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc137
[0049.434] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x700f4, Msg=0x24, wParam=0x0, lParam=0x2ed270) returned 0x0
[0049.434] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc138
[0049.434] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x700f4, Msg=0x81, wParam=0x0, lParam=0x2ed1f0) returned 0x1
[0049.434] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x700f4, Msg=0x83, wParam=0x0, lParam=0x2ed290) returned 0x0
[0049.435] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x700f4, Msg=0x1, wParam=0x0, lParam=0x2ed1f0) returned 0x0
[0049.441] GetClientRect (in: hWnd=0x700f4, lpRect=0x2eca40 | out: lpRect=0x2eca40) returned 1
[0049.441] GetWindowRect (in: hWnd=0x700f4, lpRect=0x2eca40 | out: lpRect=0x2eca40) returned 1
[0049.449] GetParent (hWnd=0x700f4) returned 0x0
[0050.065] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x2ee090, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x64
[0050.089] IsAppThemed () returned 0x1
[0050.092] CoTaskMemAlloc (cb=0xca) returned 0x1b1960
[0050.092] CreateActCtxA (pActCtx=0x2ee528) returned 0x1a4cd8
[0050.183] CoTaskMemFree (pv=0x1b1960)
[0051.262] AdjustWindowRectEx (in: lpRect=0x2ed8d0, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2ed8d0) returned 1
[0051.688] GetSystemDefaultLCID () returned 0x409
[0051.689] GetStockObject (i=17) returned 0x18a0025
[0051.706] GetObjectW (in: h=0x18a0025, c=92, pv=0x2ed440 | out: pv=0x2ed440) returned 92
[0051.708] GetDC (hWnd=0x0) returned 0xb010833
[0051.793] GetCurrentProcessId () returned 0x964
[0051.804] FindAtomW (lpString="GDI+Atom_2404_1") returned 0x0
[0051.806] AddAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0051.905] GdiplusStartup (in: token=0x2ec388, input=0x2ec3a0, output=0x2ec378 | out: token=0x2ec388, output=0x2ec378) returned 0x0
[0051.910] GdipCreateFontFromLogfontW (hdc=0xb010833, logfont=0x1b7a30, font=0x2ed458) returned 0x0
[0052.542] GdipGetFontUnit (font=0x12f41a0, unit=0x2ed360) returned 0x0
[0052.543] GdipGetFontSize (font=0x12f41a0, size=0x2ed360) returned 0x0
[0052.544] GdipGetFontStyle (font=0x12f41a0, style=0x2ed360) returned 0x0
[0052.544] GdipGetFamily (font=0x12f41a0, family=0x2ed360) returned 0x0
[0052.656] GdipGetFontSize (font=0x12f41a0, size=0x2ed2c0) returned 0x0
[0052.656] ReleaseDC (hWnd=0x0, hDC=0xb010833) returned 1
[0052.660] GetDC (hWnd=0x0) returned 0x1701082e
[0052.661] GdipCreateFromHDC (hdc=0x1701082e, graphics=0x2ed420) returned 0x0
[0052.665] GdipGetDpiY (graphics=0x1afad3c0, dpi=0x27a2db0) returned 0x0
[0052.666] GdipGetFontHeight (font=0x12f41a0, graphics=0x1afad3c0, height=0x2ed3f0) returned 0x0
[0052.689] GdipGetEmHeight (family=0x12fc5e0, style=0, EmHeight=0x2ed410) returned 0x0
[0052.691] GdipGetLineSpacing (family=0x12fc5e0, style=0, LineSpacing=0x2ed410) returned 0x0
[0052.715] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0052.716] GdipDeleteGraphics (graphics=0x1afad3c0) returned 0x0
[0052.716] ReleaseDC (hWnd=0x0, hDC=0x1701082e) returned 1
[0052.720] GdipCreateFont (fontFamily=0x12fc5e0, emSize=0x0, style=0, unit=0x3, font=0x2ed4b0) returned 0x0
[0052.720] GdipGetFontSize (font=0x1b013a40, size=0x2ed540) returned 0x0
[0052.731] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0052.731] GdipDeleteFont (font=0x12f41a0) returned 0x0
[0052.733] GetDC (hWnd=0x0) returned 0x1701082e
[0052.733] GdipCreateFromHDC (hdc=0x1701082e, graphics=0x2ed570) returned 0x0
[0052.733] GdipGetFontHeight (font=0x1b013a40, graphics=0x1afad3c0, height=0x2ed540) returned 0x0
[0052.733] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0052.733] GdipDeleteGraphics (graphics=0x1afad3c0) returned 0x0
[0052.733] ReleaseDC (hWnd=0x0, hDC=0x1701082e) returned 1
[0052.734] GetSystemMetrics (nIndex=5) returned 1
[0052.734] GetSystemMetrics (nIndex=6) returned 1
[0052.746] AdjustWindowRectEx (in: lpRect=0x2ed8b0, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2ed8b0) returned 1
[0052.800] GetSystemMetrics (nIndex=5) returned 1
[0052.800] GetSystemMetrics (nIndex=6) returned 1
[0052.802] AdjustWindowRectEx (in: lpRect=0x2ed7f0, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2ed7f0) returned 1
[0053.726] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x2ec3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38
[0053.913] AdjustWindowRectEx (in: lpRect=0x2ed860, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed860) returned 1
[0053.914] GetSystemMetrics (nIndex=59) returned 1460
[0053.914] GetSystemMetrics (nIndex=60) returned 920
[0053.914] GetSystemMetrics (nIndex=34) returned 132
[0053.914] GetSystemMetrics (nIndex=35) returned 38
[0053.915] AdjustWindowRectEx (in: lpRect=0x2ed4e0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed4e0) returned 1
[0053.929] GetCurrentThreadId () returned 0x968
[0053.929] GetCurrentThreadId () returned 0x968
[0053.976] AdjustWindowRectEx (in: lpRect=0x2ed600, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed600) returned 1
[0053.976] AdjustWindowRectEx (in: lpRect=0x2ed7d0, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed7d0) returned 1
[0053.976] GetSystemMetrics (nIndex=59) returned 1460
[0053.976] GetSystemMetrics (nIndex=60) returned 920
[0053.976] AdjustWindowRectEx (in: lpRect=0x2ed280, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed280) returned 1
[0053.976] AdjustWindowRectEx (in: lpRect=0x2ed450, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed450) returned 1
[0054.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", nBufferLength=0x105, lpBuffer=0x2ed3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", lpFilePart=0x0) returned 0x3b
[0054.115] SetErrorMode (uMode=0x1) returned 0x0
[0054.116] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.config"), fInfoLevelId=0x0, lpFileInformation=0x2ed630 | out: lpFileInformation=0x2ed630*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0054.117] SetErrorMode (uMode=0x0) returned 0x1
[0055.644] GetSystemMetrics (nIndex=11) returned 32
[0055.644] GetSystemMetrics (nIndex=12) returned 32
[0055.644] GetDC (hWnd=0x0) returned 0x1701082e
[0055.644] GetDeviceCaps (hdc=0x1701082e, index=12) returned 32
[0055.645] GetDeviceCaps (hdc=0x1701082e, index=14) returned 1
[0055.645] ReleaseDC (hWnd=0x0, hDC=0x1701082e) returned 1
[0055.647] CreateIconFromResourceEx (presbits=0x27fd9d0, dwResSize=0x2e8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x110189
[0055.650] CreateCompatibleDC (hdc=0x0) returned 0x31010818
[0055.653] GetDC (hWnd=0x0) returned 0x1701082e
[0055.653] GdipCreateFromHDC (hdc=0x1701082e, graphics=0x2ed410) returned 0x0
[0055.654] GdipGetLogFontW (font=0x1b013a40, graphics=0x1afad3c0, logfontW=0x1b7a30) returned 0x0
[0055.654] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0055.654] GdipDeleteGraphics (graphics=0x1afad3c0) returned 0x0
[0055.654] ReleaseDC (hWnd=0x0, hDC=0x1701082e) returned 1
[0055.659] CreateFontIndirectW (lplf=0x1b7a30) returned 0x2e0a0218
[0055.668] SelectObject (hdc=0x31010818, h=0x2e0a0218) returned 0x18a002e
[0055.680] GetTextMetricsW (in: hdc=0x31010818, lptm=0x2ed5b0 | out: lptm=0x2ed5b0) returned 1
[0055.681] GetTextExtentPoint32W (in: hdc=0x31010818, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x27fe248 | out: psizl=0x27fe248) returned 1
[0055.683] SelectObject (hdc=0x31010818, h=0x18a002e) returned 0x2e0a0218
[0055.684] DeleteDC (hdc=0x31010818) returned 1
[0055.715] AdjustWindowRectEx (in: lpRect=0x2ed3f0, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed3f0) returned 1
[0055.715] AdjustWindowRectEx (in: lpRect=0x2ed5c0, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed5c0) returned 1
[0055.737] AdjustWindowRectEx (in: lpRect=0x2ed280, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed280) returned 1
[0055.737] AdjustWindowRectEx (in: lpRect=0x2ed450, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed450) returned 1
[0055.739] AdjustWindowRectEx (in: lpRect=0x2ed560, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2ed560) returned 1
[0055.739] AdjustWindowRectEx (in: lpRect=0x2ed480, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2ed480) returned 1
[0055.739] GetSystemMetrics (nIndex=5) returned 1
[0055.739] GetSystemMetrics (nIndex=6) returned 1
[0055.768] GetCurrentActCtx (in: lphActCtx=0x2ee590 | out: lphActCtx=0x2ee590*=0x0) returned 1
[0055.769] ActivateActCtx (in: hActCtx=0x1a4cd8, lpCookie=0x2ee5d0 | out: hActCtx=0x1a4cd8, lpCookie=0x2ee5d0) returned 1
[0055.779] GetCurrentActCtx (in: lphActCtx=0x2edff0 | out: lphActCtx=0x2edff0*=0x1a4cd8) returned 1
[0055.779] AdjustWindowRectEx (in: lpRect=0x2edea0, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2edea0) returned 1
[0055.779] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000
[0055.779] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x2010000, X=-2147483648, Y=-2147483648, nWidth=10, nHeight=10, hWndParent=0x0, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x301b8
[0055.779] SetWindowLongPtrW (hWnd=0x301b8, nIndex=-4, dwNewLong=0x77c7b0ac) returned 0x9a150c
[0055.779] GetWindowLongPtrW (hWnd=0x301b8, nIndex=-4) returned 0x77c7b0ac
[0055.779] SetWindowLongPtrW (hWnd=0x301b8, nIndex=-4, dwNewLong=0x9a15ac) returned 0x77c7b0ac
[0055.779] GetWindowLongPtrW (hWnd=0x301b8, nIndex=-4) returned 0x9a15ac
[0055.779] GetWindowLongPtrW (hWnd=0x301b8, nIndex=-16) returned 0x6c10000
[0055.780] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x81, wParam=0x0, lParam=0x2ed690) returned 0x1
[0055.781] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x83, wParam=0x0, lParam=0x2ed730) returned 0x0
[0055.930] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x1, wParam=0x0, lParam=0x2ed690) returned 0x0
[0055.931] GetClientRect (in: hWnd=0x301b8, lpRect=0x2ecea0 | out: lpRect=0x2ecea0) returned 1
[0055.931] GetWindowRect (in: hWnd=0x301b8, lpRect=0x2ecea0 | out: lpRect=0x2ecea0) returned 1
[0055.931] GetWindowTextLengthW (hWnd=0x301b8) returned 0
[0055.931] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0055.931] GetSystemMetrics (nIndex=42) returned 0
[0055.954] CoTaskMemAlloc (cb=0x6) returned 0x15d570
[0055.954] GetWindowTextW (in: hWnd=0x301b8, lpString=0x15d570, nMaxCount=1 | out: lpString="") returned 0
[0055.954] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xd, wParam=0x1, lParam=0x15d570) returned 0x0
[0055.954] CoTaskMemFree (pv=0x15d570)
[0056.007] GetProcessWindowStation () returned 0x44
[0056.013] GetUserObjectInformationA (in: hObj=0x44, nIndex=1, pvInfo=0x27fee00, nLength=0xc, lpnLengthNeeded=0x2ecb90 | out: pvInfo=0x27fee00, lpnLengthNeeded=0x2ecb90) returned 1
[0056.015] SetConsoleCtrlHandler (HandlerRoutine=0x9a163c, Add=1) returned 1
[0056.015] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000
[0056.016] GetClassInfoW (in: hInstance=0x1330000, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0", lpWndClass=0x27fee88 | out: lpWndClass=0x27fee88) returned 0
[0056.017] CoTaskMemAlloc (cb=0x58) returned 0x18c4c0
[0056.017] RegisterClassW (lpWndClass=0x2ecab0) returned 0xc13a
[0056.017] CoTaskMemFree (pv=0x18c4c0)
[0056.018] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0", lpWindowName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x301ae
[0056.018] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x81, wParam=0x0, lParam=0x2ec2f0) returned 0x1
[0056.018] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x83, wParam=0x0, lParam=0x2ec3a0) returned 0x0
[0056.019] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x1, wParam=0x0, lParam=0x2ec290) returned 0x0
[0056.019] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0
[0056.019] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0
[0056.022] GetStartupInfoW (in: lpStartupInfo=0x27ff488 | out: lpStartupInfo=0x27ff488*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0))
[0056.022] GetParent (hWnd=0x301b8) returned 0x0
[0056.024] SetWindowLongPtrW (hWnd=0x301b8, nIndex=-8, dwNewLong=0x0) returned 0x0
[0056.025] GetSystemMetrics (nIndex=49) returned 16
[0056.025] GetSystemMetrics (nIndex=50) returned 16
[0056.033] CreateIconFromResourceEx (presbits=0x27ff548, dwResSize=0x2e8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x601a1
[0056.035] SendMessageW (hWnd=0x301b8, Msg=0x80, wParam=0x0, lParam=0x601a1) returned 0x0
[0056.036] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x80, wParam=0x0, lParam=0x601a1) returned 0x0
[0056.036] SendMessageW (hWnd=0x301b8, Msg=0x80, wParam=0x1, lParam=0x110189) returned 0x0
[0056.036] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x80, wParam=0x1, lParam=0x110189) returned 0x0
[0056.036] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xd, wParam=0x104, lParam=0x1b104310) returned 0x0
[0056.036] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xd, wParam=0x104, lParam=0x1b104310) returned 0x0
[0056.037] GetSystemMenu (hWnd=0x301b8, bRevert=0) returned 0x0
[0056.038] GetWindowPlacement (in: hWnd=0x301b8, lpwndpl=0x2edeb0 | out: lpwndpl=0x2edeb0) returned 1
[0056.038] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1
[0056.039] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1
[0056.039] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1
[0056.039] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1
[0056.039] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1
[0056.055] GetClientRect (in: hWnd=0x301b8, lpRect=0x2edfd0 | out: lpRect=0x2edfd0) returned 1
[0056.055] GetClientRect (in: hWnd=0x301b8, lpRect=0x2edeb0 | out: lpRect=0x2edeb0) returned 1
[0056.055] GetWindowRect (in: hWnd=0x301b8, lpRect=0x2edeb0 | out: lpRect=0x2edeb0) returned 1
[0056.056] GetWindowLongPtrW (hWnd=0x301b8, nIndex=-16) returned 0x6c10000
[0056.056] GetWindowLongPtrW (hWnd=0x301b8, nIndex=-16) returned 0x6c10000
[0056.056] GetWindowLongPtrW (hWnd=0x301b8, nIndex=-20) returned 0x50100
[0056.057] SetWindowLongPtrW (hWnd=0x301b8, nIndex=-16, dwNewLong=0x2010000) returned 0x6c10000
[0056.057] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x2edef0) returned 0x0
[0056.057] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x2edef0) returned 0x0
[0056.076] SetWindowLongPtrW (hWnd=0x301b8, nIndex=-20, dwNewLong=0x50000) returned 0x50000
[0056.076] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x2edef0) returned 0x0
[0056.076] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x2edef0) returned 0x0
[0056.077] SetWindowPos (hWnd=0x301b8, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1
[0056.077] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x46, wParam=0x0, lParam=0x2edf90) returned 0x0
[0056.077] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x83, wParam=0x1, lParam=0x2edf60) returned 0x0
[0056.078] GetWindowPlacement (in: hWnd=0x301b8, lpwndpl=0x2ed9f0 | out: lpwndpl=0x2ed9f0) returned 1
[0056.079] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x47, wParam=0x0, lParam=0x2edf90) returned 0x0
[0056.093] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x3, wParam=0x0, lParam=0xc800c8) returned 0x0
[0056.093] GetClientRect (in: hWnd=0x301b8, lpRect=0x2ecca0 | out: lpRect=0x2ecca0) returned 1
[0056.093] GetWindowRect (in: hWnd=0x301b8, lpRect=0x2ecca0 | out: lpRect=0x2ecca0) returned 1
[0056.094] GetWindowTextLengthW (hWnd=0x301b8) returned 0
[0056.094] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0056.094] GetSystemMetrics (nIndex=42) returned 0
[0056.094] CoTaskMemAlloc (cb=0x6) returned 0x15d570
[0056.094] GetWindowTextW (in: hWnd=0x301b8, lpString=0x15d570, nMaxCount=1 | out: lpString="") returned 0
[0056.094] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xd, wParam=0x1, lParam=0x15d570) returned 0x0
[0056.094] CoTaskMemFree (pv=0x15d570)
[0056.094] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x5, wParam=0x0, lParam=0x260084) returned 0x0
[0056.095] GetClientRect (in: hWnd=0x301b8, lpRect=0x2ed790 | out: lpRect=0x2ed790) returned 1
[0056.095] GetWindowRect (in: hWnd=0x301b8, lpRect=0x2ed790 | out: lpRect=0x2ed790) returned 1
[0056.096] RedrawWindow (hWnd=0x301b8, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
[0056.097] GetSystemMenu (hWnd=0x301b8, bRevert=0) returned 0x0
[0056.097] GetWindowPlacement (in: hWnd=0x301b8, lpwndpl=0x2edeb0 | out: lpwndpl=0x2edeb0) returned 1
[0056.097] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1
[0056.099] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1
[0056.099] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1
[0056.099] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1
[0056.099] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1
[0056.099] ShowWindow (hWnd=0x301b8, nCmdShow=5) returned 1
[0056.100] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0056.100] GetCurrentActCtx (in: lphActCtx=0x2ed840 | out: lphActCtx=0x2ed840*=0x1a4cd8) returned 1
[0056.101] GetClassInfoW (in: hInstance=0x0, lpClassName="EDIT", lpWndClass=0x27ffa38 | out: lpWndClass=0x27ffa38) returned 1
[0056.969] CoTaskMemAlloc (cb=0x44) returned 0x11c7a60
[0056.969] RegisterClassW (lpWndClass=0x2ed520) returned 0xc13f
[0056.969] CoTaskMemFree (pv=0x11c7a60)
[0056.969] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000
[0056.969] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x560100c0, X=12, Y=239, nWidth=100, nHeight=20, hWndParent=0x301b8, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x301b6
[0056.969] SetWindowLongPtrW (hWnd=0x301b6, nIndex=-4, dwNewLong=0x7fefc71975c) returned 0x9b202c
[0056.969] GetWindowLongPtrW (hWnd=0x301b6, nIndex=-4) returned 0x7fefc71975c
[0056.970] SetWindowLongPtrW (hWnd=0x301b6, nIndex=-4, dwNewLong=0x9b207c) returned 0x7fefc71975c
[0056.970] GetWindowLongPtrW (hWnd=0x301b6, nIndex=-4) returned 0x9b207c
[0056.970] GetWindowLongPtrW (hWnd=0x301b6, nIndex=-16) returned 0x460100c0
[0056.970] GetWindowLongPtrW (hWnd=0x301b6, nIndex=-12) returned 0x0
[0056.970] SetWindowLongPtrW (hWnd=0x301b6, nIndex=-12, dwNewLong=0x301b6) returned 0x0
[0056.970] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0x81, wParam=0x0, lParam=0x2ecee0) returned 0x1
[0056.971] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0x83, wParam=0x0, lParam=0x2ecf80) returned 0x0
[0056.971] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0x1, wParam=0x0, lParam=0x2ecee0) returned 0x1
[0056.974] SendMessageW (hWnd=0x301b6, Msg=0x2055, wParam=0x301b6, lParam=0x3) returned 0x2
[0056.986] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0
[0056.987] GetWindow (hWnd=0x301b6, uCmd=0x3) returned 0x0
[0056.987] GetClientRect (in: hWnd=0x301b6, lpRect=0x2ec730 | out: lpRect=0x2ec730) returned 1
[0056.987] GetWindowRect (in: hWnd=0x301b6, lpRect=0x2ec730 | out: lpRect=0x2ec730) returned 1
[0056.987] GetParent (hWnd=0x301b6) returned 0x301b8
[0056.987] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x301b8, lpPoints=0x2ec720, cPoints=0x2 | out: lpPoints=0x2ec720) returned -13041864
[0056.988] SendMessageW (hWnd=0x301b6, Msg=0x30, wParam=0x2e0a0218, lParam=0x0) returned 0x1
[0056.989] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0x30, wParam=0x2e0a0218, lParam=0x0) returned 0x1
[0056.990] SendMessageW (hWnd=0x301b6, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0
[0056.990] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0
[0056.991] GetSystemMetrics (nIndex=5) returned 1
[0056.991] GetSystemMetrics (nIndex=6) returned 1
[0056.992] SendMessageW (hWnd=0x301b6, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1
[0056.992] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1
[0056.994] SendMessageW (hWnd=0x301b6, Msg=0xd2, wParam=0x0, lParam=0x0) returned 0x0
[0056.994] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0xd2, wParam=0x0, lParam=0x0) returned 0x0
[0057.000] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0x5, wParam=0x0, lParam=0x100060) returned 0x0
[0057.000] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0x3, wParam=0x0, lParam=0xf1000e) returned 0x0
[0057.000] GetClientRect (in: hWnd=0x301b6, lpRect=0x2ec830 | out: lpRect=0x2ec830) returned 1
[0057.000] GetWindowRect (in: hWnd=0x301b6, lpRect=0x2ec830 | out: lpRect=0x2ec830) returned 1
[0057.000] GetParent (hWnd=0x301b6) returned 0x301b8
[0057.000] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x301b8, lpPoints=0x2ec820, cPoints=0x2 | out: lpPoints=0x2ec820) returned -13041864
[0057.001] SendMessageW (hWnd=0x301b6, Msg=0x2210, wParam=0x1b60001, lParam=0x301b6) returned 0x0
[0057.001] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0x2210, wParam=0x1b60001, lParam=0x301b6) returned 0x0
[0057.001] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0057.001] GetParent (hWnd=0x301b6) returned 0x301b8
[0057.004] GetWindowTextLengthW (hWnd=0x301b8) returned 0
[0057.004] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0057.004] GetSystemMetrics (nIndex=42) returned 0
[0057.004] CoTaskMemAlloc (cb=0x6) returned 0x15d570
[0057.004] GetWindowTextW (in: hWnd=0x301b8, lpString=0x15d570, nMaxCount=1 | out: lpString="") returned 0
[0057.004] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xd, wParam=0x1, lParam=0x15d570) returned 0x0
[0057.004] CoTaskMemFree (pv=0x15d570)
[0057.249] CoTaskMemAlloc (cb=0x20c) returned 0x1a6710
[0057.249] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1a6710 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25
[0057.249] CoTaskMemFree (pv=0x1a6710)
[0057.250] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x2ed2e0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e
[0057.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed360, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31
[0057.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31
[0057.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ed250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30
[0057.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x2ed290, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b
[0057.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ed280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30
[0057.280] SetErrorMode (uMode=0x1) returned 0x0
[0057.280] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x2ed490 | out: lpFileInformation=0x2ed490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xed83fc60, ftLastAccessTime.dwHighDateTime=0x1d41168, ftLastWriteTime.dwLowDateTime=0xed83fc60, ftLastWriteTime.dwHighDateTime=0x1d41168, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
[0057.280] SetErrorMode (uMode=0x0) returned 0x1
[0057.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ed280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30
[0057.280] SetErrorMode (uMode=0x1) returned 0x0
[0057.280] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x2ed490 | out: lpFileInformation=0x2ed490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xed83fc60, ftLastAccessTime.dwHighDateTime=0x1d41168, ftLastWriteTime.dwLowDateTime=0xed83fc60, ftLastWriteTime.dwHighDateTime=0x1d41168, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
[0057.280] SetErrorMode (uMode=0x0) returned 0x1
[0057.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x2ed080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b
[0057.284] SetErrorMode (uMode=0x1) returned 0x0
[0057.286] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFindFileData=0x2ed220 | out: lpFindFileData=0x2ed220) returned 0x18c4c0
[0057.289] FindNextFileW (in: hFindFile=0x18c4c0, lpFindFileData=0x2ed230 | out: lpFindFileData=0x2ed230) returned 0
[0057.289] FindClose (in: hFindFile=0x18c4c0 | out: hFindFile=0x18c4c0) returned 1
[0057.289] SetErrorMode (uMode=0x0) returned 0x1
[0057.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\.", nBufferLength=0x105, lpBuffer=0x2ed140, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30
[0057.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe", nBufferLength=0x105, lpBuffer=0x2ed090, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe", lpFilePart=0x0) returned 0x3a
[0057.526] SetErrorMode (uMode=0x1) returned 0x0
[0057.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\templanran.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x1cc
[0057.529] GetFileType (hFile=0x1cc) returned 0x1
[0057.529] SetErrorMode (uMode=0x0) returned 0x1
[0057.529] GetFileType (hFile=0x1cc) returned 0x1
[0057.531] WriteFile (in: hFile=0x1cc, lpBuffer=0x280eee8*, nNumberOfBytesToWrite=0x7400, lpNumberOfBytesWritten=0x2ed648, lpOverlapped=0x0 | out: lpBuffer=0x280eee8*, lpNumberOfBytesWritten=0x2ed648*=0x7400, lpOverlapped=0x0) returned 1
[0057.532] CloseHandle (hObject=0x1cc) returned 1
[0057.627] LocalAlloc (uFlags=0x0, uBytes=0x76) returned 0x1b87b0
[0057.746] ShellExecuteExW (in: pExecInfo=0x2816988*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2816988*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x360)) returned 1
[0062.685] LocalFree (hMem=0x1b87b0) returned 0x0
[0062.957] CoTaskMemAlloc (cb=0x20c) returned 0x1a6b70
[0062.957] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1a6b70 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25
[0062.957] CoTaskMemFree (pv=0x1a6b70)
[0062.957] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x2ed2e0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e
[0062.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed360, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31
[0062.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31
[0062.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ed250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30
[0062.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x2ed290, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b
[0062.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ed280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30
[0062.958] SetErrorMode (uMode=0x1) returned 0x0
[0062.958] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x2ed490 | out: lpFileInformation=0x2ed490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xed83fc60, ftLastAccessTime.dwHighDateTime=0x1d41168, ftLastWriteTime.dwLowDateTime=0xed83fc60, ftLastWriteTime.dwHighDateTime=0x1d41168, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
[0062.958] SetErrorMode (uMode=0x0) returned 0x1
[0062.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ed280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30
[0062.958] SetErrorMode (uMode=0x1) returned 0x0
[0062.958] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x2ed490 | out: lpFileInformation=0x2ed490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xed83fc60, ftLastAccessTime.dwHighDateTime=0x1d41168, ftLastWriteTime.dwLowDateTime=0xed83fc60, ftLastWriteTime.dwHighDateTime=0x1d41168, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1
[0062.958] SetErrorMode (uMode=0x0) returned 0x1
[0062.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x2ed080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b
[0062.958] SetErrorMode (uMode=0x1) returned 0x0
[0062.958] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFindFileData=0x2ed220 | out: lpFindFileData=0x2ed220) returned 0x18c4c0
[0062.959] FindNextFileW (in: hFindFile=0x18c4c0, lpFindFileData=0x2ed230 | out: lpFindFileData=0x2ed230) returned 0
[0062.959] FindClose (in: hFindFile=0x18c4c0 | out: hFindFile=0x18c4c0) returned 1
[0062.959] SetErrorMode (uMode=0x0) returned 0x1
[0062.959] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\.", nBufferLength=0x105, lpBuffer=0x2ed140, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30
[0062.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", nBufferLength=0x105, lpBuffer=0x2ed090, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", lpFilePart=0x0) returned 0x3a
[0062.966] SetErrorMode (uMode=0x1) returned 0x0
[0062.966] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temprunsom.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d8
[0062.967] GetFileType (hFile=0x2d8) returned 0x1
[0062.967] SetErrorMode (uMode=0x0) returned 0x1
[0062.967] GetFileType (hFile=0x2d8) returned 0x1
[0062.967] WriteFile (in: hFile=0x2d8, lpBuffer=0x127a0d98*, nNumberOfBytesToWrite=0x17e00, lpNumberOfBytesWritten=0x2ed648, lpOverlapped=0x0 | out: lpBuffer=0x127a0d98*, lpNumberOfBytesWritten=0x2ed648*=0x17e00, lpOverlapped=0x0) returned 1
[0063.419] CloseHandle (hObject=0x2d8) returned 1
[0063.421] LocalAlloc (uFlags=0x0, uBytes=0x76) returned 0x1b87b0
[0063.421] RtlMoveMemory (in: Destination=0x1b87b0, Source=0x2819648, Length=0x76 | out: Destination=0x1b87b0)
[0063.422] ShellExecuteExW (in: pExecInfo=0x2819d50*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2819d50*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x364)) returned 1
[0063.485] LocalFree (hMem=0x1b87b0) returned 0x0
[0066.576] CoTaskMemAlloc (cb=0x204) returned 0x11c8760
[0066.576] GetUserNameW (in: lpBuffer=0x11c8760, pcbBuffer=0x2ed598 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x2ed598) returned 1
[0066.577] CoTaskMemFree (pv=0x11c8760)
[0066.578] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
[0066.579] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x0, lpConsoleScreenBufferInfo=0x2ed4e0 | out: lpConsoleScreenBufferInfo=0x2ed4e0) returned 0
[0066.579] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
[0066.579] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x0, lpConsoleScreenBufferInfo=0x2ed4e0 | out: lpConsoleScreenBufferInfo=0x2ed4e0) returned 0
[0066.579] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
[0066.579] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x0, lpConsoleScreenBufferInfo=0x2ed4e0 | out: lpConsoleScreenBufferInfo=0x2ed4e0) returned 0
[0066.853] GetCurrentProcessId () returned 0x964
[0066.942] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x2ec410 | out: lpLuid=0x2ec410*(LowPart=0x14, HighPart=0)) returned 1
[0066.943] GetCurrentProcess () returned 0xffffffffffffffff
[0066.943] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x20, TokenHandle=0x2ec430 | out: TokenHandle=0x2ec430*=0x2d0) returned 1
[0066.944] AdjustTokenPrivileges (in: TokenHandle=0x2d0, DisableAllPrivileges=0, NewState=0x281b520*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
[0066.970] CloseHandle (hObject=0x2d0) returned 1
[0066.978] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x964) returned 0x2d0
[0067.118] EnumProcessModules (in: hProcess=0x2d0, lphModule=0x281b588, cb=0x200, lpcbNeeded=0x2ed448 | out: lphModule=0x281b588, lpcbNeeded=0x2ed448) returned 1
[0067.120] GetModuleInformation (in: hProcess=0x2d0, hModule=0x1330000, lpmodinfo=0x281b7f8, cb=0x18 | out: lpmodinfo=0x281b7f8*(lpBaseOfDll=0x1330000, SizeOfImage=0x3c000, EntryPoint=0x1356ffe)) returned 1
[0067.121] CoTaskMemAlloc (cb=0x804) returned 0x11d06d0
[0067.121] GetModuleBaseNameW (in: hProcess=0x2d0, hModule=0x1330000, lpBaseName=0x11d06d0, nSize=0x800 | out: lpBaseName="KryptoTrojaner.exe") returned 0x12
[0067.121] CoTaskMemFree (pv=0x11d06d0)
[0067.122] CoTaskMemAlloc (cb=0x804) returned 0x11d06d0
[0067.122] GetModuleFileNameExW (in: hProcess=0x2d0, hModule=0x1330000, lpFilename=0x11d06d0, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe")) returned 0x38
[0067.122] CoTaskMemFree (pv=0x11d06d0)
[0067.122] CloseHandle (hObject=0x2d0) returned 1
[0067.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", nBufferLength=0x105, lpBuffer=0x2ece10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", lpFilePart=0x0) returned 0x38
[0067.128] SetErrorMode (uMode=0x1) returned 0x0
[0067.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\@___readme___@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2d0
[0067.129] GetFileType (hFile=0x2d0) returned 0x1
[0067.129] SetErrorMode (uMode=0x0) returned 0x1
[0067.129] GetFileType (hFile=0x2d0) returned 0x1
[0067.145] WriteFile (in: hFile=0x2d0, lpBuffer=0x2820398*, nNumberOfBytesToWrite=0x696, lpNumberOfBytesWritten=0x2ed378, lpOverlapped=0x0 | out: lpBuffer=0x2820398*, lpNumberOfBytesWritten=0x2ed378*=0x696, lpOverlapped=0x0) returned 1
[0067.147] LocalAlloc (uFlags=0x0, uBytes=0x72) returned 0x1b87b0
[0067.148] RtlMoveMemory (in: Destination=0x1b87b0, Source=0x281dbe8, Length=0x72 | out: Destination=0x1b87b0)
[0067.148] ShellExecuteExW (in: pExecInfo=0x2821b68*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2821b68*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x378)) returned 1
[0067.245] LocalFree (hMem=0x1b87b0) returned 0x0
[0067.739] CoTaskMemAlloc (cb=0x204) returned 0x11c8760
[0067.739] GetUserNameW (in: lpBuffer=0x11c8760, pcbBuffer=0x2ed7b8 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x2ed7b8) returned 1
[0067.739] CoTaskMemFree (pv=0x11c8760)
[0067.815] GetWindowTextLengthW (hWnd=0x301b6) returned 0
[0067.815] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0067.815] GetSystemMetrics (nIndex=42) returned 0
[0067.815] CoTaskMemAlloc (cb=0x6) returned 0x1b57ea80
[0067.815] GetWindowTextW (in: hWnd=0x301b6, lpString=0x1b57ea80, nMaxCount=1 | out: lpString="") returned 0
[0067.815] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0xd, wParam=0x1, lParam=0x1b57ea80) returned 0x0
[0067.815] CoTaskMemFree (pv=0x1b57ea80)
[0067.815] GetFullPathNameW (in: lpFileName="C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html", nBufferLength=0x105, lpBuffer=0x2ed030, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html", lpFilePart=0x0) returned 0x2b
[0067.815] SetErrorMode (uMode=0x1) returned 0x0
[0067.816] CreateFileW (lpFileName="C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html" (normalized: "c:\\users\\cerberos\\desktop\\instructions.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0068.643] SetErrorMode (uMode=0x0) returned 0x1
[0068.772] GetProcessWindowStation () returned 0x44
[0068.850] GetUserObjectInformationA (in: hObj=0x44, nIndex=1, pvInfo=0x2823f88, nLength=0xc, lpnLengthNeeded=0x2eaf10 | out: pvInfo=0x2823f88, lpnLengthNeeded=0x2eaf10) returned 1
[0069.164] AdjustWindowRectEx (in: lpRect=0x2ead50, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ead50) returned 1
[0071.003] AdjustWindowRectEx (in: lpRect=0x2ead60, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ead60) returned 1
[0071.051] AdjustWindowRectEx (in: lpRect=0x2ead20, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ead20) returned 1
[0071.052] AdjustWindowRectEx (in: lpRect=0x2ead20, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ead20) returned 1
[0071.052] AdjustWindowRectEx (in: lpRect=0x2ead20, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ead20) returned 1
[0071.052] AdjustWindowRectEx (in: lpRect=0x2ead20, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ead20) returned 1
[0071.053] GetDC (hWnd=0x0) returned 0x1701082e
[0071.053] GdipCreateFromHDC (hdc=0x1701082e, graphics=0x2eaa20) returned 0x0
[0071.053] GdipGetFontHeight (font=0x1b013a40, graphics=0x1afad3c0, height=0x2ea9f0) returned 0x0
[0071.053] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0071.053] GdipDeleteGraphics (graphics=0x1afad3c0) returned 0x0
[0071.053] ReleaseDC (hWnd=0x0, hDC=0x1701082e) returned 1
[0071.053] GetSystemMetrics (nIndex=5) returned 1
[0071.053] GetSystemMetrics (nIndex=6) returned 1
[0071.053] AdjustWindowRectEx (in: lpRect=0x2ead60, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2ead60) returned 1
[0071.054] AdjustWindowRectEx (in: lpRect=0x2eac60, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2eac60) returned 1
[0072.499] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x2ea870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3c
[0072.701] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x2ea9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3c
[0072.701] SetErrorMode (uMode=0x1) returned 0x0
[0072.701] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorlib.dll"), fInfoLevelId=0x0, lpFileInformation=0x2eac00 | out: lpFileInformation=0x2eac00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4cf0e8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8e4cf0e8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8e541509, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x45b000)) returned 1
[0072.701] SetErrorMode (uMode=0x0) returned 0x1
[0072.703] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", lpdwHandle=0x2eae70 | out: lpdwHandle=0x2eae70) returned 0x7dc
[0072.902] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", dwHandle=0x0, dwLen=0x7dc, lpData=0x28455e8 | out: lpData=0x28455e8) returned 1
[0072.919] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2eade8, puLen=0x2eade0 | out: lplpBuffer=0x2eade8*=0x28459d0, puLen=0x2eade0) returned 1
[0072.922] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28456a0, puLen=0x2ead50) returned 1
[0072.926] lstrlenW (lpString="Microsoft Corporation") returned 21
[0072.931] CoTaskMemAlloc (cb=0x2e) returned 0x1b57a9e0
[0072.931] lstrcpyW (in: lpString1=0x1b57a9e0, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation"
[0072.931] CoTaskMemFree (pv=0x1b57a9e0)
[0072.932] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28456f4, puLen=0x2ead50) returned 1
[0072.932] lstrlenW (lpString="Microsoft Common Language Runtime Class Library") returned 47
[0072.932] CoTaskMemAlloc (cb=0x62) returned 0x1b54a9d0
[0072.932] lstrcpyW (in: lpString1=0x1b54a9d0, lpString2="Microsoft Common Language Runtime Class Library" | out: lpString1="Microsoft Common Language Runtime Class Library") returned="Microsoft Common Language Runtime Class Library"
[0072.932] CoTaskMemFree (pv=0x1b54a9d0)
[0072.933] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2845774, puLen=0x2ead50) returned 1
[0072.933] lstrlenW (lpString="2.0.50727.5420 (Win7SP1.050727-5400)") returned 36
[0072.933] CoTaskMemAlloc (cb=0x4c) returned 0x1b553920
[0072.933] lstrcpyW (in: lpString1=0x1b553920, lpString2="2.0.50727.5420 (Win7SP1.050727-5400)" | out: lpString1="2.0.50727.5420 (Win7SP1.050727-5400)") returned="2.0.50727.5420 (Win7SP1.050727-5400)"
[0072.934] CoTaskMemFree (pv=0x1b553920)
[0072.934] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28457e0, puLen=0x2ead50) returned 1
[0072.934] lstrlenW (lpString="mscorlib.dll") returned 12
[0072.934] CoTaskMemAlloc (cb=0x1c) returned 0x1b56fce0
[0072.934] lstrcpyW (in: lpString1=0x1b56fce0, lpString2="mscorlib.dll" | out: lpString1="mscorlib.dll") returned="mscorlib.dll"
[0072.934] CoTaskMemFree (pv=0x1b56fce0)
[0072.935] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2845820, puLen=0x2ead50) returned 1
[0072.935] lstrlenW (lpString="© Microsoft Corporation. All rights reserved.") returned 46
[0072.935] CoTaskMemAlloc (cb=0x60) returned 0x1b54a9d0
[0072.935] lstrcpyW (in: lpString1=0x1b54a9d0, lpString2="© Microsoft Corporation. All rights reserved." | out: lpString1="© Microsoft Corporation. All rights reserved.") returned="© Microsoft Corporation. All rights reserved."
[0072.935] CoTaskMemFree (pv=0x1b54a9d0)
[0072.936] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28458a8, puLen=0x2ead50) returned 1
[0072.957] lstrlenW (lpString="mscorlib.dll") returned 12
[0072.957] CoTaskMemAlloc (cb=0x1c) returned 0x1b56fce0
[0072.957] lstrcpyW (in: lpString1=0x1b56fce0, lpString2="mscorlib.dll" | out: lpString1="mscorlib.dll") returned="mscorlib.dll"
[0072.957] CoTaskMemFree (pv=0x1b56fce0)
[0072.957] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28458e4, puLen=0x2ead50) returned 1
[0072.957] lstrlenW (lpString="Microsoft® .NET Framework") returned 25
[0072.957] CoTaskMemAlloc (cb=0x36) returned 0x1b57a9e0
[0072.957] lstrcpyW (in: lpString1=0x1b57a9e0, lpString2="Microsoft® .NET Framework" | out: lpString1="Microsoft® .NET Framework") returned="Microsoft® .NET Framework"
[0072.957] CoTaskMemFree (pv=0x1b57a9e0)
[0072.957] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x284593c, puLen=0x2ead50) returned 1
[0072.957] lstrlenW (lpString="2.0.50727.5420") returned 14
[0072.957] CoTaskMemAlloc (cb=0x20) returned 0x1b56fce0
[0072.957] lstrcpyW (in: lpString1=0x1b56fce0, lpString2="2.0.50727.5420" | out: lpString1="2.0.50727.5420") returned="2.0.50727.5420"
[0072.958] CoTaskMemFree (pv=0x1b56fce0)
[0072.958] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2845974, puLen=0x2ead50) returned 1
[0072.958] lstrlenW (lpString="Flavor=Retail") returned 13
[0072.958] CoTaskMemAlloc (cb=0x1e) returned 0x1b56fce0
[0072.958] lstrcpyW (in: lpString1=0x1b56fce0, lpString2="Flavor=Retail" | out: lpString1="Flavor=Retail") returned="Flavor=Retail"
[0072.958] CoTaskMemFree (pv=0x1b56fce0)
[0072.958] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0072.958] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0072.958] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0072.958] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ead28, puLen=0x2ead20 | out: lplpBuffer=0x2ead28*=0x28459d0, puLen=0x2ead20) returned 1
[0072.959] CoTaskMemAlloc (cb=0x204) returned 0x1b57b350
[0072.959] VerLanguageNameW (in: wLang=0x409, szLang=0x1b57b350, cchLang=0x100 | out: szLang="English (United States)") returned 0x17
[0073.002] CoTaskMemFree (pv=0x1b57b350)
[0073.002] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\", lplpBuffer=0x2ead78, puLen=0x2ead70 | out: lplpBuffer=0x2ead78*=0x2845610, puLen=0x2ead70) returned 1
[0073.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x2ea870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38
[0073.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", nBufferLength=0x105, lpBuffer=0x2ea8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", lpFilePart=0x0) returned 0x3b
[0073.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", nBufferLength=0x105, lpBuffer=0x2ea7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", lpFilePart=0x0) returned 0x3b
[0073.006] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x2ea7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\", lpFilePart=0x0) returned 0x30
[0073.800] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x2ea780, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x45
[0073.801] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x2ea610, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x45
[0073.801] SetErrorMode (uMode=0x1) returned 0x0
[0073.801] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x374
[0073.802] GetFileType (hFile=0x374) returned 0x1
[0073.802] SetErrorMode (uMode=0x0) returned 0x1
[0073.802] GetFileType (hFile=0x374) returned 0x1
[0073.878] GetFileSize (in: hFile=0x374, lpFileSizeHigh=0x2eaa88 | out: lpFileSizeHigh=0x2eaa88*=0x0) returned 0x622a
[0073.886] ReadFile (in: hFile=0x374, lpBuffer=0x284aef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ea9a8, lpOverlapped=0x0 | out: lpBuffer=0x284aef8*, lpNumberOfBytesRead=0x2ea9a8*=0x1000, lpOverlapped=0x0) returned 1
[0073.910] ReadFile (in: hFile=0x374, lpBuffer=0x284aef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ea8e8, lpOverlapped=0x0 | out: lpBuffer=0x284aef8*, lpNumberOfBytesRead=0x2ea8e8*=0x1000, lpOverlapped=0x0) returned 1
[0073.910] ReadFile (in: hFile=0x374, lpBuffer=0x284aef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ea8e8, lpOverlapped=0x0 | out: lpBuffer=0x284aef8*, lpNumberOfBytesRead=0x2ea8e8*=0x1000, lpOverlapped=0x0) returned 1
[0073.910] ReadFile (in: hFile=0x374, lpBuffer=0x284aef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ea8e8, lpOverlapped=0x0 | out: lpBuffer=0x284aef8*, lpNumberOfBytesRead=0x2ea8e8*=0x1000, lpOverlapped=0x0) returned 1
[0073.910] ReadFile (in: hFile=0x374, lpBuffer=0x284aef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ea8e8, lpOverlapped=0x0 | out: lpBuffer=0x284aef8*, lpNumberOfBytesRead=0x2ea8e8*=0x1000, lpOverlapped=0x0) returned 1
[0073.910] ReadFile (in: hFile=0x374, lpBuffer=0x284aef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ea8e8, lpOverlapped=0x0 | out: lpBuffer=0x284aef8*, lpNumberOfBytesRead=0x2ea8e8*=0x1000, lpOverlapped=0x0) returned 1
[0073.910] ReadFile (in: hFile=0x374, lpBuffer=0x284aef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ea948, lpOverlapped=0x0 | out: lpBuffer=0x284aef8*, lpNumberOfBytesRead=0x2ea948*=0x22a, lpOverlapped=0x0) returned 1
[0073.910] ReadFile (in: hFile=0x374, lpBuffer=0x284aef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ea9a8, lpOverlapped=0x0 | out: lpBuffer=0x284aef8*, lpNumberOfBytesRead=0x2ea9a8*=0x0, lpOverlapped=0x0) returned 1
[0073.911] CloseHandle (hObject=0x374) returned 1
[0073.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", nBufferLength=0x105, lpBuffer=0x2ea780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", lpFilePart=0x0) returned 0x3b
[0073.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", nBufferLength=0x105, lpBuffer=0x2ea610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", lpFilePart=0x0) returned 0x3b
[0073.937] SetErrorMode (uMode=0x1) returned 0x0
[0073.937] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff
[0074.180] SetErrorMode (uMode=0x0) returned 0x1
[0074.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x2ea9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38
[0074.182] SetErrorMode (uMode=0x1) returned 0x0
[0074.182] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe"), fInfoLevelId=0x0, lpFileInformation=0x2eac00 | out: lpFileInformation=0x2eac00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f30a660, ftCreationTime.dwHighDateTime=0x1d3b054, ftLastAccessTime.dwLowDateTime=0x8f30a660, ftLastAccessTime.dwHighDateTime=0x1d3b054, ftLastWriteTime.dwLowDateTime=0xd9447400, ftLastWriteTime.dwHighDateTime=0x1d41168, nFileSizeHigh=0x0, nFileSizeLow=0x34400)) returned 1
[0074.182] SetErrorMode (uMode=0x0) returned 0x1
[0074.182] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpdwHandle=0x2eae70 | out: lpdwHandle=0x2eae70) returned 0x504
[0074.183] GetFileVersionInfoW (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", dwHandle=0x0, dwLen=0x504, lpData=0x28536e8 | out: lpData=0x28536e8) returned 1
[0074.183] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2eade8, puLen=0x2eade0 | out: lplpBuffer=0x2eade8*=0x2853784, puLen=0x2eade0) returned 1
[0074.183] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.183] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28537ec, puLen=0x2ead50) returned 1
[0074.183] lstrlenW (lpString="get") returned 3
[0074.183] CoTaskMemAlloc (cb=0xa) returned 0x1b56f3c0
[0074.183] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="get" | out: lpString1="get") returned="get"
[0074.183] CoTaskMemFree (pv=0x1b56f3c0)
[0074.183] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2853814, puLen=0x2ead50) returned 1
[0074.183] lstrlenW (lpString="1.0.0.0") returned 7
[0074.183] CoTaskMemAlloc (cb=0x12) returned 0x1b56f3c0
[0074.183] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="1.0.0.0" | out: lpString1="1.0.0.0") returned="1.0.0.0"
[0074.183] CoTaskMemFree (pv=0x1b56f3c0)
[0074.183] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2853844, puLen=0x2ead50) returned 1
[0074.183] lstrlenW (lpString="get.exe") returned 7
[0074.183] CoTaskMemAlloc (cb=0x12) returned 0x1b56f3c0
[0074.183] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="get.exe" | out: lpString1="get.exe") returned="get.exe"
[0074.184] CoTaskMemFree (pv=0x1b56f3c0)
[0074.184] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2853878, puLen=0x2ead50) returned 1
[0074.184] lstrlenW (lpString="Copyright © 2017") returned 17
[0074.184] CoTaskMemAlloc (cb=0x26) returned 0x1b570250
[0074.184] lstrcpyW (in: lpString1=0x1b570250, lpString2="Copyright © 2017" | out: lpString1="Copyright © 2017") returned="Copyright © 2017"
[0074.184] CoTaskMemFree (pv=0x1b570250)
[0074.184] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28538c4, puLen=0x2ead50) returned 1
[0074.184] lstrlenW (lpString="get.exe") returned 7
[0074.184] CoTaskMemAlloc (cb=0x12) returned 0x1b56f3c0
[0074.184] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="get.exe" | out: lpString1="get.exe") returned="get.exe"
[0074.184] CoTaskMemFree (pv=0x1b56f3c0)
[0074.184] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28538f4, puLen=0x2ead50) returned 1
[0074.184] lstrlenW (lpString="get") returned 3
[0074.184] CoTaskMemAlloc (cb=0xa) returned 0x1b56f3c0
[0074.184] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="get" | out: lpString1="get") returned="get"
[0074.184] CoTaskMemFree (pv=0x1b56f3c0)
[0074.184] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2853920, puLen=0x2ead50) returned 1
[0074.184] lstrlenW (lpString="1.0.0.0") returned 7
[0074.184] CoTaskMemAlloc (cb=0x12) returned 0x1b56f3c0
[0074.184] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="1.0.0.0" | out: lpString1="1.0.0.0") returned="1.0.0.0"
[0074.184] CoTaskMemFree (pv=0x1b56f3c0)
[0074.184] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.185] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.185] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.185] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.185] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ead28, puLen=0x2ead20 | out: lplpBuffer=0x2ead28*=0x2853784, puLen=0x2ead20) returned 1
[0074.185] CoTaskMemAlloc (cb=0x204) returned 0x1b57b350
[0074.185] VerLanguageNameW (in: wLang=0x0, szLang=0x1b57b350, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10
[0074.185] CoTaskMemFree (pv=0x1b57b350)
[0074.185] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\", lplpBuffer=0x2ead78, puLen=0x2ead70 | out: lplpBuffer=0x2ead78*=0x2853710, puLen=0x2ead70) returned 1
[0074.185] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll", nBufferLength=0x105, lpBuffer=0x2ea870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll", lpFilePart=0x0) returned 0x66
[0074.186] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll", nBufferLength=0x105, lpBuffer=0x2ea9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll", lpFilePart=0x0) returned 0x66
[0074.186] SetErrorMode (uMode=0x1) returned 0x0
[0074.186] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualbasic\\8.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll"), fInfoLevelId=0x0, lpFileInformation=0x2eac00 | out: lpFileInformation=0x2eac00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97baa43e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97baa43e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97bf66ff, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x95000)) returned 1
[0074.187] SetErrorMode (uMode=0x0) returned 0x1
[0074.187] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll", lpdwHandle=0x2eae70 | out: lpdwHandle=0x2eae70) returned 0x79c
[0074.327] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll", dwHandle=0x0, dwLen=0x79c, lpData=0x28573d0 | out: lpData=0x28573d0) returned 1
[0074.328] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2eade8, puLen=0x2eade0 | out: lplpBuffer=0x2eade8*=0x2857798, puLen=0x2eade0) returned 1
[0074.328] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2857488, puLen=0x2ead50) returned 1
[0074.328] lstrlenW (lpString="Microsoft Corporation") returned 21
[0074.328] CoTaskMemAlloc (cb=0x2e) returned 0x1b579b60
[0074.328] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation"
[0074.328] CoTaskMemFree (pv=0x1b579b60)
[0074.328] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28574dc, puLen=0x2ead50) returned 1
[0074.328] lstrlenW (lpString="Visual Basic Runtime Library") returned 28
[0074.328] CoTaskMemAlloc (cb=0x3c) returned 0x1b56d6e0
[0074.329] lstrcpyW (in: lpString1=0x1b56d6e0, lpString2="Visual Basic Runtime Library" | out: lpString1="Visual Basic Runtime Library") returned="Visual Basic Runtime Library"
[0074.329] CoTaskMemFree (pv=0x1b56d6e0)
[0074.329] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2857538, puLen=0x2ead50) returned 1
[0074.329] lstrlenW (lpString="8.0.50727.5420 (Win7SP1.050727-5400)") returned 36
[0074.329] CoTaskMemAlloc (cb=0x4c) returned 0x1b553920
[0074.329] lstrcpyW (in: lpString1=0x1b553920, lpString2="8.0.50727.5420 (Win7SP1.050727-5400)" | out: lpString1="8.0.50727.5420 (Win7SP1.050727-5400)") returned="8.0.50727.5420 (Win7SP1.050727-5400)"
[0074.329] CoTaskMemFree (pv=0x1b553920)
[0074.329] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28575a4, puLen=0x2ead50) returned 1
[0074.329] lstrlenW (lpString="Microsoft.VisualBasic.DLL") returned 25
[0074.329] CoTaskMemAlloc (cb=0x36) returned 0x1b579b60
[0074.329] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft.VisualBasic.DLL" | out: lpString1="Microsoft.VisualBasic.DLL") returned="Microsoft.VisualBasic.DLL"
[0074.329] CoTaskMemFree (pv=0x1b579b60)
[0074.329] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28575fc, puLen=0x2ead50) returned 1
[0074.329] lstrlenW (lpString="© Microsoft Corporation. All rights reserved.") returned 45
[0074.329] CoTaskMemAlloc (cb=0x5e) returned 0x1b591710
[0074.329] lstrcpyW (in: lpString1=0x1b591710, lpString2="© Microsoft Corporation. All rights reserved." | out: lpString1="© Microsoft Corporation. All rights reserved.") returned="© Microsoft Corporation. All rights reserved."
[0074.329] CoTaskMemFree (pv=0x1b591710)
[0074.329] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2857680, puLen=0x2ead50) returned 1
[0074.329] lstrlenW (lpString="Microsoft.VisualBasic.DLL") returned 25
[0074.329] CoTaskMemAlloc (cb=0x36) returned 0x1b579b60
[0074.329] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft.VisualBasic.DLL" | out: lpString1="Microsoft.VisualBasic.DLL") returned="Microsoft.VisualBasic.DLL"
[0074.329] CoTaskMemFree (pv=0x1b579b60)
[0074.329] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28576d4, puLen=0x2ead50) returned 1
[0074.330] lstrlenW (lpString="Microsoft® Visual Studio® 2005") returned 30
[0074.330] CoTaskMemAlloc (cb=0x40) returned 0x1b56d6e0
[0074.330] lstrcpyW (in: lpString1=0x1b56d6e0, lpString2="Microsoft® Visual Studio® 2005" | out: lpString1="Microsoft® Visual Studio® 2005") returned="Microsoft® Visual Studio® 2005"
[0074.330] CoTaskMemFree (pv=0x1b56d6e0)
[0074.330] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2857738, puLen=0x2ead50) returned 1
[0074.330] lstrlenW (lpString="8.0.50727.5420") returned 14
[0074.330] CoTaskMemAlloc (cb=0x20) returned 0x1b570250
[0074.330] lstrcpyW (in: lpString1=0x1b570250, lpString2="8.0.50727.5420" | out: lpString1="8.0.50727.5420") returned="8.0.50727.5420"
[0074.330] CoTaskMemFree (pv=0x1b570250)
[0074.330] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.330] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.330] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.330] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.330] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ead28, puLen=0x2ead20 | out: lplpBuffer=0x2ead28*=0x2857798, puLen=0x2ead20) returned 1
[0074.330] CoTaskMemAlloc (cb=0x204) returned 0x1b57b350
[0074.330] VerLanguageNameW (in: wLang=0x409, szLang=0x1b57b350, cchLang=0x100 | out: szLang="English (United States)") returned 0x17
[0074.330] CoTaskMemFree (pv=0x1b57b350)
[0074.330] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\", lplpBuffer=0x2ead78, puLen=0x2ead70 | out: lplpBuffer=0x2ead78*=0x28573f8, puLen=0x2ead70) returned 1
[0074.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x2ea870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48
[0074.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x2ea9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48
[0074.331] SetErrorMode (uMode=0x1) returned 0x0
[0074.331] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system\\2.0.0.0__b77a5c561934e089\\system.dll"), fInfoLevelId=0x0, lpFileInformation=0x2eac00 | out: lpFileInformation=0x2eac00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x850a1657, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x850a1657, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x853e749d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x30b000)) returned 1
[0074.332] SetErrorMode (uMode=0x0) returned 0x1
[0074.332] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpdwHandle=0x2eae70 | out: lpdwHandle=0x2eae70) returned 0x74c
[0074.590] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", dwHandle=0x0, dwLen=0x74c, lpData=0x285b3b8 | out: lpData=0x285b3b8) returned 1
[0074.591] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2eade8, puLen=0x2eade0 | out: lplpBuffer=0x2eade8*=0x285b758, puLen=0x2eade0) returned 1
[0074.591] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b470, puLen=0x2ead50) returned 1
[0074.591] lstrlenW (lpString="Microsoft Corporation") returned 21
[0074.591] CoTaskMemAlloc (cb=0x2e) returned 0x1b579b60
[0074.591] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation"
[0074.591] CoTaskMemFree (pv=0x1b579b60)
[0074.591] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b4c4, puLen=0x2ead50) returned 1
[0074.591] lstrlenW (lpString=".NET Framework") returned 14
[0074.591] CoTaskMemAlloc (cb=0x20) returned 0x1b570250
[0074.591] lstrcpyW (in: lpString1=0x1b570250, lpString2=".NET Framework" | out: lpString1=".NET Framework") returned=".NET Framework"
[0074.591] CoTaskMemFree (pv=0x1b570250)
[0074.591] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b504, puLen=0x2ead50) returned 1
[0074.591] lstrlenW (lpString="2.0.50727.5420 (Win7SP1.050727-5400)") returned 36
[0074.591] CoTaskMemAlloc (cb=0x4c) returned 0x1b553920
[0074.591] lstrcpyW (in: lpString1=0x1b553920, lpString2="2.0.50727.5420 (Win7SP1.050727-5400)" | out: lpString1="2.0.50727.5420 (Win7SP1.050727-5400)") returned="2.0.50727.5420 (Win7SP1.050727-5400)"
[0074.591] CoTaskMemFree (pv=0x1b553920)
[0074.591] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b570, puLen=0x2ead50) returned 1
[0074.591] lstrlenW (lpString="System.dll") returned 10
[0074.592] CoTaskMemAlloc (cb=0x18) returned 0x1b56f3c0
[0074.592] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="System.dll" | out: lpString1="System.dll") returned="System.dll"
[0074.592] CoTaskMemFree (pv=0x1b56f3c0)
[0074.592] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b5ac, puLen=0x2ead50) returned 1
[0074.592] lstrlenW (lpString="© Microsoft Corporation. All rights reserved.") returned 46
[0074.592] CoTaskMemAlloc (cb=0x60) returned 0x1b591710
[0074.592] lstrcpyW (in: lpString1=0x1b591710, lpString2="© Microsoft Corporation. All rights reserved." | out: lpString1="© Microsoft Corporation. All rights reserved.") returned="© Microsoft Corporation. All rights reserved."
[0074.592] CoTaskMemFree (pv=0x1b591710)
[0074.592] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b634, puLen=0x2ead50) returned 1
[0074.592] lstrlenW (lpString="System.dll") returned 10
[0074.592] CoTaskMemAlloc (cb=0x18) returned 0x1b56f3c0
[0074.592] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="System.dll" | out: lpString1="System.dll") returned="System.dll"
[0074.592] CoTaskMemFree (pv=0x1b56f3c0)
[0074.592] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b66c, puLen=0x2ead50) returned 1
[0074.592] lstrlenW (lpString="Microsoft® .NET Framework") returned 25
[0074.592] CoTaskMemAlloc (cb=0x36) returned 0x1b579b60
[0074.592] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft® .NET Framework" | out: lpString1="Microsoft® .NET Framework") returned="Microsoft® .NET Framework"
[0074.592] CoTaskMemFree (pv=0x1b579b60)
[0074.592] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b6c4, puLen=0x2ead50) returned 1
[0074.592] lstrlenW (lpString="2.0.50727.5420") returned 14
[0074.592] CoTaskMemAlloc (cb=0x20) returned 0x1b570250
[0074.592] lstrcpyW (in: lpString1=0x1b570250, lpString2="2.0.50727.5420" | out: lpString1="2.0.50727.5420") returned="2.0.50727.5420"
[0074.592] CoTaskMemFree (pv=0x1b570250)
[0074.592] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b6fc, puLen=0x2ead50) returned 1
[0074.592] lstrlenW (lpString="Flavor=Retail") returned 13
[0074.592] CoTaskMemAlloc (cb=0x1e) returned 0x1b570250
[0074.592] lstrcpyW (in: lpString1=0x1b570250, lpString2="Flavor=Retail" | out: lpString1="Flavor=Retail") returned="Flavor=Retail"
[0074.593] CoTaskMemFree (pv=0x1b570250)
[0074.593] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.593] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.593] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.593] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ead28, puLen=0x2ead20 | out: lplpBuffer=0x2ead28*=0x285b758, puLen=0x2ead20) returned 1
[0074.593] CoTaskMemAlloc (cb=0x204) returned 0x1b57b350
[0074.593] VerLanguageNameW (in: wLang=0x409, szLang=0x1b57b350, cchLang=0x100 | out: szLang="English (United States)") returned 0x17
[0074.593] CoTaskMemFree (pv=0x1b57b350)
[0074.593] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\", lplpBuffer=0x2ead78, puLen=0x2ead70 | out: lplpBuffer=0x2ead78*=0x285b3e0, puLen=0x2ead70) returned 1
[0074.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x2ea870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x64
[0074.594] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x2ea9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x64
[0074.594] SetErrorMode (uMode=0x1) returned 0x0
[0074.594] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.windows.forms\\2.0.0.0__b77a5c561934e089\\system.windows.forms.dll"), fInfoLevelId=0x0, lpFileInformation=0x2eac00 | out: lpFileInformation=0x2eac00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f9a4db, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x82f9a4db, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8300c8fb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cb000)) returned 1
[0074.594] SetErrorMode (uMode=0x0) returned 0x1
[0074.594] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpdwHandle=0x2eae70 | out: lpdwHandle=0x2eae70) returned 0x7bc
[0074.595] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", dwHandle=0x0, dwLen=0x7bc, lpData=0x285f340 | out: lpData=0x285f340) returned 1
[0074.595] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2eade8, puLen=0x2eade0 | out: lplpBuffer=0x2eade8*=0x285f718, puLen=0x2eade0) returned 1
[0074.595] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f3f8, puLen=0x2ead50) returned 1
[0074.595] lstrlenW (lpString="Microsoft Corporation") returned 21
[0074.595] CoTaskMemAlloc (cb=0x2e) returned 0x1b579b60
[0074.595] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation"
[0074.596] CoTaskMemFree (pv=0x1b579b60)
[0074.596] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f44c, puLen=0x2ead50) returned 1
[0074.596] lstrlenW (lpString=".NET Framework") returned 14
[0074.596] CoTaskMemAlloc (cb=0x20) returned 0x1b570250
[0074.596] lstrcpyW (in: lpString1=0x1b570250, lpString2=".NET Framework" | out: lpString1=".NET Framework") returned=".NET Framework"
[0074.596] CoTaskMemFree (pv=0x1b570250)
[0074.596] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f48c, puLen=0x2ead50) returned 1
[0074.596] lstrlenW (lpString="2.0.50727.5420 (Win7SP1.050727-5400)") returned 36
[0074.596] CoTaskMemAlloc (cb=0x4c) returned 0x1b553920
[0074.596] lstrcpyW (in: lpString1=0x1b553920, lpString2="2.0.50727.5420 (Win7SP1.050727-5400)" | out: lpString1="2.0.50727.5420 (Win7SP1.050727-5400)") returned="2.0.50727.5420 (Win7SP1.050727-5400)"
[0074.596] CoTaskMemFree (pv=0x1b553920)
[0074.596] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f4f8, puLen=0x2ead50) returned 1
[0074.596] lstrlenW (lpString="System.Windows.Forms.dll") returned 24
[0074.596] CoTaskMemAlloc (cb=0x34) returned 0x1b579b60
[0074.596] lstrcpyW (in: lpString1=0x1b579b60, lpString2="System.Windows.Forms.dll" | out: lpString1="System.Windows.Forms.dll") returned="System.Windows.Forms.dll"
[0074.596] CoTaskMemFree (pv=0x1b579b60)
[0074.596] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f550, puLen=0x2ead50) returned 1
[0074.596] lstrlenW (lpString="© Microsoft Corporation. All rights reserved.") returned 46
[0074.596] CoTaskMemAlloc (cb=0x60) returned 0x1b591710
[0074.596] lstrcpyW (in: lpString1=0x1b591710, lpString2="© Microsoft Corporation. All rights reserved." | out: lpString1="© Microsoft Corporation. All rights reserved.") returned="© Microsoft Corporation. All rights reserved."
[0074.596] CoTaskMemFree (pv=0x1b591710)
[0074.597] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f5d8, puLen=0x2ead50) returned 1
[0074.597] lstrlenW (lpString="System.Windows.Forms.dll") returned 24
[0074.597] CoTaskMemAlloc (cb=0x34) returned 0x1b579b60
[0074.597] lstrcpyW (in: lpString1=0x1b579b60, lpString2="System.Windows.Forms.dll" | out: lpString1="System.Windows.Forms.dll") returned="System.Windows.Forms.dll"
[0074.597] CoTaskMemFree (pv=0x1b579b60)
[0074.597] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f62c, puLen=0x2ead50) returned 1
[0074.597] lstrlenW (lpString="Microsoft® .NET Framework") returned 25
[0074.597] CoTaskMemAlloc (cb=0x36) returned 0x1b579b60
[0074.597] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft® .NET Framework" | out: lpString1="Microsoft® .NET Framework") returned="Microsoft® .NET Framework"
[0074.597] CoTaskMemFree (pv=0x1b579b60)
[0074.597] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f684, puLen=0x2ead50) returned 1
[0074.597] lstrlenW (lpString="2.0.50727.5420") returned 14
[0074.597] CoTaskMemAlloc (cb=0x20) returned 0x1b570250
[0074.597] lstrcpyW (in: lpString1=0x1b570250, lpString2="2.0.50727.5420" | out: lpString1="2.0.50727.5420") returned="2.0.50727.5420"
[0074.597] CoTaskMemFree (pv=0x1b570250)
[0074.597] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f6bc, puLen=0x2ead50) returned 1
[0074.597] lstrlenW (lpString="Flavor=Retail") returned 13
[0074.597] CoTaskMemAlloc (cb=0x1e) returned 0x1b570250
[0074.597] lstrcpyW (in: lpString1=0x1b570250, lpString2="Flavor=Retail" | out: lpString1="Flavor=Retail") returned="Flavor=Retail"
[0074.597] CoTaskMemFree (pv=0x1b570250)
[0074.597] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.597] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.598] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.598] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ead28, puLen=0x2ead20 | out: lplpBuffer=0x2ead28*=0x285f718, puLen=0x2ead20) returned 1
[0074.598] CoTaskMemAlloc (cb=0x204) returned 0x1b57b350
[0074.598] VerLanguageNameW (in: wLang=0x409, szLang=0x1b57b350, cchLang=0x100 | out: szLang="English (United States)") returned 0x17
[0074.598] CoTaskMemFree (pv=0x1b57b350)
[0074.598] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\", lplpBuffer=0x2ead78, puLen=0x2ead70 | out: lplpBuffer=0x2ead78*=0x285f368, puLen=0x2ead70) returned 1
[0074.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", nBufferLength=0x105, lpBuffer=0x2ea870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", lpFilePart=0x0) returned 0x58
[0074.599] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", nBufferLength=0x105, lpBuffer=0x2ea9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", lpFilePart=0x0) returned 0x58
[0074.599] SetErrorMode (uMode=0x1) returned 0x0
[0074.599] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.drawing\\2.0.0.0__b03f5f7f11d50a3a\\system.drawing.dll"), fInfoLevelId=0x0, lpFileInformation=0x2eac00 | out: lpFileInformation=0x2eac00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93975fe4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93975fe4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9399c144, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x99000)) returned 1
[0074.600] SetErrorMode (uMode=0x0) returned 0x1
[0074.600] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", lpdwHandle=0x2eae70 | out: lpdwHandle=0x2eae70) returned 0x78c
[0074.780] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", dwHandle=0x0, dwLen=0x78c, lpData=0x28636b0 | out: lpData=0x28636b0) returned 1
[0074.781] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2eade8, puLen=0x2eade0 | out: lplpBuffer=0x2eade8*=0x2863a70, puLen=0x2eade0) returned 1
[0074.781] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2863768, puLen=0x2ead50) returned 1
[0074.781] lstrlenW (lpString="Microsoft Corporation") returned 21
[0074.781] CoTaskMemAlloc (cb=0x2e) returned 0x1b579b60
[0074.781] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation"
[0074.781] CoTaskMemFree (pv=0x1b579b60)
[0074.781] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28637bc, puLen=0x2ead50) returned 1
[0074.781] lstrlenW (lpString=".NET Framework") returned 14
[0074.781] CoTaskMemAlloc (cb=0x20) returned 0x1b570250
[0074.781] lstrcpyW (in: lpString1=0x1b570250, lpString2=".NET Framework" | out: lpString1=".NET Framework") returned=".NET Framework"
[0074.781] CoTaskMemFree (pv=0x1b570250)
[0074.781] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28637fc, puLen=0x2ead50) returned 1
[0074.782] lstrlenW (lpString="2.0.50727.5420 (Win7SP1.050727-5400)") returned 36
[0074.782] CoTaskMemAlloc (cb=0x4c) returned 0x1b553920
[0074.782] lstrcpyW (in: lpString1=0x1b553920, lpString2="2.0.50727.5420 (Win7SP1.050727-5400)" | out: lpString1="2.0.50727.5420 (Win7SP1.050727-5400)") returned="2.0.50727.5420 (Win7SP1.050727-5400)"
[0074.782] CoTaskMemFree (pv=0x1b553920)
[0074.782] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2863868, puLen=0x2ead50) returned 1
[0074.782] lstrlenW (lpString="System.Drawing.dll") returned 18
[0074.782] CoTaskMemAlloc (cb=0x28) returned 0x1b570250
[0074.782] lstrcpyW (in: lpString1=0x1b570250, lpString2="System.Drawing.dll" | out: lpString1="System.Drawing.dll") returned="System.Drawing.dll"
[0074.782] CoTaskMemFree (pv=0x1b570250)
[0074.782] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28638b4, puLen=0x2ead50) returned 1
[0074.782] lstrlenW (lpString="© Microsoft Corporation. All rights reserved.") returned 46
[0074.782] CoTaskMemAlloc (cb=0x60) returned 0x1b591710
[0074.782] lstrcpyW (in: lpString1=0x1b591710, lpString2="© Microsoft Corporation. All rights reserved." | out: lpString1="© Microsoft Corporation. All rights reserved.") returned="© Microsoft Corporation. All rights reserved."
[0074.782] CoTaskMemFree (pv=0x1b591710)
[0074.782] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x286393c, puLen=0x2ead50) returned 1
[0074.782] lstrlenW (lpString="System.Drawing.dll") returned 18
[0074.782] CoTaskMemAlloc (cb=0x28) returned 0x1b570250
[0074.782] lstrcpyW (in: lpString1=0x1b570250, lpString2="System.Drawing.dll" | out: lpString1="System.Drawing.dll") returned="System.Drawing.dll"
[0074.782] CoTaskMemFree (pv=0x1b570250)
[0074.782] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2863984, puLen=0x2ead50) returned 1
[0074.782] lstrlenW (lpString="Microsoft® .NET Framework") returned 25
[0074.782] CoTaskMemAlloc (cb=0x36) returned 0x1b579b60
[0074.782] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft® .NET Framework" | out: lpString1="Microsoft® .NET Framework") returned="Microsoft® .NET Framework"
[0074.782] CoTaskMemFree (pv=0x1b579b60)
[0074.782] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28639dc, puLen=0x2ead50) returned 1
[0074.782] lstrlenW (lpString="2.0.50727.5420") returned 14
[0074.782] CoTaskMemAlloc (cb=0x20) returned 0x1b570250
[0074.782] lstrcpyW (in: lpString1=0x1b570250, lpString2="2.0.50727.5420" | out: lpString1="2.0.50727.5420") returned="2.0.50727.5420"
[0074.782] CoTaskMemFree (pv=0x1b570250)
[0074.795] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2863a14, puLen=0x2ead50) returned 1
[0074.795] lstrlenW (lpString="Flavor=Retail") returned 13
[0074.795] CoTaskMemAlloc (cb=0x1e) returned 0x1b570250
[0074.795] lstrcpyW (in: lpString1=0x1b570250, lpString2="Flavor=Retail" | out: lpString1="Flavor=Retail") returned="Flavor=Retail"
[0074.795] CoTaskMemFree (pv=0x1b570250)
[0074.795] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.795] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.795] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.795] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ead28, puLen=0x2ead20 | out: lplpBuffer=0x2ead28*=0x2863a70, puLen=0x2ead20) returned 1
[0074.795] CoTaskMemAlloc (cb=0x204) returned 0x1b57b350
[0074.795] VerLanguageNameW (in: wLang=0x409, szLang=0x1b57b350, cchLang=0x100 | out: szLang="English (United States)") returned 0x17
[0074.795] CoTaskMemFree (pv=0x1b57b350)
[0074.795] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\", lplpBuffer=0x2ead78, puLen=0x2ead70 | out: lplpBuffer=0x2ead78*=0x28636d8, puLen=0x2ead70) returned 1
[0074.796] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll", nBufferLength=0x105, lpBuffer=0x2ea870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll", lpFilePart=0x0) returned 0x6a
[0074.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll", nBufferLength=0x105, lpBuffer=0x2ea9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll", lpFilePart=0x0) returned 0x6a
[0074.876] SetErrorMode (uMode=0x1) returned 0x0
[0074.876] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.runtime.remoting\\2.0.0.0__b77a5c561934e089\\system.runtime.remoting.dll"), fInfoLevelId=0x0, lpFileInformation=0x2eac00 | out: lpFileInformation=0x2eac00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830cafdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830cafdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830f113d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000)) returned 1
[0074.879] SetErrorMode (uMode=0x0) returned 0x1
[0074.879] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll", lpdwHandle=0x2eae70 | out: lpdwHandle=0x2eae70) returned 0x82c
[0074.941] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll", dwHandle=0x0, dwLen=0x82c, lpData=0x2867b18 | out: lpData=0x2867b18) returned 1
[0074.947] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2eade8, puLen=0x2eade0 | out: lplpBuffer=0x2eade8*=0x2867f28, puLen=0x2eade0) returned 1
[0074.947] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867bd0, puLen=0x2ead50) returned 1
[0074.947] lstrlenW (lpString="Microsoft Corporation") returned 21
[0074.947] CoTaskMemAlloc (cb=0x2e) returned 0x1b579b60
[0074.947] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation"
[0074.947] CoTaskMemFree (pv=0x1b579b60)
[0074.947] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867c24, puLen=0x2ead50) returned 1
[0074.947] lstrlenW (lpString="Microsoft .NET Runtime Object Remoting") returned 38
[0074.947] CoTaskMemAlloc (cb=0x50) returned 0x1b553920
[0074.947] lstrcpyW (in: lpString1=0x1b553920, lpString2="Microsoft .NET Runtime Object Remoting" | out: lpString1="Microsoft .NET Runtime Object Remoting") returned="Microsoft .NET Runtime Object Remoting"
[0074.947] CoTaskMemFree (pv=0x1b553920)
[0074.947] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867c94, puLen=0x2ead50) returned 1
[0074.947] lstrlenW (lpString="2.0.50727.5420 (Win7SP1.050727-5400)") returned 36
[0074.947] CoTaskMemAlloc (cb=0x4c) returned 0x1b553920
[0074.947] lstrcpyW (in: lpString1=0x1b553920, lpString2="2.0.50727.5420 (Win7SP1.050727-5400)" | out: lpString1="2.0.50727.5420 (Win7SP1.050727-5400)") returned="2.0.50727.5420 (Win7SP1.050727-5400)"
[0074.947] CoTaskMemFree (pv=0x1b553920)
[0074.948] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867d00, puLen=0x2ead50) returned 1
[0074.948] lstrlenW (lpString="System.Runtime.Remoting.dll") returned 27
[0074.948] CoTaskMemAlloc (cb=0x3a) returned 0x1b56d6e0
[0074.948] lstrcpyW (in: lpString1=0x1b56d6e0, lpString2="System.Runtime.Remoting.dll" | out: lpString1="System.Runtime.Remoting.dll") returned="System.Runtime.Remoting.dll"
[0074.948] CoTaskMemFree (pv=0x1b56d6e0)
[0074.948] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867d5c, puLen=0x2ead50) returned 1
[0074.948] lstrlenW (lpString="© Microsoft Corporation. All rights reserved.") returned 46
[0074.948] CoTaskMemAlloc (cb=0x60) returned 0x1b591710
[0074.948] lstrcpyW (in: lpString1=0x1b591710, lpString2="© Microsoft Corporation. All rights reserved." | out: lpString1="© Microsoft Corporation. All rights reserved.") returned="© Microsoft Corporation. All rights reserved."
[0074.948] CoTaskMemFree (pv=0x1b591710)
[0074.948] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867de4, puLen=0x2ead50) returned 1
[0074.948] lstrlenW (lpString="System.Runtime.Remoting.dll") returned 27
[0074.948] CoTaskMemAlloc (cb=0x3a) returned 0x1b56d6e0
[0074.948] lstrcpyW (in: lpString1=0x1b56d6e0, lpString2="System.Runtime.Remoting.dll" | out: lpString1="System.Runtime.Remoting.dll") returned="System.Runtime.Remoting.dll"
[0074.948] CoTaskMemFree (pv=0x1b56d6e0)
[0074.948] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867e3c, puLen=0x2ead50) returned 1
[0074.948] lstrlenW (lpString="Microsoft® .NET Framework") returned 25
[0074.948] CoTaskMemAlloc (cb=0x36) returned 0x1b579b60
[0074.948] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft® .NET Framework" | out: lpString1="Microsoft® .NET Framework") returned="Microsoft® .NET Framework"
[0074.948] CoTaskMemFree (pv=0x1b579b60)
[0074.948] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867e94, puLen=0x2ead50) returned 1
[0074.948] lstrlenW (lpString="2.0.50727.5420") returned 14
[0074.948] CoTaskMemAlloc (cb=0x20) returned 0x1b570250
[0074.949] lstrcpyW (in: lpString1=0x1b570250, lpString2="2.0.50727.5420" | out: lpString1="2.0.50727.5420") returned="2.0.50727.5420"
[0074.949] CoTaskMemFree (pv=0x1b570250)
[0074.949] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867ecc, puLen=0x2ead50) returned 1
[0074.949] lstrlenW (lpString="Flavor=Retail") returned 13
[0074.949] CoTaskMemAlloc (cb=0x1e) returned 0x1b570250
[0074.949] lstrcpyW (in: lpString1=0x1b570250, lpString2="Flavor=Retail" | out: lpString1="Flavor=Retail") returned="Flavor=Retail"
[0074.949] CoTaskMemFree (pv=0x1b570250)
[0074.949] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.949] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.949] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.949] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ead28, puLen=0x2ead20 | out: lplpBuffer=0x2ead28*=0x2867f28, puLen=0x2ead20) returned 1
[0074.949] CoTaskMemAlloc (cb=0x204) returned 0x1b57b350
[0074.949] VerLanguageNameW (in: wLang=0x409, szLang=0x1b57b350, cchLang=0x100 | out: szLang="English (United States)") returned 0x17
[0074.950] CoTaskMemFree (pv=0x1b57b350)
[0074.950] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\", lplpBuffer=0x2ead78, puLen=0x2ead70 | out: lplpBuffer=0x2ead78*=0x2867b40, puLen=0x2ead70) returned 1
[0074.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x2ea870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38
[0074.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x2ea9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38
[0074.951] SetErrorMode (uMode=0x1) returned 0x0
[0074.951] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe"), fInfoLevelId=0x0, lpFileInformation=0x2eac00 | out: lpFileInformation=0x2eac00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f30a660, ftCreationTime.dwHighDateTime=0x1d3b054, ftLastAccessTime.dwLowDateTime=0x8f30a660, ftLastAccessTime.dwHighDateTime=0x1d3b054, ftLastWriteTime.dwLowDateTime=0xd9447400, ftLastWriteTime.dwHighDateTime=0x1d41168, nFileSizeHigh=0x0, nFileSizeLow=0x34400)) returned 1
[0074.951] SetErrorMode (uMode=0x0) returned 0x1
[0074.951] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpdwHandle=0x2eae70 | out: lpdwHandle=0x2eae70) returned 0x504
[0074.951] GetFileVersionInfoW (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", dwHandle=0x0, dwLen=0x504, lpData=0x286f160 | out: lpData=0x286f160) returned 1
[0074.954] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2eade8, puLen=0x2eade0 | out: lplpBuffer=0x2eade8*=0x286f1fc, puLen=0x2eade0) returned 1
[0074.954] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.954] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x286f264, puLen=0x2ead50) returned 1
[0074.954] lstrlenW (lpString="get") returned 3
[0074.954] CoTaskMemAlloc (cb=0xa) returned 0x1b56f3c0
[0074.954] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="get" | out: lpString1="get") returned="get"
[0074.954] CoTaskMemFree (pv=0x1b56f3c0)
[0074.954] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x286f28c, puLen=0x2ead50) returned 1
[0074.954] lstrlenW (lpString="1.0.0.0") returned 7
[0074.955] CoTaskMemAlloc (cb=0x12) returned 0x1b56f3c0
[0074.955] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="1.0.0.0" | out: lpString1="1.0.0.0") returned="1.0.0.0"
[0074.955] CoTaskMemFree (pv=0x1b56f3c0)
[0074.955] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x286f2bc, puLen=0x2ead50) returned 1
[0074.955] lstrlenW (lpString="get.exe") returned 7
[0074.955] CoTaskMemAlloc (cb=0x12) returned 0x1b56f3c0
[0074.955] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="get.exe" | out: lpString1="get.exe") returned="get.exe"
[0074.955] CoTaskMemFree (pv=0x1b56f3c0)
[0074.955] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x286f2f0, puLen=0x2ead50) returned 1
[0074.955] lstrlenW (lpString="Copyright © 2017") returned 17
[0074.955] CoTaskMemAlloc (cb=0x26) returned 0x1b570250
[0074.955] lstrcpyW (in: lpString1=0x1b570250, lpString2="Copyright © 2017" | out: lpString1="Copyright © 2017") returned="Copyright © 2017"
[0074.955] CoTaskMemFree (pv=0x1b570250)
[0074.955] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x286f33c, puLen=0x2ead50) returned 1
[0074.955] lstrlenW (lpString="get.exe") returned 7
[0074.955] CoTaskMemAlloc (cb=0x12) returned 0x1b56f3c0
[0074.955] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="get.exe" | out: lpString1="get.exe") returned="get.exe"
[0074.955] CoTaskMemFree (pv=0x1b56f3c0)
[0074.955] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x286f36c, puLen=0x2ead50) returned 1
[0074.955] lstrlenW (lpString="get") returned 3
[0074.955] CoTaskMemAlloc (cb=0xa) returned 0x1b56f3c0
[0074.956] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="get" | out: lpString1="get") returned="get"
[0074.956] CoTaskMemFree (pv=0x1b56f3c0)
[0074.956] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x286f398, puLen=0x2ead50) returned 1
[0074.956] lstrlenW (lpString="1.0.0.0") returned 7
[0074.956] CoTaskMemAlloc (cb=0x12) returned 0x1b56f3c0
[0074.956] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="1.0.0.0" | out: lpString1="1.0.0.0") returned="1.0.0.0"
[0074.956] CoTaskMemFree (pv=0x1b56f3c0)
[0074.956] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.956] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.956] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.956] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0
[0074.956] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ead28, puLen=0x2ead20 | out: lplpBuffer=0x2ead28*=0x286f1fc, puLen=0x2ead20) returned 1
[0074.956] CoTaskMemAlloc (cb=0x204) returned 0x1b57b350
[0074.956] VerLanguageNameW (in: wLang=0x0, szLang=0x1b57b350, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10
[0074.956] CoTaskMemFree (pv=0x1b57b350)
[0074.956] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\", lplpBuffer=0x2ead78, puLen=0x2ead70 | out: lplpBuffer=0x2ead78*=0x286f188, puLen=0x2ead70) returned 1
[0074.957] GetCurrentActCtx (in: lphActCtx=0x2eacf0 | out: lphActCtx=0x2eacf0*=0x1a4cd8) returned 1
[0074.977] GetCurrentActCtx (in: lphActCtx=0x2eab70 | out: lphActCtx=0x2eab70*=0x1a4cd8) returned 1
[0074.978] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000
[0074.978] CreateWindowExW (dwExStyle=0x10000, lpClassName="WindowsForms10.Window.8.app.0.33c0d9d", lpWindowName="WindowsFormsParkingWindow", dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffffffffffd, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x201d8
[0074.978] SetWindowLongPtrW (hWnd=0x201d8, nIndex=-4, dwNewLong=0x77c7b0ac) returned 0x9a150c
[0074.978] GetWindowLongPtrW (hWnd=0x201d8, nIndex=-4) returned 0x77c7b0ac
[0074.978] SetWindowLongPtrW (hWnd=0x201d8, nIndex=-4, dwNewLong=0x9b7ddc) returned 0x77c7b0ac
[0074.978] GetWindowLongPtrW (hWnd=0x201d8, nIndex=-4) returned 0x9b7ddc
[0074.979] GetWindowLongPtrW (hWnd=0x201d8, nIndex=-16) returned 0x6c10000
[0074.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0x24, wParam=0x0, lParam=0x2ea290) returned 0x0
[0074.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0x81, wParam=0x0, lParam=0x2ea210) returned 0x1
[0074.980] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0x83, wParam=0x0, lParam=0x2ea2b0) returned 0x0
[0074.980] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0x1, wParam=0x0, lParam=0x2ea1d0) returned 0x0
[0074.980] GetClientRect (in: hWnd=0x201d8, lpRect=0x2e99c0 | out: lpRect=0x2e99c0) returned 1
[0074.981] GetWindowRect (in: hWnd=0x201d8, lpRect=0x2e99c0 | out: lpRect=0x2e99c0) returned 1
[0074.987] SetWindowTextW (hWnd=0x201d8, lpString="WindowsFormsParkingWindow") returned 1
[0074.987] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0xc, wParam=0x0, lParam=0x2871a98) returned 0x1
[0074.987] GetParent (hWnd=0x201d8) returned 0x0
[0074.987] GetClassInfoW (in: hInstance=0x0, lpClassName="STATIC", lpWndClass=0x2871ef8 | out: lpWndClass=0x2871ef8) returned 1
[0074.988] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000
[0074.988] CoTaskMemAlloc (cb=0x48) returned 0x1b56d730
[0074.988] RegisterClassW (lpWndClass=0x2ea9d0) returned 0xc13d
[0074.988] CoTaskMemFree (pv=0x1b56d730)
[0074.988] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000
[0074.988] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x5600000d, X=0, Y=0, nWidth=100, nHeight=23, hWndParent=0x201d8, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x201da
[0074.991] SetWindowLongPtrW (hWnd=0x201da, nIndex=-4, dwNewLong=0x7fefc7161b4) returned 0x9b7e2c
[0074.991] GetWindowLongPtrW (hWnd=0x201da, nIndex=-4) returned 0x7fefc7161b4
[0074.991] SetWindowLongPtrW (hWnd=0x201da, nIndex=-4, dwNewLong=0x9b7e7c) returned 0x7fefc7161b4
[0074.991] GetWindowLongPtrW (hWnd=0x201da, nIndex=-4) returned 0x9b7e7c
[0074.991] GetWindowLongPtrW (hWnd=0x201da, nIndex=-16) returned 0x4600000d
[0074.991] GetWindowLongPtrW (hWnd=0x201da, nIndex=-12) returned 0x0
[0074.991] SetWindowLongPtrW (hWnd=0x201da, nIndex=-12, dwNewLong=0x201da) returned 0x0
[0074.992] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x81, wParam=0x0, lParam=0x2ea390) returned 0x1
[0074.992] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x83, wParam=0x0, lParam=0x2ea430) returned 0x0
[0074.992] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x1, wParam=0x0, lParam=0x2ea390) returned 0x0
[0074.992] GetClientRect (in: hWnd=0x201da, lpRect=0x2e9b30 | out: lpRect=0x2e9b30) returned 1
[0074.992] GetWindowRect (in: hWnd=0x201da, lpRect=0x2e9b30 | out: lpRect=0x2e9b30) returned 1
[0074.992] GetParent (hWnd=0x201da) returned 0x201d8
[0074.992] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d8, lpPoints=0x2e9b20, cPoints=0x2 | out: lpPoints=0x2e9b20) returned -1572867
[0074.993] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0
[0074.993] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0
[0074.993] GetClientRect (in: hWnd=0x201da, lpRect=0x2e9c30 | out: lpRect=0x2e9c30) returned 1
[0074.993] GetWindowRect (in: hWnd=0x201da, lpRect=0x2e9c30 | out: lpRect=0x2e9c30) returned 1
[0074.993] GetParent (hWnd=0x201da) returned 0x201d8
[0074.993] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d8, lpPoints=0x2e9c20, cPoints=0x2 | out: lpPoints=0x2e9c20) returned -1572867
[0074.993] SendMessageW (hWnd=0x201da, Msg=0x2210, wParam=0x1da0001, lParam=0x201da) returned 0x0
[0074.993] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x2210, wParam=0x1da0001, lParam=0x201da) returned 0x0
[0074.995] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0074.995] GetParent (hWnd=0x201da) returned 0x201d8
[0074.996] GdipCreateFromHWND (hwnd=0x201da, graphics=0x2eae70) returned 0x0
[0075.053] GdipMeasureString (graphics=0x1afad3c0, string="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.", length=283, font=0x1b013a40, layoutRect=0x2ead08, stringFormat=0x0, boundingBox=0x2eacf8, codepointsFitted=0x2eacf4, linesFilled=0x2eacf0) returned 0x0
[0075.287] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0075.287] GdipDeleteGraphics (graphics=0x1afad3c0) returned 0x0
[0075.288] GetForegroundWindow () returned 0x101ac
[0075.328] GetCursorPos (in: lpPoint=0x2872440 | out: lpPoint=0x2872440*(x=591, y=123)) returned 1
[0075.329] GetSystemMetrics (nIndex=80) returned 1
[0075.347] MonitorFromPoint (pt=0x7b0000024f, dwFlags=0x2) returned 0x10001
[0075.396] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ea990 | out: lpmi=0x2ea990) returned 1
[0075.396] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0xf010836
[0075.397] GetDeviceCaps (hdc=0xf010836, index=12) returned 32
[0075.397] GetDeviceCaps (hdc=0xf010836, index=14) returned 1
[0075.397] DeleteDC (hdc=0xf010836) returned 1
[0075.410] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2eaa90 | out: lpmi=0x2eaa90) returned 1
[0075.410] AdjustWindowRectEx (in: lpRect=0x2ead10, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2ead10) returned 1
[0075.410] GetSystemMetrics (nIndex=59) returned 1460
[0075.410] GetSystemMetrics (nIndex=60) returned 920
[0075.410] GetSystemMetrics (nIndex=34) returned 132
[0075.410] GetSystemMetrics (nIndex=35) returned 38
[0075.410] GetCursorPos (in: lpPoint=0x2872808 | out: lpPoint=0x2872808*(x=591, y=123)) returned 1
[0075.410] MonitorFromPoint (pt=0x7e0000024e, dwFlags=0x2) returned 0x10001
[0075.410] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ea610 | out: lpmi=0x2ea610) returned 1
[0075.410] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x10010836
[0075.411] GetDeviceCaps (hdc=0x10010836, index=12) returned 32
[0075.411] GetDeviceCaps (hdc=0x10010836, index=14) returned 1
[0075.411] DeleteDC (hdc=0x10010836) returned 1
[0075.411] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ea710 | out: lpmi=0x2ea710) returned 1
[0075.411] AdjustWindowRectEx (in: lpRect=0x2ea990, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2ea990) returned 1
[0075.422] AdjustWindowRectEx (in: lpRect=0x2eaca0, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2eaca0) returned 1
[0075.454] LoadIconW (hInstance=0x0, lpIconName=0x7f01) returned 0x1002d
[0075.459] GetIconInfo (in: hIcon=0x1002d, piconinfo=0x2872be8 | out: piconinfo=0x2872be8) returned 1
[0075.464] GetObjectW (in: h=0xd050727, c=32, pv=0x2872c18 | out: pv=0x2872c18) returned 32
[0075.470] GdipCreateBitmapFromHBITMAP (hbm=0xd050727, hpal=0x0, bitmap=0x2eab40) returned 0x0
[0075.473] GdipGetImageWidth (image=0x1b860fd0, width=0x2eabc0) returned 0x0
[0075.475] GdipGetImageHeight (image=0x1b860fd0, height=0x2eabc0) returned 0x0
[0075.476] GdipGetImagePixelFormat (image=0x1b860fd0, format=0x2eabc0) returned 0x0
[0075.477] GdipBitmapLockBits (bitmap=0x1b860fd0, rect=0x2eaae0, flags=0x1, format=0x22009, lockedBitmapData=0x2872db0) returned 0x0
[0075.479] GdipCreateBitmapFromScan0 (width=32, height=32, stride=0, format=0x26200a, scan0=0x0, bitmap=0x2eab80) returned 0x0
[0075.479] GdipBitmapLockBits (bitmap=0x1b863aa0, rect=0x2eaae0, flags=0x2, format=0x26200a, lockedBitmapData=0x2872e10) returned 0x0
[0075.504] RtlMoveMemory (in: Destination=0x1b046450, Source=0x1b86ad40, Length=0x80 | out: Destination=0x1b046450)
[0075.504] RtlMoveMemory (in: Destination=0x1b0464d0, Source=0x1b86acc0, Length=0x80 | out: Destination=0x1b0464d0)
[0075.505] RtlMoveMemory (in: Destination=0x1b046550, Source=0x1b86ac40, Length=0x80 | out: Destination=0x1b046550)
[0075.505] RtlMoveMemory (in: Destination=0x1b0465d0, Source=0x1b86abc0, Length=0x80 | out: Destination=0x1b0465d0)
[0075.505] RtlMoveMemory (in: Destination=0x1b046650, Source=0x1b86ab40, Length=0x80 | out: Destination=0x1b046650)
[0075.505] RtlMoveMemory (in: Destination=0x1b0466d0, Source=0x1b86aac0, Length=0x80 | out: Destination=0x1b0466d0)
[0075.505] RtlMoveMemory (in: Destination=0x1b046750, Source=0x1b86aa40, Length=0x80 | out: Destination=0x1b046750)
[0075.505] RtlMoveMemory (in: Destination=0x1b0467d0, Source=0x1b86a9c0, Length=0x80 | out: Destination=0x1b0467d0)
[0075.505] RtlMoveMemory (in: Destination=0x1b046850, Source=0x1b86a940, Length=0x80 | out: Destination=0x1b046850)
[0075.505] RtlMoveMemory (in: Destination=0x1b0468d0, Source=0x1b86a8c0, Length=0x80 | out: Destination=0x1b0468d0)
[0075.505] RtlMoveMemory (in: Destination=0x1b046950, Source=0x1b86a840, Length=0x80 | out: Destination=0x1b046950)
[0075.505] RtlMoveMemory (in: Destination=0x1b0469d0, Source=0x1b86a7c0, Length=0x80 | out: Destination=0x1b0469d0)
[0075.505] RtlMoveMemory (in: Destination=0x1b046a50, Source=0x1b86a740, Length=0x80 | out: Destination=0x1b046a50)
[0075.505] RtlMoveMemory (in: Destination=0x1b046ad0, Source=0x1b86a6c0, Length=0x80 | out: Destination=0x1b046ad0)
[0075.505] RtlMoveMemory (in: Destination=0x1b046b50, Source=0x1b86a640, Length=0x80 | out: Destination=0x1b046b50)
[0075.505] RtlMoveMemory (in: Destination=0x1b046bd0, Source=0x1b86a5c0, Length=0x80 | out: Destination=0x1b046bd0)
[0075.505] RtlMoveMemory (in: Destination=0x1b046c50, Source=0x1b86a540, Length=0x80 | out: Destination=0x1b046c50)
[0075.505] RtlMoveMemory (in: Destination=0x1b046cd0, Source=0x1b86a4c0, Length=0x80 | out: Destination=0x1b046cd0)
[0075.506] RtlMoveMemory (in: Destination=0x1b046d50, Source=0x1b86a440, Length=0x80 | out: Destination=0x1b046d50)
[0075.506] RtlMoveMemory (in: Destination=0x1b046dd0, Source=0x1b86a3c0, Length=0x80 | out: Destination=0x1b046dd0)
[0075.506] RtlMoveMemory (in: Destination=0x1b046e50, Source=0x1b86a340, Length=0x80 | out: Destination=0x1b046e50)
[0075.506] RtlMoveMemory (in: Destination=0x1b046ed0, Source=0x1b86a2c0, Length=0x80 | out: Destination=0x1b046ed0)
[0075.506] RtlMoveMemory (in: Destination=0x1b046f50, Source=0x1b86a240, Length=0x80 | out: Destination=0x1b046f50)
[0075.506] RtlMoveMemory (in: Destination=0x1b046fd0, Source=0x1b86a1c0, Length=0x80 | out: Destination=0x1b046fd0)
[0075.506] RtlMoveMemory (in: Destination=0x1b047050, Source=0x1b86a140, Length=0x80 | out: Destination=0x1b047050)
[0075.506] RtlMoveMemory (in: Destination=0x1b0470d0, Source=0x1b86a0c0, Length=0x80 | out: Destination=0x1b0470d0)
[0075.506] RtlMoveMemory (in: Destination=0x1b047150, Source=0x1b86a040, Length=0x80 | out: Destination=0x1b047150)
[0075.509] RtlMoveMemory (in: Destination=0x1b0471d0, Source=0x1b869fc0, Length=0x80 | out: Destination=0x1b0471d0)
[0075.509] RtlMoveMemory (in: Destination=0x1b047250, Source=0x1b869f40, Length=0x80 | out: Destination=0x1b047250)
[0075.509] RtlMoveMemory (in: Destination=0x1b0472d0, Source=0x1b869ec0, Length=0x80 | out: Destination=0x1b0472d0)
[0075.509] RtlMoveMemory (in: Destination=0x1b047350, Source=0x1b869e40, Length=0x80 | out: Destination=0x1b047350)
[0075.509] RtlMoveMemory (in: Destination=0x1b0473d0, Source=0x1b869dc0, Length=0x80 | out: Destination=0x1b0473d0)
[0075.511] GdipBitmapUnlockBits (bitmap=0x1b860fd0, lockedBitmapData=0x2872db0) returned 0x0
[0075.511] GdipBitmapUnlockBits (bitmap=0x1b863aa0, lockedBitmapData=0x2872e10) returned 0x0
[0075.511] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0075.511] GdipDisposeImage (image=0x1b860fd0) returned 0x0
[0075.512] DeleteObject (ho=0xd050727) returned 1
[0075.512] DeleteObject (ho=0x11050836) returned 1
[0075.521] GetCurrentThreadId () returned 0x968
[0075.521] GetCurrentThreadId () returned 0x968
[0075.533] SetWindowPos (hWnd=0x201da, hWndInsertAfter=0x0, X=64, Y=8, cx=354, cy=81, uFlags=0x14) returned 1
[0075.533] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x46, wParam=0x0, lParam=0x2eabe0) returned 0x0
[0075.533] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x83, wParam=0x1, lParam=0x2eabb0) returned 0x0
[0075.533] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x47, wParam=0x0, lParam=0x2eabe0) returned 0x0
[0075.533] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x3, wParam=0x0, lParam=0x80040) returned 0x0
[0075.533] GetClientRect (in: hWnd=0x201da, lpRect=0x2e9790 | out: lpRect=0x2e9790) returned 1
[0075.533] GetWindowRect (in: hWnd=0x201da, lpRect=0x2e9790 | out: lpRect=0x2e9790) returned 1
[0075.533] GetParent (hWnd=0x201da) returned 0x201d8
[0075.534] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d8, lpPoints=0x2e9780, cPoints=0x2 | out: lpPoints=0x2e9780) returned -1572867
[0075.534] GetSysColor (nIndex=10) returned 0xb4b4b4
[0075.534] GetSysColor (nIndex=2) returned 0xd1b499
[0075.534] GetSysColor (nIndex=9) returned 0x0
[0075.534] GetSysColor (nIndex=12) returned 0xababab
[0075.534] GetSysColor (nIndex=15) returned 0xf0f0f0
[0075.534] GetSysColor (nIndex=20) returned 0xffffff
[0075.535] GetSysColor (nIndex=16) returned 0xa0a0a0
[0075.535] GetSysColor (nIndex=15) returned 0xf0f0f0
[0075.535] GetSysColor (nIndex=16) returned 0xa0a0a0
[0075.535] GetSysColor (nIndex=21) returned 0x696969
[0075.535] GetSysColor (nIndex=22) returned 0xe3e3e3
[0075.535] GetSysColor (nIndex=20) returned 0xffffff
[0075.535] GetSysColor (nIndex=18) returned 0x0
[0075.535] GetSysColor (nIndex=1) returned 0x0
[0075.535] GetSysColor (nIndex=27) returned 0xead1b9
[0075.535] GetSysColor (nIndex=28) returned 0xf2e4d7
[0075.535] GetSysColor (nIndex=17) returned 0x6d6d6d
[0075.535] GetSysColor (nIndex=13) returned 0xff9933
[0075.535] GetSysColor (nIndex=14) returned 0xffffff
[0075.535] GetSysColor (nIndex=26) returned 0xcc6600
[0075.535] GetSysColor (nIndex=11) returned 0xfcf7f4
[0075.536] GetSysColor (nIndex=3) returned 0xdbcdbf
[0075.536] GetSysColor (nIndex=19) returned 0x544e43
[0075.536] GetSysColor (nIndex=24) returned 0xe1ffff
[0075.536] GetSysColor (nIndex=23) returned 0x0
[0075.536] GetSysColor (nIndex=4) returned 0xf0f0f0
[0075.536] GetSysColor (nIndex=30) returned 0xf0f0f0
[0075.536] GetSysColor (nIndex=29) returned 0xff9933
[0075.536] GetSysColor (nIndex=7) returned 0x0
[0075.536] GetSysColor (nIndex=0) returned 0xc8c8c8
[0075.536] GetSysColor (nIndex=5) returned 0xffffff
[0075.536] GetSysColor (nIndex=6) returned 0x646464
[0075.536] GetSysColor (nIndex=8) returned 0x0
[0075.537] InvalidateRect (hWnd=0x201da, lpRect=0x0, bErase=1) returned 1
[0075.537] GetWindowTextLengthW (hWnd=0x201da) returned 0
[0075.537] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0075.537] GetSystemMetrics (nIndex=42) returned 0
[0075.537] CoTaskMemAlloc (cb=0x6) returned 0x1b57eb70
[0075.537] GetWindowTextW (in: hWnd=0x201da, lpString=0x1b57eb70, nMaxCount=1 | out: lpString="") returned 0
[0075.537] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xd, wParam=0x1, lParam=0x1b57eb70) returned 0x0
[0075.537] CoTaskMemFree (pv=0x1b57eb70)
[0075.538] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x5, wParam=0x0, lParam=0x510162) returned 0x0
[0075.538] GetClientRect (in: hWnd=0x201da, lpRect=0x2ea370 | out: lpRect=0x2ea370) returned 1
[0075.538] GetWindowRect (in: hWnd=0x201da, lpRect=0x2ea370 | out: lpRect=0x2ea370) returned 1
[0075.538] GetParent (hWnd=0x201da) returned 0x201d8
[0075.538] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d8, lpPoints=0x2ea360, cPoints=0x2 | out: lpPoints=0x2ea360) returned -1572867
[0075.539] GetWindowTextLengthW (hWnd=0x201da) returned 0
[0075.539] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0075.539] GetSystemMetrics (nIndex=42) returned 0
[0075.539] CoTaskMemAlloc (cb=0x6) returned 0x1b57eb70
[0075.539] GetWindowTextW (in: hWnd=0x201da, lpString=0x1b57eb70, nMaxCount=1 | out: lpString="") returned 0
[0075.539] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xd, wParam=0x1, lParam=0x1b57eb70) returned 0x0
[0075.539] CoTaskMemFree (pv=0x1b57eb70)
[0075.539] GetWindowTextLengthW (hWnd=0x201da) returned 0
[0075.539] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0075.539] GetSystemMetrics (nIndex=42) returned 0
[0075.539] CoTaskMemAlloc (cb=0x6) returned 0x1b57eb70
[0075.539] GetWindowTextW (in: hWnd=0x201da, lpString=0x1b57eb70, nMaxCount=1 | out: lpString="") returned 0
[0075.539] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xd, wParam=0x1, lParam=0x1b57eb70) returned 0x0
[0075.539] CoTaskMemFree (pv=0x1b57eb70)
[0075.539] SetWindowTextW (hWnd=0x201da, lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.") returned 1
[0075.539] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xc, wParam=0x0, lParam=0x2830790) returned 0x1
[0075.541] InvalidateRect (hWnd=0x201da, lpRect=0x0, bErase=1) returned 1
[0075.545] GetCurrentThreadId () returned 0x968
[0075.546] GetWindowThreadProcessId (in: hWnd=0x201da, lpdwProcessId=0x2ead50 | out: lpdwProcessId=0x2ead50) returned 0x968
[0075.579] GdipCreateBitmapFromStream (stream=0x1b190020, bitmap=0x2eae38) returned 0x0
[0075.894] GdipImageForceValidation (image=0x1b864090) returned 0x0
[0075.896] GdipGetImageRawFormat (image=0x1b864090, format=0x2eacf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0
[0075.905] GdipGetImageHeight (image=0x1b864090, height=0x2eadf0) returned 0x0
[0075.905] GdipGetImageWidth (image=0x1b864090, width=0x2eadf0) returned 0x0
[0075.908] GdipGetImageWidth (image=0x1b864090, width=0x2eada0) returned 0x0
[0075.908] GdipGetImageHeight (image=0x1b864090, height=0x2eada0) returned 0x0
[0075.909] GdipGetImageWidth (image=0x1b864090, width=0x2ead40) returned 0x0
[0075.909] GdipGetImageHeight (image=0x1b864090, height=0x2ead40) returned 0x0
[0075.909] GdipBitmapGetPixel (bitmap=0x1b864090, x=0, y=15, color=0x2eada0) returned 0x0
[0075.910] GdipGetImageRawFormat (image=0x1b864090, format=0x2eabb0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0
[0075.910] GdipGetImageWidth (image=0x1b864090, width=0x2eab80) returned 0x0
[0075.910] GdipGetImageHeight (image=0x1b864090, height=0x2eab80) returned 0x0
[0075.912] GdipCreateBitmapFromScan0 (width=16, height=16, stride=0, format=0x26200a, scan0=0x0, bitmap=0x2eab90) returned 0x0
[0075.915] GdipGetImagePixelFormat (image=0x1b860fd0, format=0x2eab60) returned 0x0
[0075.917] GdipGetImageGraphicsContext (image=0x1b860fd0, graphics=0x2eabc0) returned 0x0
[0075.920] GdipGraphicsClear (graphics=0x1b864fe0, color=0xffffff) returned 0x0
[0075.921] GdipCreateImageAttributes (imageattr=0x2eabf0) returned 0x0
[0075.922] GdipSetImageAttributesColorKeys (imageattr=0x1b869df0, type=0x0, enableFlag=1, colorLow=0xffffffffffc0c0c0, colorHigh=0xffffffffffc0c0c0) returned 0x0
[0075.922] GdipDrawImageRectRectI (graphics=0x1b864fe0, image=0x1b864090, dstx=0, dsty=0, dstwidth=16, dstheight=16, srcx=0, srcy=0, srcwidth=16, srcheight=16, srcUnit=0x2, imageAttributes=0x1b869df0, callback=0x0, callbackData=0x0) returned 0x0
[0075.923] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0075.923] GdipDisposeImageAttributes (imageattr=0x1b869df0) returned 0x0
[0075.923] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0075.924] GdipDeleteGraphics (graphics=0x1b864fe0) returned 0x0
[0075.924] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0075.924] GdipDisposeImage (image=0x1b864090) returned 0x0
[0075.924] GdipCreateBitmapFromStream (stream=0x1b19ffa0, bitmap=0x2eae38) returned 0x0
[0075.926] GdipImageForceValidation (image=0x1b864090) returned 0x0
[0075.927] GdipGetImageRawFormat (image=0x1b864090, format=0x2eacf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0
[0075.927] GdipGetImageHeight (image=0x1b864090, height=0x2eadf0) returned 0x0
[0075.927] GdipGetImageWidth (image=0x1b864090, width=0x2eadf0) returned 0x0
[0075.927] GdipGetImageWidth (image=0x1b864090, width=0x2eada0) returned 0x0
[0075.927] GdipGetImageHeight (image=0x1b864090, height=0x2eada0) returned 0x0
[0075.927] GdipGetImageWidth (image=0x1b864090, width=0x2ead40) returned 0x0
[0075.927] GdipGetImageHeight (image=0x1b864090, height=0x2ead40) returned 0x0
[0075.927] GdipBitmapGetPixel (bitmap=0x1b864090, x=0, y=15, color=0x2eada0) returned 0x0
[0075.927] GdipGetImageRawFormat (image=0x1b864090, format=0x2eabb0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0
[0075.927] GdipGetImageWidth (image=0x1b864090, width=0x2eab80) returned 0x0
[0075.927] GdipGetImageHeight (image=0x1b864090, height=0x2eab80) returned 0x0
[0075.927] GdipCreateBitmapFromScan0 (width=16, height=16, stride=0, format=0x26200a, scan0=0x0, bitmap=0x2eab90) returned 0x0
[0075.927] GdipGetImagePixelFormat (image=0x1b047460, format=0x2eab60) returned 0x0
[0075.927] GdipGetImageGraphicsContext (image=0x1b047460, graphics=0x2eabc0) returned 0x0
[0075.927] GdipGraphicsClear (graphics=0x1b047cc0, color=0xffffff) returned 0x0
[0075.927] GdipCreateImageAttributes (imageattr=0x2eabf0) returned 0x0
[0075.928] GdipSetImageAttributesColorKeys (imageattr=0x1b869df0, type=0x0, enableFlag=1, colorLow=0xffffffffffc0c0c0, colorHigh=0xffffffffffc0c0c0) returned 0x0
[0075.928] GdipDrawImageRectRectI (graphics=0x1b047cc0, image=0x1b864090, dstx=0, dsty=0, dstwidth=16, dstheight=16, srcx=0, srcy=0, srcwidth=16, srcheight=16, srcUnit=0x2, imageAttributes=0x1b869df0, callback=0x0, callbackData=0x0) returned 0x0
[0075.928] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0075.928] GdipDisposeImageAttributes (imageattr=0x1b869df0) returned 0x0
[0075.928] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0075.928] GdipDeleteGraphics (graphics=0x1b047cc0) returned 0x0
[0075.928] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0075.928] GdipDisposeImage (image=0x1b864090) returned 0x0
[0075.928] AdjustWindowRectEx (in: lpRect=0x2eace0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2eace0) returned 1
[0075.930] GetCurrentThreadId () returned 0x968
[0075.930] GetCurrentThreadId () returned 0x968
[0075.930] AdjustWindowRectEx (in: lpRect=0x2eace0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2eace0) returned 1
[0075.930] GetCurrentThreadId () returned 0x968
[0075.930] GetCurrentThreadId () returned 0x968
[0075.930] AdjustWindowRectEx (in: lpRect=0x2eace0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2eace0) returned 1
[0075.930] GetCurrentThreadId () returned 0x968
[0075.930] GetCurrentThreadId () returned 0x968
[0075.932] GetSystemMetrics (nIndex=5) returned 1
[0075.932] GetSystemMetrics (nIndex=6) returned 1
[0075.932] AdjustWindowRectEx (in: lpRect=0x2eab90, dwStyle=0x56210044, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2eab90) returned 1
[0075.932] AdjustWindowRectEx (in: lpRect=0x2eab90, dwStyle=0x56210044, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2eab90) returned 1
[0075.934] AdjustWindowRectEx (in: lpRect=0x2eace0, dwStyle=0x563008c4, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2eace0) returned 1
[0075.934] GetCurrentThreadId () returned 0x968
[0075.934] GetCurrentThreadId () returned 0x968
[0076.054] GetProcessWindowStation () returned 0x44
[0076.055] GetCapture () returned 0x0
[0076.055] GetActiveWindow () returned 0x0
[0076.057] GetCurrentActCtx (in: lphActCtx=0x2eac40 | out: lphActCtx=0x2eac40*=0x1a4cd8) returned 1
[0076.057] GetProcessWindowStation () returned 0x44
[0076.082] OleInitialize (pvReserved=0x0) returned 0x0
[0076.083] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x2ea970 | out: lplpMessageFilter=0x2ea970*=0x0) returned 0x0
[0076.084] GetCurrentThreadId () returned 0x968
[0076.085] EnumThreadWindows (dwThreadId=0x968, lpfn=0x9b7ecc, lParam=0x0) returned 1
[0076.090] IsWindowVisible (hWnd=0x301ae) returned 0
[0076.090] IsWindowVisible (hWnd=0x301b8) returned 0
[0076.090] IsWindowVisible (hWnd=0x301b2) returned 0
[0076.090] GetActiveWindow () returned 0x0
[0076.091] GetFocus () returned 0x0
[0076.091] GetCurrentActCtx (in: lphActCtx=0x2ea8a0 | out: lphActCtx=0x2ea8a0*=0x1a4cd8) returned 1
[0076.091] AdjustWindowRectEx (in: lpRect=0x2ea750, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2ea750) returned 1
[0076.091] GetCursorPos (in: lpPoint=0x2875918 | out: lpPoint=0x2875918*(x=591, y=123)) returned 1
[0076.091] MonitorFromPoint (pt=0x7b0000024f, dwFlags=0x2) returned 0x10001
[0076.091] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ea5a0 | out: lpmi=0x2ea5a0) returned 1
[0076.091] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x12010836
[0076.091] GetDeviceCaps (hdc=0x12010836, index=12) returned 32
[0076.091] GetDeviceCaps (hdc=0x12010836, index=14) returned 1
[0076.091] DeleteDC (hdc=0x12010836) returned 1
[0076.092] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ea6a0 | out: lpmi=0x2ea6a0) returned 1
[0076.092] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000
[0076.092] CreateWindowExW (dwExStyle=0x50001, lpClassName="WindowsForms10.Window.8.app.0.33c0d9d", lpWindowName="Microsoft .NET Framework", dwStyle=0x2c80000, X=498, Y=347, nWidth=444, nHeight=166, hWndParent=0x0, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x201d6
[0076.092] SetWindowLongPtrW (hWnd=0x201d6, nIndex=-4, dwNewLong=0x77c7b0ac) returned 0x9a150c
[0076.092] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-4) returned 0x77c7b0ac
[0076.092] SetWindowLongPtrW (hWnd=0x201d6, nIndex=-4, dwNewLong=0x9b7f1c) returned 0x77c7b0ac
[0076.092] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-4) returned 0x9b7f1c
[0076.092] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-16) returned 0x6c80000
[0076.093] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x81, wParam=0x0, lParam=0x2e9f40) returned 0x1
[0076.093] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x83, wParam=0x0, lParam=0x2e9fe0) returned 0x0
[0076.093] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x1, wParam=0x0, lParam=0x2e9f00) returned 0x0
[0076.093] GetClientRect (in: hWnd=0x201d6, lpRect=0x2e9710 | out: lpRect=0x2e9710) returned 1
[0076.093] GetWindowRect (in: hWnd=0x201d6, lpRect=0x2e9710 | out: lpRect=0x2e9710) returned 1
[0076.093] SetWindowTextW (hWnd=0x201d6, lpString="Microsoft .NET Framework") returned 1
[0076.093] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xc, wParam=0x0, lParam=0x2872280) returned 0x1
[0076.094] GetStartupInfoW (in: lpStartupInfo=0x2875da0 | out: lpStartupInfo=0x2875da0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0))
[0076.094] GetParent (hWnd=0x201d6) returned 0x0
[0076.094] SetWindowLongPtrW (hWnd=0x201d6, nIndex=-8, dwNewLong=0x0) returned 0x0
[0076.094] SendMessageW (hWnd=0x201d6, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0
[0076.094] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0
[0076.094] SendMessageW (hWnd=0x201d6, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0
[0076.094] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0
[0076.210] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0076.210] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0076.210] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0076.215] GetSystemMenu (hWnd=0x201d6, bRevert=0) returned 0x5012b
[0076.215] GetWindowPlacement (in: hWnd=0x201d6, lpwndpl=0x2ea760 | out: lpwndpl=0x2ea760) returned 1
[0076.215] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf020, uEnable=0x1) returned 0
[0076.215] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf030, uEnable=0x1) returned 0
[0076.215] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf060, uEnable=0x0) returned 0
[0076.215] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf120, uEnable=0x1) returned 0
[0076.215] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf000, uEnable=0x1) returned 0
[0076.215] GetClientRect (in: hWnd=0x201d6, lpRect=0x2ea880 | out: lpRect=0x2ea880) returned 1
[0076.215] GetClientRect (in: hWnd=0x201d6, lpRect=0x2ea760 | out: lpRect=0x2ea760) returned 1
[0076.215] GetWindowRect (in: hWnd=0x201d6, lpRect=0x2ea760 | out: lpRect=0x2ea760) returned 1
[0076.215] SetWindowPos (hWnd=0x201d6, hWndInsertAfter=0xffffffffffffffff, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1
[0076.215] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x46, wParam=0x0, lParam=0x2ea860) returned 0x0
[0076.216] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x46, wParam=0x0, lParam=0x2ea860) returned 0x0
[0076.216] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
[0076.216] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
[0076.216] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
[0076.216] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
[0076.216] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0076.216] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0076.216] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0077.325] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
[0077.327] GetKeyboardLayout (idThread=0x0) returned 0x4090409
[0077.327] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
[0077.329] GetParent (hWnd=0x201d6) returned 0x0
[0077.330] GetKeyboardLayout (idThread=0x0) returned 0x4090409
[0077.331] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0
[0077.331] GetWindowPlacement (in: hWnd=0x201d6, lpwndpl=0x2ea2c0 | out: lpwndpl=0x2ea2c0) returned 1
[0077.331] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x47, wParam=0x0, lParam=0x2ea860) returned 0x0
[0077.332] GetClientRect (in: hWnd=0x201d6, lpRect=0x2ea060 | out: lpRect=0x2ea060) returned 1
[0077.332] GetWindowRect (in: hWnd=0x201d6, lpRect=0x2ea060 | out: lpRect=0x2ea060) returned 1
[0077.332] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0077.332] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0077.332] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0077.332] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x83, wParam=0x1, lParam=0x2ea1c0) returned 0x0
[0077.333] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-16) returned 0x6c80000
[0077.333] GetWindowTextLengthW (hWnd=0x201d6) returned 24
[0077.333] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0077.333] GetSystemMetrics (nIndex=42) returned 0
[0077.333] CoTaskMemAlloc (cb=0x36) returned 0x1b57a560
[0077.333] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b57a560, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0077.333] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b57a560) returned 0x18
[0077.333] CoTaskMemFree (pv=0x1b57a560)
[0077.333] GetWindowTextLengthW (hWnd=0x201d6) returned 24
[0077.333] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0077.333] GetSystemMetrics (nIndex=42) returned 0
[0077.333] CoTaskMemAlloc (cb=0x36) returned 0x1b57a560
[0077.333] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b57a560, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0077.333] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b57a560) returned 0x18
[0077.333] CoTaskMemFree (pv=0x1b57a560)
[0077.333] GetCursorPos (in: lpPoint=0x28761d8 | out: lpPoint=0x28761d8*(x=591, y=123)) returned 1
[0077.333] MonitorFromPoint (pt=0x7e00000250, dwFlags=0x2) returned 0x10001
[0077.333] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ea5d0 | out: lpmi=0x2ea5d0) returned 1
[0077.333] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x9010720
[0077.334] GetDeviceCaps (hdc=0x9010720, index=12) returned 32
[0077.334] GetDeviceCaps (hdc=0x9010720, index=14) returned 1
[0077.334] DeleteDC (hdc=0x9010720) returned 1
[0077.334] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ea6d0 | out: lpmi=0x2ea6d0) returned 1
[0077.334] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-16) returned 0x6c80000
[0077.334] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-20) returned 0x50109
[0077.334] SetWindowLongPtrW (hWnd=0x201d6, nIndex=-16, dwNewLong=0x2c80000) returned 0x6c80000
[0077.334] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x2ea7a0) returned 0x0
[0077.334] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x2ea7a0) returned 0x0
[0077.334] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0077.334] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0077.335] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0077.335] SetWindowLongPtrW (hWnd=0x201d6, nIndex=-20, dwNewLong=0x50001) returned 0x50109
[0077.335] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x2ea7a0) returned 0x0
[0077.335] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x2ea7a0) returned 0x0
[0077.335] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0077.335] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0077.335] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0077.335] SetWindowPos (hWnd=0x201d6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1
[0077.335] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x46, wParam=0x0, lParam=0x2ea840) returned 0x0
[0077.339] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x83, wParam=0x1, lParam=0x2ea810) returned 0x0
[0077.339] GetWindowPlacement (in: hWnd=0x201d6, lpwndpl=0x2ea2a0 | out: lpwndpl=0x2ea2a0) returned 1
[0077.339] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x47, wParam=0x0, lParam=0x2ea840) returned 0x0
[0077.339] GetClientRect (in: hWnd=0x201d6, lpRect=0x2ea040 | out: lpRect=0x2ea040) returned 1
[0077.339] GetWindowRect (in: hWnd=0x201d6, lpRect=0x2ea040 | out: lpRect=0x2ea040) returned 1
[0077.339] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0077.339] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0077.339] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0077.339] RedrawWindow (hWnd=0x201d6, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
[0077.340] GetSystemMenu (hWnd=0x201d6, bRevert=0) returned 0x5012b
[0077.340] GetWindowPlacement (in: hWnd=0x201d6, lpwndpl=0x2ea760 | out: lpwndpl=0x2ea760) returned 1
[0077.340] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf020, uEnable=0x1) returned 1
[0077.340] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf030, uEnable=0x1) returned 1
[0077.340] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf060, uEnable=0x0) returned 0
[0077.340] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf120, uEnable=0x1) returned 1
[0077.340] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf000, uEnable=0x1) returned 1
[0077.340] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-8) returned 0x0
[0077.340] IsWindowEnabled (hWnd=0x201d6) returned 1
[0077.340] ShowWindow (hWnd=0x201d6, nCmdShow=5) returned 0
[0077.340] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0077.341] GetCurrentActCtx (in: lphActCtx=0x2e9f40 | out: lphActCtx=0x2e9f40*=0x1a4cd8) returned 1
[0077.341] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000
[0077.341] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x56000000, X=0, Y=0, nWidth=64, nHeight=64, hWndParent=0x201d6, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x201cc
[0077.341] SetWindowLongPtrW (hWnd=0x201cc, nIndex=-4, dwNewLong=0x77c7b0ac) returned 0x9a150c
[0077.341] GetWindowLongPtrW (hWnd=0x201cc, nIndex=-4) returned 0x77c7b0ac
[0077.341] SetWindowLongPtrW (hWnd=0x201cc, nIndex=-4, dwNewLong=0x9b7f6c) returned 0x77c7b0ac
[0077.341] GetWindowLongPtrW (hWnd=0x201cc, nIndex=-4) returned 0x9b7f6c
[0077.341] GetWindowLongPtrW (hWnd=0x201cc, nIndex=-16) returned 0x46000000
[0077.341] GetWindowLongPtrW (hWnd=0x201cc, nIndex=-12) returned 0x0
[0077.341] SetWindowLongPtrW (hWnd=0x201cc, nIndex=-12, dwNewLong=0x201cc) returned 0x0
[0077.341] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x81, wParam=0x0, lParam=0x2e95e0) returned 0x1
[0077.342] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x83, wParam=0x0, lParam=0x2e9680) returned 0x0
[0077.342] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x1, wParam=0x0, lParam=0x2e95e0) returned 0x0
[0077.342] GetWindow (hWnd=0x201cc, uCmd=0x3) returned 0x0
[0077.342] GetClientRect (in: hWnd=0x201cc, lpRect=0x2e8e30 | out: lpRect=0x2e8e30) returned 1
[0077.342] GetWindowRect (in: hWnd=0x201cc, lpRect=0x2e8e30 | out: lpRect=0x2e8e30) returned 1
[0077.342] GetParent (hWnd=0x201cc) returned 0x201d6
[0077.342] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8e20, cPoints=0x2 | out: lpPoints=0x2e8e20) returned -24314357
[0077.343] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x5, wParam=0x0, lParam=0x400040) returned 0x0
[0077.343] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0
[0077.343] GetClientRect (in: hWnd=0x201cc, lpRect=0x2e8f30 | out: lpRect=0x2e8f30) returned 1
[0077.343] GetWindowRect (in: hWnd=0x201cc, lpRect=0x2e8f30 | out: lpRect=0x2e8f30) returned 1
[0077.343] GetParent (hWnd=0x201cc) returned 0x201d6
[0077.343] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8f20, cPoints=0x2 | out: lpPoints=0x2e8f20) returned -24314357
[0077.343] SendMessageW (hWnd=0x201cc, Msg=0x2210, wParam=0x1cc0001, lParam=0x201cc) returned 0x0
[0077.343] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x2210, wParam=0x1cc0001, lParam=0x201cc) returned 0x0
[0077.343] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0077.344] GetParent (hWnd=0x201cc) returned 0x201d6
[0077.344] GetParent (hWnd=0x201da) returned 0x201d8
[0077.344] SetParent (hWndChild=0x201da, hWndNewParent=0x201d6) returned 0x201d8
[0077.344] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0
[0077.344] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x46, wParam=0x0, lParam=0x2e9ee0) returned 0x0
[0077.345] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0
[0077.345] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x47, wParam=0x0, lParam=0x2e9ee0) returned 0x0
[0077.345] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x3, wParam=0x0, lParam=0x80040) returned 0x0
[0077.345] GetClientRect (in: hWnd=0x201da, lpRect=0x2e8a90 | out: lpRect=0x2e8a90) returned 1
[0077.345] GetWindowRect (in: hWnd=0x201da, lpRect=0x2e8a90 | out: lpRect=0x2e8a90) returned 1
[0077.345] GetParent (hWnd=0x201da) returned 0x201d6
[0077.345] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8a80, cPoints=0x2 | out: lpPoints=0x2e8a80) returned -24314357
[0077.345] GetClientRect (in: hWnd=0x201da, lpRect=0x2e9670 | out: lpRect=0x2e9670) returned 1
[0077.345] GetWindowRect (in: hWnd=0x201da, lpRect=0x2e9670 | out: lpRect=0x2e9670) returned 1
[0077.345] GetParent (hWnd=0x201da) returned 0x201d6
[0077.345] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e9660, cPoints=0x2 | out: lpPoints=0x2e9660) returned -24314357
[0077.345] GetParent (hWnd=0x201da) returned 0x201d6
[0077.345] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0077.346] GetWindow (hWnd=0x201da, uCmd=0x3) returned 0x0
[0077.346] SetWindowPos (hWnd=0x201da, hWndInsertAfter=0x201cc, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1
[0077.346] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x46, wParam=0x0, lParam=0x2e9d90) returned 0x0
[0077.346] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0
[0077.346] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x47, wParam=0x0, lParam=0x2e9d90) returned 0x0
[0077.346] GetClientRect (in: hWnd=0x201da, lpRect=0x2e9520 | out: lpRect=0x2e9520) returned 1
[0077.346] GetWindowRect (in: hWnd=0x201da, lpRect=0x2e9520 | out: lpRect=0x2e9520) returned 1
[0077.346] GetParent (hWnd=0x201da) returned 0x201d6
[0077.346] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e9510, cPoints=0x2 | out: lpPoints=0x2e9510) returned -24314357
[0077.346] GetParent (hWnd=0x201da) returned 0x201d6
[0077.347] GetWindow (hWnd=0x201da, uCmd=0x3) returned 0x201cc
[0077.347] GetWindowThreadProcessId (in: hWnd=0x201da, lpdwProcessId=0x2e9f60 | out: lpdwProcessId=0x2e9f60) returned 0x968
[0077.348] GetCurrentActCtx (in: lphActCtx=0x2e9f40 | out: lphActCtx=0x2e9f40*=0x1a4cd8) returned 1
[0077.348] GetClassInfoW (in: hInstance=0x0, lpClassName="BUTTON", lpWndClass=0x28767b0 | out: lpWndClass=0x28767b0) returned 1
[0077.349] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000
[0077.349] CoTaskMemAlloc (cb=0x48) returned 0x1b5789b0
[0077.349] RegisterClassW (lpWndClass=0x2e9c20) returned 0xc142
[0077.349] CoTaskMemFree (pv=0x1b5789b0)
[0077.349] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000
[0077.349] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.33c0d9d", lpWindowName="&Details", dwStyle=0x5601000b, X=8, Y=107, nWidth=100, nHeight=23, hWndParent=0x201d6, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x201ce
[0077.349] SetWindowLongPtrW (hWnd=0x201ce, nIndex=-4, dwNewLong=0x7fefc713b20) returned 0x9b7fbc
[0077.349] GetWindowLongPtrW (hWnd=0x201ce, nIndex=-4) returned 0x7fefc713b20
[0077.350] SetWindowLongPtrW (hWnd=0x201ce, nIndex=-4, dwNewLong=0x9b800c) returned 0x7fefc713b20
[0077.350] GetWindowLongPtrW (hWnd=0x201ce, nIndex=-4) returned 0x9b800c
[0077.350] GetWindowLongPtrW (hWnd=0x201ce, nIndex=-16) returned 0x4601000b
[0077.350] GetWindowLongPtrW (hWnd=0x201ce, nIndex=-12) returned 0x0
[0077.350] SetWindowLongPtrW (hWnd=0x201ce, nIndex=-12, dwNewLong=0x201ce) returned 0x0
[0077.350] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x81, wParam=0x0, lParam=0x2e95e0) returned 0x1
[0077.351] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x83, wParam=0x0, lParam=0x2e9680) returned 0x0
[0077.351] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x1, wParam=0x0, lParam=0x2e95c0) returned 0x0
[0077.351] SendMessageW (hWnd=0x201ce, Msg=0x2055, wParam=0x201ce, lParam=0x3) returned 0x2
[0077.351] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0
[0077.351] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0
[0077.351] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0
[0077.352] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
[0077.352] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
[0077.352] RedrawWindow (hWnd=0x201cc, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
[0077.352] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
[0077.352] RedrawWindow (hWnd=0x201da, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
[0077.352] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
[0077.352] RedrawWindow (hWnd=0x201ce, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
[0077.352] RedrawWindow (hWnd=0x201d6, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
[0077.352] GetWindow (hWnd=0x201ce, uCmd=0x3) returned 0x201da
[0077.352] GetClientRect (in: hWnd=0x201ce, lpRect=0x2e8d60 | out: lpRect=0x2e8d60) returned 1
[0077.352] GetWindowRect (in: hWnd=0x201ce, lpRect=0x2e8d60 | out: lpRect=0x2e8d60) returned 1
[0077.352] GetParent (hWnd=0x201ce) returned 0x201d6
[0077.352] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8d50, cPoints=0x2 | out: lpPoints=0x2e8d50) returned -24314357
[0077.353] SetWindowTextW (hWnd=0x201ce, lpString="&Details") returned 1
[0077.353] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0xc, wParam=0x0, lParam=0x28738b0) returned 0x1
[0077.353] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0
[0077.353] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x3, wParam=0x0, lParam=0x6b0008) returned 0x0
[0077.353] GetClientRect (in: hWnd=0x201ce, lpRect=0x2e8e80 | out: lpRect=0x2e8e80) returned 1
[0077.353] GetWindowRect (in: hWnd=0x201ce, lpRect=0x2e8e80 | out: lpRect=0x2e8e80) returned 1
[0077.353] GetParent (hWnd=0x201ce) returned 0x201d6
[0077.353] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8e70, cPoints=0x2 | out: lpPoints=0x2e8e70) returned -24314357
[0077.353] SendMessageW (hWnd=0x201ce, Msg=0x2210, wParam=0x1ce0001, lParam=0x201ce) returned 0x0
[0077.353] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x2210, wParam=0x1ce0001, lParam=0x201ce) returned 0x0
[0077.353] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0077.353] GetParent (hWnd=0x201ce) returned 0x201d6
[0077.353] GetCurrentActCtx (in: lphActCtx=0x2e9f40 | out: lphActCtx=0x2e9f40*=0x1a4cd8) returned 1
[0077.354] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000
[0077.354] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.33c0d9d", lpWindowName="&Continue", dwStyle=0x5601000b, X=225, Y=107, nWidth=100, nHeight=23, hWndParent=0x201d6, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x201c8
[0077.354] SetWindowLongPtrW (hWnd=0x201c8, nIndex=-4, dwNewLong=0x7fefc713b20) returned 0x9b7fbc
[0077.354] GetWindowLongPtrW (hWnd=0x201c8, nIndex=-4) returned 0x7fefc713b20
[0077.354] SetWindowLongPtrW (hWnd=0x201c8, nIndex=-4, dwNewLong=0x9b805c) returned 0x7fefc713b20
[0077.354] GetWindowLongPtrW (hWnd=0x201c8, nIndex=-4) returned 0x9b805c
[0077.354] GetWindowLongPtrW (hWnd=0x201c8, nIndex=-16) returned 0x4601000b
[0077.354] GetWindowLongPtrW (hWnd=0x201c8, nIndex=-12) returned 0x0
[0077.354] SetWindowLongPtrW (hWnd=0x201c8, nIndex=-12, dwNewLong=0x201c8) returned 0x0
[0077.354] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x81, wParam=0x0, lParam=0x2e95e0) returned 0x1
[0077.354] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x83, wParam=0x0, lParam=0x2e9680) returned 0x0
[0077.355] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x1, wParam=0x0, lParam=0x2e95c0) returned 0x0
[0077.355] SendMessageW (hWnd=0x201c8, Msg=0x2055, wParam=0x201c8, lParam=0x3) returned 0x2
[0077.355] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3
[0077.355] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0
[0077.355] GetWindow (hWnd=0x201c8, uCmd=0x3) returned 0x201ce
[0077.355] GetClientRect (in: hWnd=0x201c8, lpRect=0x2e8d60 | out: lpRect=0x2e8d60) returned 1
[0077.355] GetWindowRect (in: hWnd=0x201c8, lpRect=0x2e8d60 | out: lpRect=0x2e8d60) returned 1
[0077.355] GetParent (hWnd=0x201c8) returned 0x201d6
[0077.355] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8d50, cPoints=0x2 | out: lpPoints=0x2e8d50) returned -24314357
[0077.355] SetWindowTextW (hWnd=0x201c8, lpString="&Continue") returned 1
[0077.355] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0xc, wParam=0x0, lParam=0x2873740) returned 0x1
[0077.356] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0
[0077.356] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x3, wParam=0x0, lParam=0x6b00e1) returned 0x0
[0077.356] GetClientRect (in: hWnd=0x201c8, lpRect=0x2e8e80 | out: lpRect=0x2e8e80) returned 1
[0077.356] GetWindowRect (in: hWnd=0x201c8, lpRect=0x2e8e80 | out: lpRect=0x2e8e80) returned 1
[0077.356] GetParent (hWnd=0x201c8) returned 0x201d6
[0077.356] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8e70, cPoints=0x2 | out: lpPoints=0x2e8e70) returned -24314357
[0077.356] SendMessageW (hWnd=0x201c8, Msg=0x2210, wParam=0x1c80001, lParam=0x201c8) returned 0x0
[0077.356] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x2210, wParam=0x1c80001, lParam=0x201c8) returned 0x0
[0077.356] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0077.356] GetParent (hWnd=0x201c8) returned 0x201d6
[0077.356] GetCurrentActCtx (in: lphActCtx=0x2e9f40 | out: lphActCtx=0x2e9f40*=0x1a4cd8) returned 1
[0077.356] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000
[0077.356] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.33c0d9d", lpWindowName="&Quit", dwStyle=0x5601000b, X=330, Y=107, nWidth=100, nHeight=23, hWndParent=0x201d6, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x201ca
[0077.356] SetWindowLongPtrW (hWnd=0x201ca, nIndex=-4, dwNewLong=0x7fefc713b20) returned 0x9b7fbc
[0077.356] GetWindowLongPtrW (hWnd=0x201ca, nIndex=-4) returned 0x7fefc713b20
[0077.357] SetWindowLongPtrW (hWnd=0x201ca, nIndex=-4, dwNewLong=0x9b80ac) returned 0x7fefc713b20
[0077.357] GetWindowLongPtrW (hWnd=0x201ca, nIndex=-4) returned 0x9b80ac
[0077.357] GetWindowLongPtrW (hWnd=0x201ca, nIndex=-16) returned 0x4601000b
[0077.357] GetWindowLongPtrW (hWnd=0x201ca, nIndex=-12) returned 0x0
[0077.357] SetWindowLongPtrW (hWnd=0x201ca, nIndex=-12, dwNewLong=0x201ca) returned 0x0
[0077.357] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x81, wParam=0x0, lParam=0x2e95e0) returned 0x1
[0077.357] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x83, wParam=0x0, lParam=0x2e9680) returned 0x0
[0077.357] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x1, wParam=0x0, lParam=0x2e95c0) returned 0x0
[0077.357] SendMessageW (hWnd=0x201ca, Msg=0x2055, wParam=0x201ca, lParam=0x3) returned 0x2
[0077.357] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3
[0077.357] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0
[0077.357] GetWindow (hWnd=0x201ca, uCmd=0x3) returned 0x201c8
[0077.357] GetClientRect (in: hWnd=0x201ca, lpRect=0x2e8d60 | out: lpRect=0x2e8d60) returned 1
[0077.357] GetWindowRect (in: hWnd=0x201ca, lpRect=0x2e8d60 | out: lpRect=0x2e8d60) returned 1
[0077.357] GetParent (hWnd=0x201ca) returned 0x201d6
[0077.357] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8d50, cPoints=0x2 | out: lpPoints=0x2e8d50) returned -24314357
[0077.358] SetWindowTextW (hWnd=0x201ca, lpString="&Quit") returned 1
[0077.358] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0xc, wParam=0x0, lParam=0x28737c0) returned 0x1
[0077.358] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0
[0077.358] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x3, wParam=0x0, lParam=0x6b014a) returned 0x0
[0077.358] GetClientRect (in: hWnd=0x201ca, lpRect=0x2e8e80 | out: lpRect=0x2e8e80) returned 1
[0077.358] GetWindowRect (in: hWnd=0x201ca, lpRect=0x2e8e80 | out: lpRect=0x2e8e80) returned 1
[0077.358] GetParent (hWnd=0x201ca) returned 0x201d6
[0077.358] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8e70, cPoints=0x2 | out: lpPoints=0x2e8e70) returned -24314357
[0077.358] SendMessageW (hWnd=0x201ca, Msg=0x2210, wParam=0x1ca0001, lParam=0x201ca) returned 0x0
[0077.358] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x2210, wParam=0x1ca0001, lParam=0x201ca) returned 0x0
[0077.358] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0077.358] GetParent (hWnd=0x201ca) returned 0x201d6
[0077.358] GetCurrentActCtx (in: lphActCtx=0x2e9ef0 | out: lphActCtx=0x2e9ef0*=0x1a4cd8) returned 1
[0077.359] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000
[0077.359] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.33c0d9d", lpWindowName="See the end of this message for details on invoking \r\njust-in-time (JIT) debugging instead of this dialog box.\r\n\r\n************** Exception Text **************\r\nSystem.IO.DirectoryNotFoundException: Could not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.\r\n at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)\r\n at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy)\r\n at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)\r\n at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)\r\n at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding, Int32 bufferSize)\r\n at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding)\r\n at System.IO.File.WriteAllText(String path, String contents, Encoding encoding)\r\n at get.ranran.html()\r\n at get.ranran.Form1_Load(Object sender, EventArgs e)\r\n at System.EventHandler.Invoke(Object sender, EventArgs e)\r\n at System.Windows.Forms.Form.OnLoad(EventArgs e)\r\n at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)\r\n at System.Windows.Forms.Control.CreateControl()\r\n at System.Windows.Forms.Control.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Control.WndProc(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)\r\n at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)\r\n\r\n\r\n************** Loaded Assemblies **************\r\nmscorlib\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/Microsoft.NET/Framework64/v2.0.50727/mscorlib.dll\r\n----------------------------------------\r\nget\r\n Assembly Version: 1.0.0.0\r\n Win32 Version: 1.0.0.0\r\n CodeBase: file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/KryptoTrojaner.exe\r\n----------------------------------------\r\nMicrosoft.VisualBasic\r\n Assembly Version: 8.0.0.0\r\n Win32 Version: 8.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/Microsoft.VisualBasic/8.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualBasic.dll\r\n----------------------------------------\r\nSystem\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll\r\n----------------------------------------\r\nSystem.Windows.Forms\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll\r\n----------------------------------------\r\nSystem.Drawing\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll\r\n----------------------------------------\r\nSystem.Runtime.Remoting\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Runtime.Remoting/2.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll\r\n----------------------------------------\r\n9ee08ca6-3f27-4b57-b8d0-4985d08ba511\r\n Assembly Version: 1.0.0.0\r\n Win32 Version: 1.0.0.0\r\n CodeBase: file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/KryptoTrojaner.exe\r\n----------------------------------------\r\n\r\n************** JIT Debugging **************\r\nTo enable just-in-time (JIT) debugging, the .config file for this\r\napplication or computer (machine.config) must have the\r\njitDebugging value set in the system.windows.forms section.\r\nThe application must also be compiled with debugging\r\nenabled.\r\n\r\nFor example:\r\n\r\n\r\n \r\n\r\n\r\nWhen JIT debugging is enabled, any unhandled exception\r\nwill be sent to the JIT debugger registered on the computer\r\nrather than be handled by this dialog box.\r\n\r\n\r\n", dwStyle=0x563008c4, X=8, Y=138, nWidth=422, nHeight=154, hWndParent=0x201d6, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x201e2
[0077.359] SetWindowLongPtrW (hWnd=0x201e2, nIndex=-4, dwNewLong=0x7fefc71975c) returned 0x9b202c
[0077.359] GetWindowLongPtrW (hWnd=0x201e2, nIndex=-4) returned 0x7fefc71975c
[0077.359] SetWindowLongPtrW (hWnd=0x201e2, nIndex=-4, dwNewLong=0x9b80fc) returned 0x7fefc71975c
[0077.359] GetWindowLongPtrW (hWnd=0x201e2, nIndex=-4) returned 0x9b80fc
[0077.359] GetWindowLongPtrW (hWnd=0x201e2, nIndex=-16) returned 0x463008c4
[0077.359] GetWindowLongPtrW (hWnd=0x201e2, nIndex=-12) returned 0x0
[0077.359] SetWindowLongPtrW (hWnd=0x201e2, nIndex=-12, dwNewLong=0x201e2) returned 0x0
[0077.359] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x81, wParam=0x0, lParam=0x2e9590) returned 0x1
[0077.360] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x83, wParam=0x0, lParam=0x2e9630) returned 0x0
[0077.360] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x1, wParam=0x0, lParam=0x2e95d0) returned 0x1
[0077.376] GetWindow (hWnd=0x201e2, uCmd=0x3) returned 0x201ca
[0077.376] GetClientRect (in: hWnd=0x201e2, lpRect=0x2e8e20 | out: lpRect=0x2e8e20) returned 1
[0077.376] GetWindowRect (in: hWnd=0x201e2, lpRect=0x2e8e20 | out: lpRect=0x2e8e20) returned 1
[0077.376] GetParent (hWnd=0x201e2) returned 0x201d6
[0077.376] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8e10, cPoints=0x2 | out: lpPoints=0x2e8e10) returned -24314357
[0077.376] GetWindowTextLengthW (hWnd=0x201d6) returned 24
[0077.376] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0077.376] GetSystemMetrics (nIndex=42) returned 0
[0077.376] CoTaskMemAlloc (cb=0x36) returned 0x1b57a560
[0077.376] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b57a560, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0077.376] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b57a560) returned 0x18
[0077.376] CoTaskMemFree (pv=0x1b57a560)
[0077.376] SendMessageW (hWnd=0x201e2, Msg=0x30, wParam=0x2e0a0218, lParam=0x0) returned 0x1
[0077.376] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x30, wParam=0x2e0a0218, lParam=0x0) returned 0x1
[0077.393] SetWindowTextW (hWnd=0x201e2, lpString="See the end of this message for details on invoking \r\njust-in-time (JIT) debugging instead of this dialog box.\r\n\r\n************** Exception Text **************\r\nSystem.IO.DirectoryNotFoundException: Could not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.\r\n at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)\r\n at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy)\r\n at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)\r\n at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)\r\n at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding, Int32 bufferSize)\r\n at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding)\r\n at System.IO.File.WriteAllText(String path, String contents, Encoding encoding)\r\n at get.ranran.html()\r\n at get.ranran.Form1_Load(Object sender, EventArgs e)\r\n at System.EventHandler.Invoke(Object sender, EventArgs e)\r\n at System.Windows.Forms.Form.OnLoad(EventArgs e)\r\n at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)\r\n at System.Windows.Forms.Control.CreateControl()\r\n at System.Windows.Forms.Control.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Control.WndProc(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)\r\n at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)\r\n\r\n\r\n************** Loaded Assemblies **************\r\nmscorlib\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/Microsoft.NET/Framework64/v2.0.50727/mscorlib.dll\r\n----------------------------------------\r\nget\r\n Assembly Version: 1.0.0.0\r\n Win32 Version: 1.0.0.0\r\n CodeBase: file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/KryptoTrojaner.exe\r\n----------------------------------------\r\nMicrosoft.VisualBasic\r\n Assembly Version: 8.0.0.0\r\n Win32 Version: 8.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/Microsoft.VisualBasic/8.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualBasic.dll\r\n----------------------------------------\r\nSystem\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll\r\n----------------------------------------\r\nSystem.Windows.Forms\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll\r\n----------------------------------------\r\nSystem.Drawing\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll\r\n----------------------------------------\r\nSystem.Runtime.Remoting\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Runtime.Remoting/2.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll\r\n----------------------------------------\r\n9ee08ca6-3f27-4b57-b8d0-4985d08ba511\r\n Assembly Version: 1.0.0.0\r\n Win32 Version: 1.0.0.0\r\n CodeBase: file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/KryptoTrojaner.exe\r\n----------------------------------------\r\n\r\n************** JIT Debugging **************\r\nTo enable just-in-time (JIT) debugging, the .config file for this\r\napplication or computer (machine.config) must have the\r\njitDebugging value set in the system.windows.forms section.\r\nThe application must also be compiled with debugging\r\nenabled.\r\n\r\nFor example:\r\n\r\n\r\n \r\n\r\n\r\nWhen JIT debugging is enabled, any unhandled exception\r\nwill be sent to the JIT debugger registered on the computer\r\nrather than be handled by this dialog box.\r\n\r\n\r\n") returned 1
[0077.393] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0xc, wParam=0x0, lParam=0x286a4b0) returned 0x1
[0077.395] GetSystemMetrics (nIndex=5) returned 1
[0077.395] GetSystemMetrics (nIndex=6) returned 1
[0077.395] SendMessageW (hWnd=0x201e2, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1
[0077.395] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1
[0077.395] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x5, wParam=0x0, lParam=0x850191) returned 0x1
[0077.395] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x3, wParam=0x0, lParam=0x8c000a) returned 0x0
[0077.395] GetClientRect (in: hWnd=0x201e2, lpRect=0x2e8ee0 | out: lpRect=0x2e8ee0) returned 1
[0077.395] GetWindowRect (in: hWnd=0x201e2, lpRect=0x2e8ee0 | out: lpRect=0x2e8ee0) returned 1
[0077.395] GetParent (hWnd=0x201e2) returned 0x201d6
[0077.395] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8ed0, cPoints=0x2 | out: lpPoints=0x2e8ed0) returned -24314357
[0077.395] SendMessageW (hWnd=0x201e2, Msg=0x2210, wParam=0x1e20001, lParam=0x201e2) returned 0x0
[0077.395] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x2210, wParam=0x1e20001, lParam=0x201e2) returned 0x0
[0077.395] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0077.395] GetParent (hWnd=0x201e2) returned 0x201d6
[0077.396] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-8) returned 0x0
[0077.396] GetCursorPos (in: lpPoint=0x28771c0 | out: lpPoint=0x28771c0*(x=591, y=123)) returned 1
[0077.397] MonitorFromPoint (pt=0x2c700000526, dwFlags=0x2) returned 0x10001
[0077.397] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2e9de0 | out: lpmi=0x2e9de0) returned 1
[0077.397] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x15010720
[0077.397] GetDeviceCaps (hdc=0x15010720, index=12) returned 32
[0077.397] GetDeviceCaps (hdc=0x15010720, index=14) returned 1
[0077.397] DeleteDC (hdc=0x15010720) returned 1
[0077.397] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2e9ee0 | out: lpmi=0x2e9ee0) returned 1
[0077.399] GetWindowThreadProcessId (in: hWnd=0x201d6, lpdwProcessId=0x2e9ed0 | out: lpdwProcessId=0x2e9ed0) returned 0x968
[0077.399] GetCurrentThreadId () returned 0x968
[0077.411] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc143
[0077.412] PostMessageW (hWnd=0x201d6, Msg=0xc143, wParam=0x0, lParam=0x0) returned 1
[0077.413] GetWindowTextLengthW (hWnd=0x201d6) returned 24
[0077.413] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0077.413] GetSystemMetrics (nIndex=42) returned 0
[0077.413] CoTaskMemAlloc (cb=0x36) returned 0x1b579fa0
[0077.413] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b579fa0, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0077.413] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b579fa0) returned 0x18
[0077.413] CoTaskMemFree (pv=0x1b579fa0)
[0077.416] GdipImageGetFrameDimensionsCount (image=0x1b863aa0, count=0x2e9dc0) returned 0x0
[0077.416] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x1b5a4590
[0077.417] GdipImageGetFrameDimensionsList (image=0x1b863aa0, dimensionIDs=0x1b5a4590*(Data1=0x6f0024, Data2=0x73, Data3=0x74, Data4=([0]=0x4d, [1]=0x0, [2]=0x65, [3]=0x0, [4]=0x73, [5]=0x0, [6]=0x73, [7]=0x0)), count=0x1) returned 0x0
[0077.419] LocalFree (hMem=0x1b5a4590) returned 0x0
[0077.421] GdipImageGetFrameDimensionsCount (image=0x1b860fd0, count=0x2e9dc0) returned 0x0
[0077.421] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x1b5a45d0
[0077.421] GdipImageGetFrameDimensionsList (image=0x1b860fd0, dimensionIDs=0x1b5a45d0*(Data1=0x550c0028, Data2=0x726e, Data3=0x7365, Data4=([0]=0x74, [1]=0x72, [2]=0x69, [3]=0x63, [4]=0x74, [5]=0x65, [6]=0x64, [7]=0x1)), count=0x1) returned 0x0
[0077.421] LocalFree (hMem=0x1b5a45d0) returned 0x0
[0077.422] SystemParametersInfoW (in: uiAction=0x5f, uiParam=0x0, pvParam=0x2ea160, fWinIni=0x0 | out: pvParam=0x2ea160) returned 1
[0077.422] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x46, wParam=0x0, lParam=0x2ea8a0) returned 0x0
[0077.426] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0077.426] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0077.426] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0077.427] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0077.428] GetWindowPlacement (in: hWnd=0x201d6, lpwndpl=0x2ea320 | out: lpwndpl=0x2ea320) returned 1
[0077.428] GetClientRect (in: hWnd=0x201d6, lpRect=0x2ea1d0 | out: lpRect=0x2ea1d0) returned 1
[0077.429] GetWindowTextLengthW (hWnd=0x201d6) returned 24
[0077.429] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0077.429] GetSystemMetrics (nIndex=42) returned 0
[0077.429] CoTaskMemAlloc (cb=0x36) returned 0x1b579fa0
[0077.429] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b579fa0, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0077.429] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b579fa0) returned 0x18
[0077.429] CoTaskMemFree (pv=0x1b579fa0)
[0077.432] GetClientRect (in: hWnd=0x201d6, lpRect=0x2e9f70 | out: lpRect=0x2e9f70) returned 1
[0077.434] GdipCreateHalftonePalette () returned 0x13080713
[0077.435] SelectPalette (hdc=0xb010833, hPal=0x13080713, bForceBkgd=1) returned 0x188000b
[0077.435] GdipCreateFromHDC (hdc=0xb010833, graphics=0x2e9b40) returned 0x0
[0077.439] GdipSetPageUnit (graphics=0x1b047cc0, unit=0x2) returned 0x0
[0077.464] GdipCreateMatrix (matrix=0x2e9a30) returned 0x0
[0077.465] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869df0) returned 0x0
[0077.466] GdipIsMatrixIdentity (matrix=0x1b869df0, result=0x2e9a90) returned 0x0
[0077.467] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.468] GdipDeleteMatrix (matrix=0x1b869df0) returned 0x0
[0077.470] GdipCreateRegion (region=0x2e9a30) returned 0x0
[0077.472] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0
[0077.473] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e9a60) returned 0x0
[0077.474] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.475] GdipDeleteRegion (region=0x1afad4d0) returned 0x0
[0077.475] GdipSaveGraphics (graphics=0x1b047cc0, state=0x2e9b30) returned 0x0
[0077.522] GdipCreateRegion (region=0x2e9a00) returned 0x0
[0077.522] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0
[0077.522] GdipCreateMatrix (matrix=0x2e9a00) returned 0x0
[0077.522] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869e30) returned 0x0
[0077.522] GdipIsMatrixIdentity (matrix=0x1b869e30, result=0x2e9a60) returned 0x0
[0077.528] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fa0
[0077.528] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fa0) returned 0x0
[0077.528] LocalFree (hMem=0x1b579fa0) returned 0x0
[0077.528] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.528] GdipDeleteMatrix (matrix=0x1b869e30) returned 0x0
[0077.528] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e9ab0) returned 0x0
[0077.528] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.528] GdipDeleteRegion (region=0x1afad4d0) returned 0x0
[0077.529] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e9ae0) returned 0x0
[0077.530] GetCurrentObject (hdc=0xb010833, type=0x1) returned 0x1b00017
[0077.530] GetCurrentObject (hdc=0xb010833, type=0x2) returned 0x1900010
[0077.530] GetCurrentObject (hdc=0xb010833, type=0x7) returned 0x1050032
[0077.530] GetCurrentObject (hdc=0xb010833, type=0x6) returned 0x18a002e
[0077.612] SaveDC (hdc=0xb010833) returned 1
[0077.613] OffsetViewportOrgEx (in: hdc=0xb010833, x=0, y=0, lppt=0x2878508 | out: lppt=0x2878508) returned 1
[0077.614] GetNearestColor (hdc=0xb010833, color=0xf0f0f0) returned 0xf0f0f0
[0077.663] CreateSolidBrush (color=0xf0f0f0) returned 0x1b100720
[0077.664] FillRect (hDC=0xb010833, lprc=0x2e9ab0, hbr=0x1b100720) returned 1
[0077.665] DeleteObject (ho=0x1b100720) returned 1
[0077.666] RestoreDC (hdc=0xb010833, nSavedDC=-1) returned 1
[0077.668] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.669] GdipReleaseDC (graphics=0x1b047cc0, hdc=0xb010833) returned 0x0
[0077.669] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.669] GdipDeleteGraphics (graphics=0x1b047cc0) returned 0x0
[0077.669] SelectPalette (hdc=0xb010833, hPal=0x188000b, bForceBkgd=0) returned 0x13080713
[0077.669] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0077.669] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0077.669] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0077.670] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x14, wParam=0xb010833, lParam=0x0) returned 0x1
[0077.670] GetStockObject (i=5) returned 0x1900015
[0077.670] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0077.670] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x14, wParam=0x1701082e, lParam=0x0) returned 0x1
[0077.670] GetStockObject (i=5) returned 0x1900015
[0077.671] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0077.671] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x14, wParam=0xb010833, lParam=0x0) returned 0x1
[0077.671] GetStockObject (i=5) returned 0x1900015
[0077.671] GetWindowPlacement (in: hWnd=0x201d6, lpwndpl=0x2ea300 | out: lpwndpl=0x2ea300) returned 1
[0077.671] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x47, wParam=0x0, lParam=0x2ea8a0) returned 0x0
[0077.671] GetClientRect (in: hWnd=0x201d6, lpRect=0x2ea0a0 | out: lpRect=0x2ea0a0) returned 1
[0077.671] GetWindowRect (in: hWnd=0x201d6, lpRect=0x2ea0a0 | out: lpRect=0x2ea0a0) returned 1
[0077.671] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0077.671] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0077.672] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0077.672] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x5, wParam=0x0, lParam=0x8a01b6) returned 0x0
[0077.672] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x3, wParam=0x0, lParam=0x17401f5) returned 0x0
[0077.672] GetClientRect (in: hWnd=0x201d6, lpRect=0x2ea170 | out: lpRect=0x2ea170) returned 1
[0077.672] GetWindowRect (in: hWnd=0x201d6, lpRect=0x2ea170 | out: lpRect=0x2ea170) returned 1
[0077.675] InvalidateRect (hWnd=0x201c8, lpRect=0x0, bErase=0) returned 1
[0077.675] InvalidateRect (hWnd=0x201ce, lpRect=0x0, bErase=0) returned 1
[0077.675] GetFocus () returned 0x201d6
[0077.675] GetFocus () returned 0x201d6
[0077.675] SetFocus (hWnd=0x201ce) returned 0x201d6
[0077.676] GetFocus () returned 0x201ce
[0077.676] IsChild (hWndParent=0x201d6, hWnd=0x201ce) returned 1
[0077.676] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x8, wParam=0x201ce, lParam=0x0) returned 0x0
[0077.676] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
[0077.676] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
[0077.676] GetKeyboardLayout (idThread=0x0) returned 0x4090409
[0077.677] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x7, wParam=0x201d6, lParam=0x0) returned 0x0
[0077.677] GetStockObject (i=5) returned 0x1900015
[0077.677] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8
[0077.677] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0xd, wParam=0x9, lParam=0x1b5a4630) returned 0x8
[0077.678] SendMessageW (hWnd=0x201ce, Msg=0x202b, wParam=0x201ce, lParam=0x2e9b90) returned 0x0
[0077.678] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x202b, wParam=0x201ce, lParam=0x2e9b90) returned 0x0
[0077.679] InvalidateRect (hWnd=0x201ce, lpRect=0x0, bErase=0) returned 1
[0077.679] GetFocus () returned 0x201ce
[0077.711] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.711] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0077.711] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0077.712] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0077.712] IsWindowUnicode (hWnd=0x201d6) returned 1
[0077.712] GetMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.749] TranslateMessage (lpMsg=0x2ea8f0) returned 0
[0077.749] DispatchMessageW (lpMsg=0x2ea8f0) returned 0x0
[0077.750] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.750] GetMessageA (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.750] TranslateMessage (lpMsg=0x2ea8f0) returned 0
[0077.751] DispatchMessageA (lpMsg=0x2ea8f0) returned 0x0
[0077.751] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.751] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x84, wParam=0x0, lParam=0x1e40318) returned 0x1
[0077.751] IsWindowUnicode (hWnd=0x201c8) returned 1
[0077.751] GetMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.751] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x84, wParam=0x0, lParam=0x1e40318) returned 0x1
[0077.751] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003
[0077.771] SetCursor (hCursor=0x10003) returned 0x10007
[0077.771] TranslateMessage (lpMsg=0x2ea8f0) returned 0
[0077.771] DispatchMessageW (lpMsg=0x2ea8f0) returned 0x0
[0077.773] _TrackMouseEvent (in: lpEventTrack=0x2878b30 | out: lpEventTrack=0x2878b30) returned 1
[0077.773] SendMessageW (hWnd=0x201c8, Msg=0xc137, wParam=0x0, lParam=0x0) returned 0x0
[0077.773] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0xc137, wParam=0x0, lParam=0x0) returned 0x0
[0077.773] InvalidateRect (hWnd=0x201c8, lpRect=0x0, bErase=0) returned 1
[0077.774] GetKeyState (nVirtKey=1) returned 0
[0077.774] GetKeyState (nVirtKey=2) returned 0
[0077.774] GetKeyState (nVirtKey=4) returned 0
[0077.774] GetKeyState (nVirtKey=5) returned 0
[0077.774] GetKeyState (nVirtKey=6) returned 0
[0077.774] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.774] IsWindowUnicode (hWnd=0x201d6) returned 1
[0077.774] GetMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.774] TranslateMessage (lpMsg=0x2ea8f0) returned 0
[0077.774] DispatchMessageW (lpMsg=0x2ea8f0) returned 0x0
[0077.774] BeginPaint (in: hWnd=0x201d6, lpPaint=0x2e9cc8 | out: lpPaint=0x2e9cc8) returned 0x201082d
[0077.775] SelectPalette (hdc=0x201082d, hPal=0x13080713, bForceBkgd=1) returned 0x188000b
[0077.775] GetWindowTextLengthW (hWnd=0x201d6) returned 24
[0077.775] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0077.775] GetSystemMetrics (nIndex=42) returned 0
[0077.775] CoTaskMemAlloc (cb=0x36) returned 0x1b579fa0
[0077.775] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b579fa0, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0077.775] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b579fa0) returned 0x18
[0077.775] CoTaskMemFree (pv=0x1b579fa0)
[0077.775] EndPaint (hWnd=0x201d6, lpPaint=0x2e9cd8) returned 1
[0077.775] SelectPalette (hdc=0x201082d, hPal=0x188000b, bForceBkgd=0) returned 0x0
[0077.775] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.775] IsWindowUnicode (hWnd=0x201cc) returned 1
[0077.775] GetMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.775] TranslateMessage (lpMsg=0x2ea8f0) returned 0
[0077.775] DispatchMessageW (lpMsg=0x2ea8f0) returned 0x0
[0077.776] BeginPaint (in: hWnd=0x201cc, lpPaint=0x2e9cc8 | out: lpPaint=0x2e9cc8) returned 0xb010833
[0077.776] SelectPalette (hdc=0xb010833, hPal=0x13080713, bForceBkgd=1) returned 0x188000b
[0077.777] CreateCompatibleDC (hdc=0xb010833) returned 0x14010812
[0077.777] GetObjectType (h=0xb010833) returned 0x3
[0077.777] CreateCompatibleBitmap (hdc=0xb010833, cx=1, cy=1) returned 0x2905081e
[0077.778] GetDIBits (in: hdc=0xb010833, hbm=0x2905081e, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x2e93e8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2e93e8) returned 1
[0077.778] GetDIBits (in: hdc=0xb010833, hbm=0x2905081e, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x2e93e8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2e93e8) returned 1
[0077.778] DeleteObject (ho=0x2905081e) returned 1
[0077.778] CreateDIBSection (in: hdc=0xb010833, lpbmi=0x2e95c0, usage=0x0, ppvBits=0x2e95b8, hSection=0x0, offset=0x0 | out: ppvBits=0x2e95b8) returned 0x66050816
[0077.778] SelectObject (hdc=0x14010812, h=0x66050816) returned 0x185000f
[0077.778] GdipCreateFromHDC (hdc=0x14010812, graphics=0x2e9ad0) returned 0x0
[0077.779] GdipTranslateWorldTransform (graphics=0x1b047cc0, dx=0x0, dy=0x7fef1bbba58, order=0x0) returned 0x0
[0077.781] GdipSetClipRectI (graphics=0x1b047cc0, x=0, y=0, width=64, height=64, combineMode=0x0) returned 0x0
[0077.781] GdipCreateMatrix (matrix=0x2e9c00) returned 0x0
[0077.781] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869df0) returned 0x0
[0077.781] GdipIsMatrixIdentity (matrix=0x1b869df0, result=0x2e9c60) returned 0x0
[0077.781] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fa0
[0077.781] GdipGetMatrixElements (matrix=0x1b869df0, matrixOut=0x1b579fa0) returned 0x0
[0077.781] LocalFree (hMem=0x1b579fa0) returned 0x0
[0077.781] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.781] GdipDeleteMatrix (matrix=0x1b869df0) returned 0x0
[0077.781] GdipCreateRegion (region=0x2e9c00) returned 0x0
[0077.781] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0
[0077.782] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e9c30) returned 0x0
[0077.782] GdipSaveGraphics (graphics=0x1b047cc0, state=0x2e9d00) returned 0x0
[0077.782] GetWindowTextLengthW (hWnd=0x201cc) returned 0
[0077.782] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0077.782] GetSystemMetrics (nIndex=42) returned 0
[0077.782] CoTaskMemAlloc (cb=0x6) returned 0x1b57ec50
[0077.782] GetWindowTextW (in: hWnd=0x201cc, lpString=0x1b57ec50, nMaxCount=1 | out: lpString="") returned 0
[0077.782] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0xd, wParam=0x1, lParam=0x1b57ec50) returned 0x0
[0077.782] CoTaskMemFree (pv=0x1b57ec50)
[0077.782] GetClientRect (in: hWnd=0x201cc, lpRect=0x2e9c60 | out: lpRect=0x2e9c60) returned 1
[0077.782] GdipCreateRegion (region=0x2e96f0) returned 0x0
[0077.782] GdipGetClip (graphics=0x1b047cc0, region=0x1b86adc0) returned 0x0
[0077.782] GdipCreateMatrix (matrix=0x2e96f0) returned 0x0
[0077.782] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869e30) returned 0x0
[0077.782] GdipIsMatrixIdentity (matrix=0x1b869e30, result=0x2e9750) returned 0x0
[0077.782] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fa0
[0077.782] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fa0) returned 0x0
[0077.782] LocalFree (hMem=0x1b579fa0) returned 0x0
[0077.783] GdipCombineRegionRegion (region=0x1b86adc0, region2=0x1afad4d0, combineMode=0x1) returned 0x0
[0077.783] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fa0
[0077.783] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fa0) returned 0x0
[0077.783] LocalFree (hMem=0x1b579fa0) returned 0x0
[0077.783] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.783] GdipDeleteMatrix (matrix=0x1b869e30) returned 0x0
[0077.783] GdipIsInfiniteRegion (region=0x1b86adc0, graphics=0x1b047cc0, result=0x2e97a0) returned 0x0
[0077.784] GdipIsInfiniteRegion (region=0x1b86adc0, graphics=0x1b047cc0, result=0x2e9760) returned 0x0
[0077.785] GdipGetRegionHRgn (region=0x1b86adc0, graphics=0x1b047cc0, hRgn=0x2e9760) returned 0x0
[0077.786] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.786] GdipDeleteRegion (region=0x1b86adc0) returned 0x0
[0077.786] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e97d0) returned 0x0
[0077.786] GetCurrentObject (hdc=0x14010812, type=0x1) returned 0x1b00017
[0077.786] GetCurrentObject (hdc=0x14010812, type=0x2) returned 0x1900010
[0077.786] GetCurrentObject (hdc=0x14010812, type=0x7) returned 0x66050816
[0077.786] GetCurrentObject (hdc=0x14010812, type=0x6) returned 0x18a002e
[0077.786] SaveDC (hdc=0x14010812) returned 1
[0077.787] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1c040836
[0077.788] GetClipRgn (hdc=0x14010812, hrgn=0x1c040836) returned 0
[0077.788] SelectClipRgn (hdc=0x14010812, hrgn=0x16040725) returned 2
[0077.789] DeleteObject (ho=0x1c040836) returned 1
[0077.789] DeleteObject (ho=0x16040725) returned 1
[0077.789] OffsetViewportOrgEx (in: hdc=0x14010812, x=0, y=0, lppt=0x287a528 | out: lppt=0x287a528) returned 1
[0077.789] GetNearestColor (hdc=0x14010812, color=0xf0f0f0) returned 0xf0f0f0
[0077.789] CreateSolidBrush (color=0xf0f0f0) returned 0x1c100720
[0077.789] FillRect (hDC=0x14010812, lprc=0x2e97a0, hbr=0x1c100720) returned 1
[0077.789] DeleteObject (ho=0x1c100720) returned 1
[0077.789] RestoreDC (hdc=0x14010812, nSavedDC=-1) returned 1
[0077.789] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.790] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x14010812) returned 0x0
[0077.790] GdipRestoreGraphics (graphics=0x1b047cc0, state=0xfffffffffdb10dbd) returned 0x0
[0077.795] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.795] GdipDeleteRegion (region=0x1afad4d0) returned 0x0
[0077.795] GetWindowTextLengthW (hWnd=0x201cc) returned 0
[0077.795] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0077.795] GetSystemMetrics (nIndex=42) returned 0
[0077.795] CoTaskMemAlloc (cb=0x6) returned 0x1b57ec50
[0077.795] GetWindowTextW (in: hWnd=0x201cc, lpString=0x1b57ec50, nMaxCount=1 | out: lpString="") returned 0
[0077.795] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0xd, wParam=0x1, lParam=0x1b57ec50) returned 0x0
[0077.795] CoTaskMemFree (pv=0x1b57ec50)
[0077.824] GdipGetImageWidth (image=0x1b863aa0, width=0x2e9a60) returned 0x0
[0077.824] GdipGetImageHeight (image=0x1b863aa0, height=0x2e9a60) returned 0x0
[0077.824] GdipGetImageWidth (image=0x1b863aa0, width=0x2e9a10) returned 0x0
[0077.824] GdipGetImageHeight (image=0x1b863aa0, height=0x2e9a10) returned 0x0
[0077.825] GdipDrawImageRectI (graphics=0x1b047cc0, image=0x1b863aa0, x=16, y=16, width=32, height=32) returned 0x0
[0077.826] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e9bd0) returned 0x0
[0077.827] BitBlt (hdc=0xb010833, x=0, y=0, cx=64, cy=64, hdcSrc=0x14010812, x1=0, y1=0, rop=0xcc0020) returned 1
[0077.827] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.827] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x14010812) returned 0x0
[0077.827] SelectObject (hdc=0x14010812, h=0x185000f) returned 0x66050816
[0077.828] DeleteDC (hdc=0x14010812) returned 1
[0077.828] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.828] GdipDeleteGraphics (graphics=0x1b047cc0) returned 0x0
[0077.828] SelectPalette (hdc=0xb010833, hPal=0x188000b, bForceBkgd=0) returned 0x13080713
[0077.828] EndPaint (hWnd=0x201cc, lpPaint=0x2e9cd8) returned 1
[0077.828] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.828] IsWindowUnicode (hWnd=0x201da) returned 1
[0077.828] GetMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.828] TranslateMessage (lpMsg=0x2ea8f0) returned 0
[0077.828] DispatchMessageW (lpMsg=0x2ea8f0) returned 0x0
[0077.828] BeginPaint (in: hWnd=0x201da, lpPaint=0x2e9c18 | out: lpPaint=0x2e9c18) returned 0x2010844
[0077.828] SelectPalette (hdc=0x2010844, hPal=0x13080713, bForceBkgd=1) returned 0x188000b
[0077.828] CreateCompatibleDC (hdc=0x2010844) returned 0x16010812
[0077.828] GetObjectType (h=0x2010844) returned 0x3
[0077.828] CreateCompatibleBitmap (hdc=0x2010844, cx=1, cy=1) returned 0x130507f8
[0077.828] GetDIBits (in: hdc=0x2010844, hbm=0x130507f8, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x2e92a8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2e92a8) returned 1
[0077.828] GetDIBits (in: hdc=0x2010844, hbm=0x130507f8, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x2e92a8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2e92a8) returned 1
[0077.828] DeleteObject (ho=0x130507f8) returned 1
[0077.829] CreateDIBSection (in: hdc=0x2010844, lpbmi=0x2e9480, usage=0x0, ppvBits=0x2e9478, hSection=0x0, offset=0x0 | out: ppvBits=0x2e9478) returned 0x59050854
[0077.829] SelectObject (hdc=0x16010812, h=0x59050854) returned 0x185000f
[0077.829] GdipCreateFromHDC (hdc=0x16010812, graphics=0x2e9990) returned 0x0
[0077.829] GdipTranslateWorldTransform (graphics=0x1b047cc0, dx=0x0, dy=0x7fef1bbba58, order=0x0) returned 0x0
[0077.829] GdipSetClipRectI (graphics=0x1b047cc0, x=0, y=0, width=354, height=81, combineMode=0x0) returned 0x0
[0077.829] GdipCreateMatrix (matrix=0x2e9b50) returned 0x0
[0077.829] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869df0) returned 0x0
[0077.829] GdipIsMatrixIdentity (matrix=0x1b869df0, result=0x2e9bb0) returned 0x0
[0077.829] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fa0
[0077.829] GdipGetMatrixElements (matrix=0x1b869df0, matrixOut=0x1b579fa0) returned 0x0
[0077.829] LocalFree (hMem=0x1b579fa0) returned 0x0
[0077.829] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.829] GdipDeleteMatrix (matrix=0x1b869df0) returned 0x0
[0077.829] GdipCreateRegion (region=0x2e9b50) returned 0x0
[0077.829] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0
[0077.829] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e9b80) returned 0x0
[0077.830] GdipSaveGraphics (graphics=0x1b047cc0, state=0x2e9c50) returned 0x0
[0077.830] GetWindowTextLengthW (hWnd=0x201da) returned 283
[0077.830] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11b
[0077.830] GetSystemMetrics (nIndex=42) returned 0
[0077.830] CoTaskMemAlloc (cb=0x23c) returned 0x1b5abbb0
[0077.830] GetWindowTextW (in: hWnd=0x201da, lpString=0x1b5abbb0, nMaxCount=284 | out: lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.") returned 283
[0077.830] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xd, wParam=0x11c, lParam=0x1b5abbb0) returned 0x11b
[0077.830] CoTaskMemFree (pv=0x1b5abbb0)
[0077.830] GetClientRect (in: hWnd=0x201da, lpRect=0x2e9bb0 | out: lpRect=0x2e9bb0) returned 1
[0077.830] GdipCreateRegion (region=0x2e9640) returned 0x0
[0077.830] GdipGetClip (graphics=0x1b047cc0, region=0x1b86adc0) returned 0x0
[0077.830] GdipCreateMatrix (matrix=0x2e9640) returned 0x0
[0077.830] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869e30) returned 0x0
[0077.830] GdipIsMatrixIdentity (matrix=0x1b869e30, result=0x2e96a0) returned 0x0
[0077.830] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fa0
[0077.830] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fa0) returned 0x0
[0077.830] LocalFree (hMem=0x1b579fa0) returned 0x0
[0077.830] GdipCombineRegionRegion (region=0x1b86adc0, region2=0x1afad4d0, combineMode=0x1) returned 0x0
[0077.831] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fa0
[0077.831] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fa0) returned 0x0
[0077.831] LocalFree (hMem=0x1b579fa0) returned 0x0
[0077.831] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.831] GdipDeleteMatrix (matrix=0x1b869e30) returned 0x0
[0077.831] GdipIsInfiniteRegion (region=0x1b86adc0, graphics=0x1b047cc0, result=0x2e96f0) returned 0x0
[0077.831] GdipIsInfiniteRegion (region=0x1b86adc0, graphics=0x1b047cc0, result=0x2e96b0) returned 0x0
[0077.831] GdipGetRegionHRgn (region=0x1b86adc0, graphics=0x1b047cc0, hRgn=0x2e96b0) returned 0x0
[0077.831] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.831] GdipDeleteRegion (region=0x1b86adc0) returned 0x0
[0077.831] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e9720) returned 0x0
[0077.831] GetCurrentObject (hdc=0x16010812, type=0x1) returned 0x1b00017
[0077.831] GetCurrentObject (hdc=0x16010812, type=0x2) returned 0x1900010
[0077.831] GetCurrentObject (hdc=0x16010812, type=0x7) returned 0x59050854
[0077.831] GetCurrentObject (hdc=0x16010812, type=0x6) returned 0x18a002e
[0077.831] SaveDC (hdc=0x16010812) returned 1
[0077.831] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x17040725
[0077.831] GetClipRgn (hdc=0x16010812, hrgn=0x17040725) returned 0
[0077.831] SelectClipRgn (hdc=0x16010812, hrgn=0x1d040836) returned 2
[0077.831] DeleteObject (ho=0x17040725) returned 1
[0077.831] DeleteObject (ho=0x1d040836) returned 1
[0077.831] OffsetViewportOrgEx (in: hdc=0x16010812, x=0, y=0, lppt=0x287beb0 | out: lppt=0x287beb0) returned 1
[0077.832] GetNearestColor (hdc=0x16010812, color=0xf0f0f0) returned 0xf0f0f0
[0077.832] CreateSolidBrush (color=0xf0f0f0) returned 0x1d100720
[0077.832] FillRect (hDC=0x16010812, lprc=0x2e96f0, hbr=0x1d100720) returned 1
[0077.832] DeleteObject (ho=0x1d100720) returned 1
[0077.832] RestoreDC (hdc=0x16010812, nSavedDC=-1) returned 1
[0077.832] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.832] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x16010812) returned 0x0
[0077.832] GdipRestoreGraphics (graphics=0x1b047cc0, state=0xfffffffffdaf0dbd) returned 0x0
[0077.832] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.832] GdipDeleteRegion (region=0x1afad4d0) returned 0x0
[0077.832] GetWindowTextLengthW (hWnd=0x201da) returned 283
[0077.832] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11b
[0077.832] GetSystemMetrics (nIndex=42) returned 0
[0077.833] CoTaskMemAlloc (cb=0x23c) returned 0x1b5abbb0
[0077.833] GetWindowTextW (in: hWnd=0x201da, lpString=0x1b5abbb0, nMaxCount=284 | out: lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.") returned 283
[0077.833] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xd, wParam=0x11c, lParam=0x1b5abbb0) returned 0x11b
[0077.833] CoTaskMemFree (pv=0x1b5abbb0)
[0077.834] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e9770) returned 0x0
[0077.834] GetCurrentObject (hdc=0x16010812, type=0x1) returned 0x1b00017
[0077.834] GetCurrentObject (hdc=0x16010812, type=0x2) returned 0x1900010
[0077.834] GetCurrentObject (hdc=0x16010812, type=0x7) returned 0x59050854
[0077.834] GetCurrentObject (hdc=0x16010812, type=0x6) returned 0x18a002e
[0077.834] SaveDC (hdc=0x16010812) returned 1
[0077.834] GetNearestColor (hdc=0x16010812, color=0x0) returned 0x0
[0077.834] RestoreDC (hdc=0x16010812, nSavedDC=-1) returned 1
[0077.834] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.834] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x16010812) returned 0x0
[0077.851] AdjustWindowRectEx (in: lpRect=0x2e9630, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2e9630) returned 1
[0077.853] CoTaskMemAlloc (cb=0x44) returned 0x1b5ac110
[0077.853] GdipGetFamilyName (in: family=0x12fc5e0, name=0x1b5ac110, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0
[0077.853] CoTaskMemFree (pv=0x1b5ac110)
[0077.854] CreateCompatibleDC (hdc=0x0) returned 0x1a01081f
[0077.854] GetCurrentObject (hdc=0x1a01081f, type=0x1) returned 0x1b00017
[0077.854] GetCurrentObject (hdc=0x1a01081f, type=0x2) returned 0x1900010
[0077.854] GetCurrentObject (hdc=0x1a01081f, type=0x7) returned 0x185000f
[0077.854] GetCurrentObject (hdc=0x1a01081f, type=0x6) returned 0x18a002e
[0077.854] SaveDC (hdc=0x1a01081f) returned 1
[0077.855] GetDeviceCaps (hdc=0x1a01081f, index=90) returned 96
[0077.856] CreateFontIndirectW (lplf=0x1b7a30) returned 0xa0a0281
[0077.856] GetObjectW (in: h=0xa0a0281, c=92, pv=0x2e93d0 | out: pv=0x2e93d0) returned 92
[0077.876] GetCurrentObject (hdc=0x1a01081f, type=0x6) returned 0x18a002e
[0077.876] GetObjectW (in: h=0x18a002e, c=92, pv=0x2e9200 | out: pv=0x2e9200) returned 92
[0077.878] SelectObject (hdc=0x1a01081f, h=0xa0a0281) returned 0x18a002e
[0077.879] GetMapMode (hdc=0x1a01081f) returned 1
[0077.880] GetTextMetricsW (in: hdc=0x1a01081f, lptm=0x2e9230 | out: lptm=0x2e9230) returned 1
[0077.880] DrawTextExW (in: hdc=0x1a01081f, lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.", cchText=283, lprc=0x2e9500, format=0x102400, lpdtp=0x287cb60 | out: lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.", lprc=0x2e9500) returned 39
[0077.881] GdipGetTextRenderingHint (graphics=0x1b047cc0, mode=0x2e9650) returned 0x0
[0077.881] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e9630) returned 0x0
[0077.882] GetCurrentObject (hdc=0x16010812, type=0x1) returned 0x1b00017
[0077.882] GetCurrentObject (hdc=0x16010812, type=0x2) returned 0x1900010
[0077.882] GetCurrentObject (hdc=0x16010812, type=0x7) returned 0x59050854
[0077.882] GetCurrentObject (hdc=0x16010812, type=0x6) returned 0x18a002e
[0077.882] SaveDC (hdc=0x16010812) returned 1
[0077.882] GetTextAlign (hdc=0x16010812) returned 0x0
[0077.883] GetTextColor (hdc=0x16010812) returned 0x0
[0077.883] GetCurrentObject (hdc=0x16010812, type=0x6) returned 0x18a002e
[0077.883] GetObjectW (in: h=0x18a002e, c=92, pv=0x2e90a0 | out: pv=0x2e90a0) returned 92
[0077.883] SelectObject (hdc=0x16010812, h=0xa0a0281) returned 0x18a002e
[0077.883] GetBkMode (hdc=0x16010812) returned 2
[0077.883] SetBkMode (hdc=0x16010812, mode=1) returned 2
[0077.883] DrawTextExW (in: hdc=0x16010812, lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.", cchText=283, lprc=0x2e91e0, format=0x102010, lpdtp=0x287cea8 | out: lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.", lprc=0x2e91e0) returned 78
[0077.887] RestoreDC (hdc=0x16010812, nSavedDC=-1) returned 1
[0077.887] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.887] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x16010812) returned 0x0
[0077.887] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e9b20) returned 0x0
[0077.887] BitBlt (hdc=0x2010844, x=0, y=0, cx=354, cy=81, hdcSrc=0x16010812, x1=0, y1=0, rop=0xcc0020) returned 1
[0077.887] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.888] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x16010812) returned 0x0
[0077.888] SelectObject (hdc=0x16010812, h=0x185000f) returned 0x59050854
[0077.888] DeleteDC (hdc=0x16010812) returned 1
[0077.888] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.888] GdipDeleteGraphics (graphics=0x1b047cc0) returned 0x0
[0077.888] DeleteObject (ho=0x59050854) returned 1
[0077.888] SelectPalette (hdc=0x2010844, hPal=0x188000b, bForceBkgd=0) returned 0x13080713
[0077.888] EndPaint (hWnd=0x201da, lpPaint=0x2e9c28) returned 1
[0077.888] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.889] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1
[0077.889] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0077.890] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0077.890] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0077.891] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x46, wParam=0x0, lParam=0x2ea710) returned 0x0
[0077.891] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x84, wParam=0x0, lParam=0x1e40318) returned 0x1
[0077.891] IsWindowUnicode (hWnd=0x201c8) returned 1
[0077.891] GetMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.891] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x84, wParam=0x0, lParam=0x1e40318) returned 0x1
[0077.891] GetDlgItem (hDlg=0x201d6, nIDDlgItem=0) returned 0x0
[0077.891] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x210, wParam=0x201, lParam=0x700123) returned 0x0
[0077.892] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x21, wParam=0x201d6, lParam=0x2010001) returned 0x1
[0077.892] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x21, wParam=0x201d6, lParam=0x2010001) returned 0x1
[0077.892] SetCursor (hCursor=0x10003) returned 0x10003
[0077.892] TranslateMessage (lpMsg=0x2ea8f0) returned 0
[0077.892] DispatchMessageW (lpMsg=0x2ea8f0) returned 0x0
[0077.893] GetKeyState (nVirtKey=1) returned -127
[0077.893] GetKeyState (nVirtKey=2) returned 0
[0077.893] GetKeyState (nVirtKey=4) returned 0
[0077.893] GetKeyState (nVirtKey=5) returned 0
[0077.893] GetKeyState (nVirtKey=6) returned 0
[0077.894] IsWindowVisible (hWnd=0x201c8) returned 1
[0077.894] IsWindowEnabled (hWnd=0x201c8) returned 1
[0077.894] SetFocus (hWnd=0x201c8) returned 0x201ce
[0077.894] GetFocus () returned 0x201c8
[0077.894] IsChild (hWndParent=0x201d6, hWnd=0x201c8) returned 1
[0077.894] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x8, wParam=0x201c8, lParam=0x0) returned 0x0
[0077.896] GetCapture () returned 0x0
[0077.896] InvalidateRect (hWnd=0x201ce, lpRect=0x0, bErase=0) returned 1
[0077.896] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
[0077.896] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
[0077.896] GetKeyboardLayout (idThread=0x0) returned 0x4090409
[0077.899] InvalidateRect (hWnd=0x201ce, lpRect=0x0, bErase=0) returned 1
[0077.899] InvalidateRect (hWnd=0x201c8, lpRect=0x0, bErase=0) returned 1
[0077.899] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x7, wParam=0x201ce, lParam=0x0) returned 0x0
[0077.899] GetStockObject (i=5) returned 0x1900015
[0077.899] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x9
[0077.899] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0xd, wParam=0xa, lParam=0x1b5a4750) returned 0x9
[0077.900] SendMessageW (hWnd=0x201c8, Msg=0x202b, wParam=0x201c8, lParam=0x2e9420) returned 0x0
[0077.900] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x202b, wParam=0x201c8, lParam=0x2e9420) returned 0x0
[0077.900] InvalidateRect (hWnd=0x201c8, lpRect=0x0, bErase=0) returned 1
[0077.900] GetFocus () returned 0x201c8
[0077.900] GetFocus () returned 0x201c8
[0077.900] GetFocus () returned 0x201c8
[0077.900] GetKeyState (nVirtKey=1) returned -127
[0077.900] GetKeyState (nVirtKey=2) returned 0
[0077.900] GetKeyState (nVirtKey=4) returned 0
[0077.900] GetKeyState (nVirtKey=5) returned 0
[0077.900] GetKeyState (nVirtKey=6) returned 0
[0077.900] GetCapture () returned 0x0
[0077.901] SetCapture (hWnd=0x201c8) returned 0x0
[0077.901] GetKeyState (nVirtKey=1) returned -127
[0077.901] GetKeyState (nVirtKey=2) returned 0
[0077.901] GetKeyState (nVirtKey=4) returned 0
[0077.901] GetKeyState (nVirtKey=5) returned 0
[0077.901] GetKeyState (nVirtKey=6) returned 0
[0077.901] NotifyWinEvent (event=0x800a, hwnd=0x201c8, idObject=-4, idChild=0)
[0077.901] InvalidateRect (hWnd=0x201c8, lpRect=0x2e9f70, bErase=0) returned 1
[0077.901] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.901] GetMessageA (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.901] TranslateMessage (lpMsg=0x2ea8f0) returned 0
[0077.901] DispatchMessageA (lpMsg=0x2ea8f0) returned 0x0
[0077.901] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.901] IsWindowUnicode (hWnd=0x201c8) returned 1
[0077.901] GetMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.902] TranslateMessage (lpMsg=0x2ea8f0) returned 0
[0077.902] DispatchMessageW (lpMsg=0x2ea8f0) returned 0x1
[0077.902] MapWindowPoints (in: hWndFrom=0x201c8, hWndTo=0x0, lpPoints=0x287d0a0, cPoints=0x1 | out: lpPoints=0x287d0a0) returned 31392470
[0077.903] NotifyWinEvent (event=0x800a, hwnd=0x201c8, idObject=-4, idChild=0)
[0077.903] InvalidateRect (hWnd=0x201c8, lpRect=0x2e9ec0, bErase=0) returned 1
[0077.903] UpdateWindow (hWnd=0x201c8) returned 1
[0077.903] BeginPaint (in: hWnd=0x201c8, lpPaint=0x2e93d8 | out: lpPaint=0x2e93d8) returned 0x201082d
[0077.903] SelectPalette (hdc=0x201082d, hPal=0x13080713, bForceBkgd=1) returned 0x188000b
[0077.903] CreateCompatibleDC (hdc=0x201082d) returned 0x190107f8
[0077.903] DeleteObject (ho=0x66050816) returned 1
[0077.903] GetObjectType (h=0x201082d) returned 0x3
[0077.903] CreateCompatibleBitmap (hdc=0x201082d, cx=1, cy=1) returned 0x2b05081e
[0077.903] GetDIBits (in: hdc=0x201082d, hbm=0x2b05081e, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x2e8af8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2e8af8) returned 1
[0077.903] GetDIBits (in: hdc=0x201082d, hbm=0x2b05081e, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x2e8af8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2e8af8) returned 1
[0077.903] DeleteObject (ho=0x2b05081e) returned 1
[0077.903] CreateDIBSection (in: hdc=0x201082d, lpbmi=0x2e8cd0, usage=0x0, ppvBits=0x2e8cc8, hSection=0x0, offset=0x0 | out: ppvBits=0x2e8cc8) returned 0x67050816
[0077.903] SelectObject (hdc=0x190107f8, h=0x67050816) returned 0x185000f
[0077.903] GdipCreateFromHDC (hdc=0x190107f8, graphics=0x2e91e0) returned 0x0
[0077.904] GdipTranslateWorldTransform (graphics=0x1b047cc0, dx=0x0, dy=0x7fef1bbba58, order=0x0) returned 0x0
[0077.904] GdipSetClipRectI (graphics=0x1b047cc0, x=0, y=0, width=100, height=23, combineMode=0x0) returned 0x0
[0077.904] GdipCreateMatrix (matrix=0x2e9310) returned 0x0
[0077.904] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869df0) returned 0x0
[0077.904] GdipIsMatrixIdentity (matrix=0x1b869df0, result=0x2e9370) returned 0x0
[0077.904] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fa0
[0077.904] GdipGetMatrixElements (matrix=0x1b869df0, matrixOut=0x1b579fa0) returned 0x0
[0077.904] LocalFree (hMem=0x1b579fa0) returned 0x0
[0077.904] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.904] GdipDeleteMatrix (matrix=0x1b869df0) returned 0x0
[0077.904] GdipCreateRegion (region=0x2e9310) returned 0x0
[0077.904] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0
[0077.904] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e9340) returned 0x0
[0077.904] GdipSaveGraphics (graphics=0x1b047cc0, state=0x2e9410) returned 0x0
[0077.904] GdipRestoreGraphics (graphics=0x1b047cc0, state=0xfffffffffdad0dbd) returned 0x0
[0077.904] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.904] GdipDeleteRegion (region=0x1afad4d0) returned 0x0
[0077.918] SystemParametersInfoW (in: uiAction=0x42, uiParam=0x10, pvParam=0x2e8f90, fWinIni=0x0 | out: pvParam=0x2e8f90) returned 1
[0077.918] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e87f0) returned 0x0
[0077.918] GetCurrentObject (hdc=0x190107f8, type=0x1) returned 0x1b00017
[0077.918] GetCurrentObject (hdc=0x190107f8, type=0x2) returned 0x1900010
[0077.918] GetCurrentObject (hdc=0x190107f8, type=0x7) returned 0x67050816
[0077.919] GetCurrentObject (hdc=0x190107f8, type=0x6) returned 0x18a002e
[0077.919] SaveDC (hdc=0x190107f8) returned 1
[0077.919] GetNearestColor (hdc=0x190107f8, color=0xf0f0f0) returned 0xf0f0f0
[0077.919] GetNearestColor (hdc=0x190107f8, color=0xa0a0a0) returned 0xa0a0a0
[0077.919] GetNearestColor (hdc=0x190107f8, color=0x696969) returned 0x696969
[0077.919] GetNearestColor (hdc=0x190107f8, color=0xa0a0a0) returned 0xa0a0a0
[0077.919] GetNearestColor (hdc=0x190107f8, color=0x0) returned 0x0
[0077.919] GetNearestColor (hdc=0x190107f8, color=0xffffff) returned 0xffffff
[0077.919] GetNearestColor (hdc=0x190107f8, color=0xe5e5e5) returned 0xe5e5e5
[0077.919] GetNearestColor (hdc=0x190107f8, color=0xd8d8d8) returned 0xd8d8d8
[0077.919] GetNearestColor (hdc=0x190107f8, color=0x0) returned 0x0
[0077.919] RestoreDC (hdc=0x190107f8, nSavedDC=-1) returned 1
[0077.919] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.919] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x190107f8) returned 0x0
[0077.928] IsAppThemed () returned 0x1
[0077.928] GetThemeAppProperties () returned 0x3
[0077.928] GetThemeAppProperties () returned 0x3
[0077.929] OpenThemeData () returned 0x10003
[0077.938] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x2e8ef0, fWinIni=0x0 | out: pvParam=0x2e8ef0) returned 1
[0077.938] SendMessageW (hWnd=0x201d6, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0
[0077.938] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0
[0077.938] IsAppThemed () returned 0x1
[0077.938] GetThemeAppProperties () returned 0x3
[0077.938] GetThemeAppProperties () returned 0x3
[0077.941] DrawTextExW (in: hdc=0x1a01081f, lpchText="&Continue", cchText=9, lprc=0x2e8a30, format=0x102415, lpdtp=0x287efe0 | out: lpchText="&Continue", lprc=0x2e8a30) returned 13
[0077.941] IsAppThemed () returned 0x1
[0077.941] GetThemeAppProperties () returned 0x3
[0077.941] GetThemeAppProperties () returned 0x3
[0077.941] IsAppThemed () returned 0x1
[0077.941] GetThemeAppProperties () returned 0x3
[0077.941] GetThemeAppProperties () returned 0x3
[0077.943] IsAppThemed () returned 0x1
[0077.943] GetThemeAppProperties () returned 0x3
[0077.943] GetThemeAppProperties () returned 0x3
[0077.943] IsAppThemed () returned 0x1
[0077.943] GetThemeAppProperties () returned 0x3
[0077.943] GetThemeAppProperties () returned 0x3
[0077.944] IsThemePartDefined () returned 0x1
[0077.944] IsAppThemed () returned 0x1
[0077.944] GetThemeAppProperties () returned 0x3
[0077.944] GetThemeAppProperties () returned 0x3
[0077.944] IsThemeBackgroundPartiallyTransparent () returned 0x1
[0077.944] IsAppThemed () returned 0x1
[0077.944] GetThemeAppProperties () returned 0x3
[0077.944] GetThemeAppProperties () returned 0x3
[0077.944] IsAppThemed () returned 0x1
[0077.944] GetThemeAppProperties () returned 0x3
[0077.944] GetThemeAppProperties () returned 0x3
[0077.944] IsThemePartDefined () returned 0x1
[0077.944] GdipCreateRegion (region=0x2e8b10) returned 0x0
[0077.944] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0
[0077.944] GdipCreateMatrix (matrix=0x2e8b10) returned 0x0
[0077.944] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869e30) returned 0x0
[0077.944] GdipIsMatrixIdentity (matrix=0x1b869e30, result=0x2e8b70) returned 0x0
[0077.944] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0
[0077.944] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fe0) returned 0x0
[0077.945] LocalFree (hMem=0x1b579fe0) returned 0x0
[0077.945] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0
[0077.945] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fe0) returned 0x0
[0077.945] LocalFree (hMem=0x1b579fe0) returned 0x0
[0077.945] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.945] GdipDeleteMatrix (matrix=0x1b869e30) returned 0x0
[0077.945] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e8bc0) returned 0x0
[0077.945] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e8b80) returned 0x0
[0077.945] GdipGetRegionHRgn (region=0x1afad4d0, graphics=0x1b047cc0, hRgn=0x2e8b80) returned 0x0
[0077.945] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.945] GdipDeleteRegion (region=0x1afad4d0) returned 0x0
[0077.945] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e8bf0) returned 0x0
[0077.945] GetCurrentObject (hdc=0x190107f8, type=0x1) returned 0x1b00017
[0077.945] GetCurrentObject (hdc=0x190107f8, type=0x2) returned 0x1900010
[0077.945] GetCurrentObject (hdc=0x190107f8, type=0x7) returned 0x67050816
[0077.945] GetCurrentObject (hdc=0x190107f8, type=0x6) returned 0x18a002e
[0077.945] SaveDC (hdc=0x190107f8) returned 1
[0077.945] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1e040836
[0077.945] GetClipRgn (hdc=0x190107f8, hrgn=0x1e040836) returned 0
[0077.945] SelectClipRgn (hdc=0x190107f8, hrgn=0x1d040725) returned 2
[0077.945] DeleteObject (ho=0x1e040836) returned 1
[0077.945] DeleteObject (ho=0x1d040725) returned 1
[0077.945] OffsetViewportOrgEx (in: hdc=0x190107f8, x=0, y=0, lppt=0x287fa38 | out: lppt=0x287fa38) returned 1
[0077.946] DrawThemeParentBackground () returned 0x0
[0077.946] GetWindowPlacement (in: hWnd=0x201d6, lpwndpl=0x2e8680 | out: lpwndpl=0x2e8680) returned 1
[0077.946] GetClientRect (in: hWnd=0x201d6, lpRect=0x2e8530 | out: lpRect=0x2e8530) returned 1
[0077.946] GetWindowTextLengthW (hWnd=0x201d6) returned 24
[0077.946] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0077.946] GetSystemMetrics (nIndex=42) returned 0
[0077.946] CoTaskMemAlloc (cb=0x36) returned 0x1b579fe0
[0077.946] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b579fe0, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0077.946] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b579fe0) returned 0x18
[0077.946] CoTaskMemFree (pv=0x1b579fe0)
[0077.946] GetClientRect (in: hWnd=0x201d6, lpRect=0x2e82d0 | out: lpRect=0x2e82d0) returned 1
[0077.946] SelectPalette (hdc=0x190107f8, hPal=0x13080713, bForceBkgd=1) returned 0x188000b
[0077.946] GdipCreateFromHDC (hdc=0x190107f8, graphics=0x2e7ea0) returned 0x0
[0077.946] GdipSetPageUnit (graphics=0x1b048180, unit=0x2) returned 0x0
[0077.946] GdipCreateMatrix (matrix=0x2e7d90) returned 0x0
[0077.946] GdipGetWorldTransform (graphics=0x1b048180, matrix=0x1b869df0) returned 0x0
[0077.947] GdipIsMatrixIdentity (matrix=0x1b869df0, result=0x2e7df0) returned 0x0
[0077.947] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.947] GdipDeleteMatrix (matrix=0x1b869df0) returned 0x0
[0077.947] GdipCreateRegion (region=0x2e7d90) returned 0x0
[0077.947] GdipGetClip (graphics=0x1b048180, region=0x1afad4d0) returned 0x0
[0077.947] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b048180, result=0x2e7dc0) returned 0x0
[0077.947] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.947] GdipDeleteRegion (region=0x1afad4d0) returned 0x0
[0077.947] GdipSaveGraphics (graphics=0x1b048180, state=0x2e7e90) returned 0x0
[0077.947] GdipCreateRegion (region=0x2e7d60) returned 0x0
[0077.947] GdipGetClip (graphics=0x1b048180, region=0x1afad4d0) returned 0x0
[0077.947] GdipCreateMatrix (matrix=0x2e7d60) returned 0x0
[0077.947] GdipGetWorldTransform (graphics=0x1b048180, matrix=0x1b869e30) returned 0x0
[0077.947] GdipIsMatrixIdentity (matrix=0x1b869e30, result=0x2e7dc0) returned 0x0
[0077.947] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0
[0077.947] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fe0) returned 0x0
[0077.947] LocalFree (hMem=0x1b579fe0) returned 0x0
[0077.947] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.947] GdipDeleteMatrix (matrix=0x1b869e30) returned 0x0
[0077.947] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b048180, result=0x2e7e10) returned 0x0
[0077.947] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.947] GdipDeleteRegion (region=0x1afad4d0) returned 0x0
[0077.947] GdipGetDC (graphics=0x1b048180, hdc=0x2e7e40) returned 0x0
[0077.947] GetCurrentObject (hdc=0x190107f8, type=0x1) returned 0x1b00017
[0077.948] GetCurrentObject (hdc=0x190107f8, type=0x2) returned 0x1900010
[0077.948] GetCurrentObject (hdc=0x190107f8, type=0x7) returned 0x67050816
[0077.948] GetCurrentObject (hdc=0x190107f8, type=0x6) returned 0x18a002e
[0077.948] SaveDC (hdc=0x190107f8) returned 2
[0077.948] OffsetViewportOrgEx (in: hdc=0x190107f8, x=0, y=0, lppt=0x287fea0 | out: lppt=0x287fea0) returned 1
[0077.948] GetNearestColor (hdc=0x190107f8, color=0xf0f0f0) returned 0xf0f0f0
[0077.948] CreateSolidBrush (color=0xf0f0f0) returned 0x1e100720
[0077.948] FillRect (hDC=0x190107f8, lprc=0x2e7e10, hbr=0x1e100720) returned 1
[0077.948] DeleteObject (ho=0x1e100720) returned 1
[0077.948] RestoreDC (hdc=0x190107f8, nSavedDC=-1) returned 1
[0077.948] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.948] GdipReleaseDC (graphics=0x1b048180, hdc=0x190107f8) returned 0x0
[0077.948] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.948] GdipDeleteGraphics (graphics=0x1b048180) returned 0x0
[0077.948] SelectPalette (hdc=0x190107f8, hPal=0x188000b, bForceBkgd=0) returned 0x13080713
[0077.949] GetWindowTextLengthW (hWnd=0x201d6) returned 24
[0077.949] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0077.949] GetSystemMetrics (nIndex=42) returned 0
[0077.949] CoTaskMemAlloc (cb=0x36) returned 0x1b579fe0
[0077.949] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b579fe0, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0077.949] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b579fe0) returned 0x18
[0077.949] CoTaskMemFree (pv=0x1b579fe0)
[0077.949] GetClientRect (in: hWnd=0x201d6, lpRect=0x2e81a0 | out: lpRect=0x2e81a0) returned 1
[0077.949] SelectPalette (hdc=0x190107f8, hPal=0x13080713, bForceBkgd=1) returned 0x188000b
[0077.949] GdipCreateFromHDC (hdc=0x190107f8, graphics=0x2e7d70) returned 0x0
[0077.949] GdipSetPageUnit (graphics=0x1b048180, unit=0x2) returned 0x0
[0077.949] GdipCreateMatrix (matrix=0x2e7c60) returned 0x0
[0077.949] GdipGetWorldTransform (graphics=0x1b048180, matrix=0x1b869df0) returned 0x0
[0077.949] GdipIsMatrixIdentity (matrix=0x1b869df0, result=0x2e7cc0) returned 0x0
[0077.949] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.949] GdipDeleteMatrix (matrix=0x1b869df0) returned 0x0
[0077.950] GdipCreateRegion (region=0x2e7c60) returned 0x0
[0077.950] GdipGetClip (graphics=0x1b048180, region=0x1afad4d0) returned 0x0
[0077.950] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b048180, result=0x2e7c90) returned 0x0
[0077.950] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.950] GdipDeleteRegion (region=0x1afad4d0) returned 0x0
[0077.950] GdipSaveGraphics (graphics=0x1b048180, state=0x2e7d60) returned 0x0
[0077.950] GdipCreateRegion (region=0x2e7c30) returned 0x0
[0077.950] GdipGetClip (graphics=0x1b048180, region=0x1afad4d0) returned 0x0
[0077.950] GdipCreateMatrix (matrix=0x2e7c30) returned 0x0
[0077.950] GdipGetWorldTransform (graphics=0x1b048180, matrix=0x1b869e30) returned 0x0
[0077.950] GdipIsMatrixIdentity (matrix=0x1b869e30, result=0x2e7c90) returned 0x0
[0077.950] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0
[0077.950] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fe0) returned 0x0
[0077.950] LocalFree (hMem=0x1b579fe0) returned 0x0
[0077.950] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.950] GdipDeleteMatrix (matrix=0x1b869e30) returned 0x0
[0077.950] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b048180, result=0x2e7ce0) returned 0x0
[0077.950] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.950] GdipDeleteRegion (region=0x1afad4d0) returned 0x0
[0077.950] GdipGetDC (graphics=0x1b048180, hdc=0x2e7d10) returned 0x0
[0077.950] GetCurrentObject (hdc=0x190107f8, type=0x1) returned 0x1b00017
[0077.950] GetCurrentObject (hdc=0x190107f8, type=0x2) returned 0x1900010
[0077.950] GetCurrentObject (hdc=0x190107f8, type=0x7) returned 0x67050816
[0077.951] GetCurrentObject (hdc=0x190107f8, type=0x6) returned 0x18a002e
[0077.951] SaveDC (hdc=0x190107f8) returned 2
[0077.951] OffsetViewportOrgEx (in: hdc=0x190107f8, x=0, y=0, lppt=0x28803d0 | out: lppt=0x28803d0) returned 1
[0077.951] GetNearestColor (hdc=0x190107f8, color=0xf0f0f0) returned 0xf0f0f0
[0077.951] CreateSolidBrush (color=0xf0f0f0) returned 0x1f100720
[0077.951] FillRect (hDC=0x190107f8, lprc=0x2e7ce0, hbr=0x1f100720) returned 1
[0077.951] DeleteObject (ho=0x1f100720) returned 1
[0077.951] RestoreDC (hdc=0x190107f8, nSavedDC=-1) returned 1
[0077.951] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.951] GdipReleaseDC (graphics=0x1b048180, hdc=0x190107f8) returned 0x0
[0077.951] GdipRestoreGraphics (graphics=0x1b048180, state=0xfffffffffda90dbd) returned 0x0
[0077.951] GetWindowTextLengthW (hWnd=0x201d6) returned 24
[0077.951] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0077.951] GetSystemMetrics (nIndex=42) returned 0
[0077.951] CoTaskMemAlloc (cb=0x36) returned 0x1b579fe0
[0077.951] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b579fe0, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0077.951] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b579fe0) returned 0x18
[0077.951] CoTaskMemFree (pv=0x1b579fe0)
[0077.951] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.952] GdipDeleteGraphics (graphics=0x1b048180) returned 0x0
[0077.952] SelectPalette (hdc=0x190107f8, hPal=0x188000b, bForceBkgd=0) returned 0x13080713
[0077.952] RestoreDC (hdc=0x190107f8, nSavedDC=-1) returned 1
[0077.952] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.952] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x190107f8) returned 0x0
[0077.952] IsAppThemed () returned 0x1
[0077.952] GetThemeAppProperties () returned 0x3
[0077.952] GetThemeAppProperties () returned 0x3
[0077.952] IsAppThemed () returned 0x1
[0077.952] GetThemeAppProperties () returned 0x3
[0077.952] GetThemeAppProperties () returned 0x3
[0077.952] IsThemePartDefined () returned 0x1
[0077.952] GdipCreateRegion (region=0x2e89f0) returned 0x0
[0077.952] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0
[0077.952] GdipCreateMatrix (matrix=0x2e89f0) returned 0x0
[0077.952] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869df0) returned 0x0
[0077.952] GdipIsMatrixIdentity (matrix=0x1b869df0, result=0x2e8a50) returned 0x0
[0077.952] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0
[0077.952] GdipGetMatrixElements (matrix=0x1b869df0, matrixOut=0x1b579fe0) returned 0x0
[0077.952] LocalFree (hMem=0x1b579fe0) returned 0x0
[0077.952] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0
[0077.952] GdipGetMatrixElements (matrix=0x1b869df0, matrixOut=0x1b579fe0) returned 0x0
[0077.952] LocalFree (hMem=0x1b579fe0) returned 0x0
[0077.953] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.953] GdipDeleteMatrix (matrix=0x1b869df0) returned 0x0
[0077.953] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e8aa0) returned 0x0
[0077.953] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e8a60) returned 0x0
[0077.953] GdipGetRegionHRgn (region=0x1afad4d0, graphics=0x1b047cc0, hRgn=0x2e8a60) returned 0x0
[0077.953] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.953] GdipDeleteRegion (region=0x1afad4d0) returned 0x0
[0077.953] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e8ad0) returned 0x0
[0077.953] GetCurrentObject (hdc=0x190107f8, type=0x1) returned 0x1b00017
[0077.953] GetCurrentObject (hdc=0x190107f8, type=0x2) returned 0x1900010
[0077.953] GetCurrentObject (hdc=0x190107f8, type=0x7) returned 0x67050816
[0077.953] GetCurrentObject (hdc=0x190107f8, type=0x6) returned 0x18a002e
[0077.953] SaveDC (hdc=0x190107f8) returned 1
[0077.954] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1e040725
[0077.954] GetClipRgn (hdc=0x190107f8, hrgn=0x1e040725) returned 0
[0077.954] SelectClipRgn (hdc=0x190107f8, hrgn=0x20040836) returned 2
[0077.954] DeleteObject (ho=0x1e040725) returned 1
[0077.954] DeleteObject (ho=0x20040836) returned 1
[0077.954] OffsetViewportOrgEx (in: hdc=0x190107f8, x=0, y=0, lppt=0x2880aa0 | out: lppt=0x2880aa0) returned 1
[0077.954] IsAppThemed () returned 0x1
[0077.954] GetThemeAppProperties () returned 0x3
[0077.954] GetThemeAppProperties () returned 0x3
[0077.954] DrawThemeBackground () returned 0x0
[0077.954] RestoreDC (hdc=0x190107f8, nSavedDC=-1) returned 1
[0077.954] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.955] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x190107f8) returned 0x0
[0077.955] GdipCreateRegion (region=0x2e89c0) returned 0x0
[0077.955] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0
[0077.955] GdipCreateMatrix (matrix=0x2e89c0) returned 0x0
[0077.955] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869e30) returned 0x0
[0077.955] GdipIsMatrixIdentity (matrix=0x1b869e30, result=0x2e8a20) returned 0x0
[0077.955] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0
[0077.955] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fe0) returned 0x0
[0077.956] LocalFree (hMem=0x1b579fe0) returned 0x0
[0077.956] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0
[0077.956] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fe0) returned 0x0
[0077.956] LocalFree (hMem=0x1b579fe0) returned 0x0
[0077.956] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.956] GdipDeleteMatrix (matrix=0x1b869e30) returned 0x0
[0077.956] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e8a70) returned 0x0
[0077.956] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e8a30) returned 0x0
[0077.956] GdipGetRegionHRgn (region=0x1afad4d0, graphics=0x1b047cc0, hRgn=0x2e8a30) returned 0x0
[0077.956] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.956] GdipDeleteRegion (region=0x1afad4d0) returned 0x0
[0077.956] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e8aa0) returned 0x0
[0077.956] GetCurrentObject (hdc=0x190107f8, type=0x1) returned 0x1b00017
[0077.956] GetCurrentObject (hdc=0x190107f8, type=0x2) returned 0x1900010
[0077.956] GetCurrentObject (hdc=0x190107f8, type=0x7) returned 0x67050816
[0077.956] GetCurrentObject (hdc=0x190107f8, type=0x6) returned 0x18a002e
[0077.956] SaveDC (hdc=0x190107f8) returned 1
[0077.956] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x21040836
[0077.956] GetClipRgn (hdc=0x190107f8, hrgn=0x21040836) returned 0
[0077.956] SelectClipRgn (hdc=0x190107f8, hrgn=0x1f040725) returned 2
[0077.957] DeleteObject (ho=0x21040836) returned 1
[0077.957] DeleteObject (ho=0x1f040725) returned 1
[0077.957] OffsetViewportOrgEx (in: hdc=0x190107f8, x=0, y=0, lppt=0x2880fa0 | out: lppt=0x2880fa0) returned 1
[0077.957] IsAppThemed () returned 0x1
[0077.957] GetThemeAppProperties () returned 0x3
[0077.957] GetThemeAppProperties () returned 0x3
[0077.957] GetThemeBackgroundContentRect () returned 0x0
[0077.957] RestoreDC (hdc=0x190107f8, nSavedDC=-1) returned 1
[0077.957] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.957] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x190107f8) returned 0x0
[0077.957] IsAppThemed () returned 0x1
[0077.957] GetThemeAppProperties () returned 0x3
[0077.957] GetThemeAppProperties () returned 0x3
[0077.958] GdipGetTextRenderingHint (graphics=0x1b047cc0, mode=0x2e8b90) returned 0x0
[0077.958] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e8b70) returned 0x0
[0077.958] GetCurrentObject (hdc=0x190107f8, type=0x1) returned 0x1b00017
[0077.958] GetCurrentObject (hdc=0x190107f8, type=0x2) returned 0x1900010
[0077.958] GetCurrentObject (hdc=0x190107f8, type=0x7) returned 0x67050816
[0077.958] GetCurrentObject (hdc=0x190107f8, type=0x6) returned 0x18a002e
[0077.958] SaveDC (hdc=0x190107f8) returned 1
[0077.958] GetTextAlign (hdc=0x190107f8) returned 0x0
[0077.958] GetTextColor (hdc=0x190107f8) returned 0x0
[0077.958] GetCurrentObject (hdc=0x190107f8, type=0x6) returned 0x18a002e
[0077.958] GetObjectW (in: h=0x18a002e, c=92, pv=0x2e85e0 | out: pv=0x2e85e0) returned 92
[0077.958] SelectObject (hdc=0x190107f8, h=0xa0a0281) returned 0x18a002e
[0077.958] GetBkMode (hdc=0x190107f8) returned 2
[0077.958] SetBkMode (hdc=0x190107f8, mode=1) returned 2
[0077.958] DrawTextExW (in: hdc=0x190107f8, lpchText="&Continue", cchText=9, lprc=0x2e8670, format=0x102415, lpdtp=0x28814f8 | out: lpchText="&Continue", lprc=0x2e8670) returned 13
[0077.959] DrawTextExW (in: hdc=0x190107f8, lpchText="&Continue", cchText=9, lprc=0x2e8720, format=0x102015, lpdtp=0x28814f8 | out: lpchText="&Continue", lprc=0x2e8720) returned 13
[0077.959] RestoreDC (hdc=0x190107f8, nSavedDC=-1) returned 1
[0077.959] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.959] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x190107f8) returned 0x0
[0077.959] GetFocus () returned 0x201c8
[0077.959] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x2e8f00, fWinIni=0x0 | out: pvParam=0x2e8f00) returned 1
[0077.959] SendMessageW (hWnd=0x201d6, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0
[0077.959] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0
[0077.959] IsAppThemed () returned 0x1
[0077.959] GetThemeAppProperties () returned 0x3
[0077.959] GetThemeAppProperties () returned 0x3
[0077.959] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e92e0) returned 0x0
[0077.959] BitBlt (hdc=0x201082d, x=0, y=0, cx=100, cy=23, hdcSrc=0x190107f8, x1=0, y1=0, rop=0xcc0020) returned 1
[0077.959] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.959] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x190107f8) returned 0x0
[0077.959] SelectObject (hdc=0x190107f8, h=0x185000f) returned 0x67050816
[0077.959] DeleteDC (hdc=0x190107f8) returned 1
[0077.959] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0077.960] GdipDeleteGraphics (graphics=0x1b047cc0) returned 0x0
[0077.960] SelectPalette (hdc=0x201082d, hPal=0x188000b, bForceBkgd=0) returned 0x13080713
[0077.960] EndPaint (hWnd=0x201c8, lpPaint=0x2e93e8) returned 1
[0077.961] MapWindowPoints (in: hWndFrom=0x201c8, hWndTo=0x0, lpPoints=0x2881660, cPoints=0x1 | out: lpPoints=0x2881660) returned 31392470
[0077.962] WindowFromPoint (Point=0x1e400000318) returned 0x201c8
[0077.962] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x84, wParam=0x0, lParam=0x1e40318) returned 0x1
[0077.964] NotifyWinEvent (event=0x800a, hwnd=0x201c8, idObject=-4, idChild=0)
[0077.964] NotifyWinEvent (event=0x800c, hwnd=0x201c8, idObject=-4, idChild=0)
[0077.964] GetCapture () returned 0x201c8
[0077.965] ReleaseCapture () returned 1
[0077.966] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
[0077.966] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1
[0077.966] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x84, wParam=0x0, lParam=0x1e40318) returned 0x1
[0077.970] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-8) returned 0x0
[0077.970] IsWindow (hWnd=0x0) returned 0
[0077.970] IsWindow (hWnd=0x0) returned 0
[0077.970] IsWindow (hWnd=0x0) returned 0
[0077.971] GetFocus () returned 0x201c8
[0077.971] IsChild (hWndParent=0x201d6, hWnd=0x201c8) returned 1
[0077.971] ShowWindow (hWnd=0x201d6, nCmdShow=0) returned 1
[0077.971] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0
[0077.971] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x46, wParam=0x0, lParam=0x2eaa50) returned 0x0
[0077.972] GetWindowPlacement (in: hWnd=0x201d6, lpwndpl=0x2ea4b0 | out: lpwndpl=0x2ea4b0) returned 1
[0077.972] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x47, wParam=0x0, lParam=0x2eaa50) returned 0x0
[0077.972] GetClientRect (in: hWnd=0x201d6, lpRect=0x2ea250 | out: lpRect=0x2ea250) returned 1
[0077.972] GetWindowRect (in: hWnd=0x201d6, lpRect=0x2ea250 | out: lpRect=0x2ea250) returned 1
[0077.973] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0077.973] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0077.973] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0077.974] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
[0077.974] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0077.974] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0077.974] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0077.975] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x1c, wParam=0x0, lParam=0x80c) returned 0x0
[0077.975] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x1c, wParam=0x0, lParam=0x80c) returned 0x0
[0077.975] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x1c, wParam=0x0, lParam=0x80c) returned 0x0
[0077.975] GetFocus () returned 0x0
[0077.975] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0
[0077.975] GetCapture () returned 0x0
[0077.975] InvalidateRect (hWnd=0x201c8, lpRect=0x0, bErase=0) returned 1
[0077.975] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
[0077.975] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
[0077.977] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-20) returned 0x50109
[0077.977] DestroyWindow (hWnd=0x201d6) returned 1
[0077.977] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0
[0077.978] GetWindowTextLengthW (hWnd=0x201d6) returned 24
[0077.978] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0077.978] GetSystemMetrics (nIndex=42) returned 0
[0077.978] CoTaskMemAlloc (cb=0x36) returned 0x1b579fe0
[0077.978] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b579fe0, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0077.978] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b579fe0) returned 0x18
[0077.978] CoTaskMemFree (pv=0x1b579fe0)
[0077.978] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0077.979] GetWindowTextLengthW (hWnd=0x201cc) returned 0
[0077.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0077.979] GetSystemMetrics (nIndex=42) returned 0
[0077.979] CoTaskMemAlloc (cb=0x6) returned 0x1b57ec50
[0077.979] GetWindowTextW (in: hWnd=0x201cc, lpString=0x1b57ec50, nMaxCount=1 | out: lpString="") returned 0
[0077.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0xd, wParam=0x1, lParam=0x1b57ec50) returned 0x0
[0077.979] CoTaskMemFree (pv=0x1b57ec50)
[0077.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0077.979] GetWindowThreadProcessId (in: hWnd=0x201d8, lpdwProcessId=0x2ea100 | out: lpdwProcessId=0x2ea100) returned 0x968
[0077.979] GetWindow (hWnd=0x201d8, uCmd=0x5) returned 0x0
[0077.979] GetWindowLongPtrW (hWnd=0x201d8, nIndex=-20) returned 0x10100
[0077.979] DestroyWindow (hWnd=0x201d8) returned 1
[0077.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0
[0077.979] GetWindowTextLengthW (hWnd=0x201d8) returned 25
[0077.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x19
[0077.979] GetSystemMetrics (nIndex=42) returned 0
[0077.979] CoTaskMemAlloc (cb=0x38) returned 0x1b579fe0
[0077.979] GetWindowTextW (in: hWnd=0x201d8, lpString=0x1b579fe0, nMaxCount=26 | out: lpString="WindowsFormsParkingWindow") returned 25
[0077.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0xd, wParam=0x1a, lParam=0x1b579fe0) returned 0x19
[0077.979] CoTaskMemFree (pv=0x1b579fe0)
[0077.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0077.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0077.981] GetWindowTextLengthW (hWnd=0x201da) returned 283
[0077.981] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11b
[0077.981] GetSystemMetrics (nIndex=42) returned 0
[0077.981] CoTaskMemAlloc (cb=0x23c) returned 0x1b5abbb0
[0077.981] GetWindowTextW (in: hWnd=0x201da, lpString=0x1b5abbb0, nMaxCount=284 | out: lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.") returned 283
[0077.981] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xd, wParam=0x11c, lParam=0x1b5abbb0) returned 0x11b
[0077.981] CoTaskMemFree (pv=0x1b5abbb0)
[0077.981] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0077.981] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0077.982] InvalidateRect (hWnd=0x201c8, lpRect=0x0, bErase=0) returned 1
[0077.982] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0077.982] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0077.982] SendMessageW (hWnd=0x201e2, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0
[0077.982] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0
[0077.983] SendMessageW (hWnd=0x201e2, Msg=0xb0, wParam=0x2ea2c4, lParam=0x2ea2c0) returned 0x0
[0077.983] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0xb0, wParam=0x2ea2c4, lParam=0x2ea2c0) returned 0x0
[0077.983] GetWindowTextLengthW (hWnd=0x201e2) returned 4373
[0077.983] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x1115
[0077.983] GetSystemMetrics (nIndex=42) returned 0
[0077.983] CoTaskMemAlloc (cb=0x2230) returned 0x1b5ad990
[0077.983] GetWindowTextW (in: hWnd=0x201e2, lpString=0x1b5ad990, nMaxCount=4374 | out: lpString="See the end of this message for details on invoking \r\njust-in-time (JIT) debugging instead of this dialog box.\r\n\r\n************** Exception Text **************\r\nSystem.IO.DirectoryNotFoundException: Could not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.\r\n at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)\r\n at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy)\r\n at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)\r\n at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)\r\n at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding, Int32 bufferSize)\r\n at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding)\r\n at System.IO.File.WriteAllText(String path, String contents, Encoding encoding)\r\n at get.ranran.html()\r\n at get.ranran.Form1_Load(Object sender, EventArgs e)\r\n at System.EventHandler.Invoke(Object sender, EventArgs e)\r\n at System.Windows.Forms.Form.OnLoad(EventArgs e)\r\n at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)\r\n at System.Windows.Forms.Control.CreateControl()\r\n at System.Windows.Forms.Control.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Control.WndProc(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)\r\n at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)\r\n\r\n\r\n************** Loaded Assemblies **************\r\nmscorlib\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/Microsoft.NET/Framework64/v2.0.50727/mscorlib.dll\r\n----------------------------------------\r\nget\r\n Assembly Version: 1.0.0.0\r\n Win32 Version: 1.0.0.0\r\n CodeBase: file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/KryptoTrojaner.exe\r\n----------------------------------------\r\nMicrosoft.VisualBasic\r\n Assembly Version: 8.0.0.0\r\n Win32 Version: 8.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/Microsoft.VisualBasic/8.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualBasic.dll\r\n----------------------------------------\r\nSystem\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll\r\n----------------------------------------\r\nSystem.Windows.Forms\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll\r\n----------------------------------------\r\nSystem.Drawing\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll\r\n----------------------------------------\r\nSystem.Runtime.Remoting\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Runtime.Remoting/2.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll\r\n----------------------------------------\r\n9ee08ca6-3f27-4b57-b8d0-4985d08ba511\r\n Assembly Version: 1.0.0.0\r\n Win32 Version: 1.0.0.0\r\n CodeBase: file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/KryptoTrojaner.exe\r\n----------------------------------------\r\n\r\n************** JIT Debugging **************\r\nTo enable just-in-time (JIT) debugging, the .config file for this\r\napplication or computer (machine.config) must have the\r\njitDebugging value set in the system.windows.forms section.\r\nThe application must also be compiled with debugging\r\nenabled.\r\n\r\nFor example:\r\n\r\n\r\n \r\n\r\n\r\nWhen JIT debugging is enabled, any unhandled exception\r\nwill be sent to the JIT debugger registered on the computer\r\nrather than be handled by this dialog box.\r\n\r\n\r\n") returned 4373
[0077.983] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0xd, wParam=0x1116, lParam=0x1b5ad990) returned 0x1115
[0077.983] CoTaskMemFree (pv=0x1b5ad990)
[0077.983] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x1
[0077.983] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0077.984] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0077.984] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0077.985] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0077.985] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0077.985] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0077.986] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0077.990] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x46, wParam=0x0, lParam=0x2ee1f0) returned 0x0
[0077.993] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x46, wParam=0x0, lParam=0x2ee1f0) returned 0x0
[0077.993] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x1c, wParam=0x1, lParam=0x80c) returned 0x0
[0077.993] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x1c, wParam=0x1, lParam=0x80c) returned 0x0
[0077.993] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1
[0077.994] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
[0077.994] GetKeyboardLayout (idThread=0x0) returned 0x4090409
[0077.994] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
[0077.994] GetParent (hWnd=0x301b8) returned 0x0
[0077.994] GetKeyboardLayout (idThread=0x0) returned 0x4090409
[0077.994] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0
[0078.011] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0078.011] GetWindowPlacement (in: hWnd=0x301b8, lpwndpl=0x2edc70 | out: lpwndpl=0x2edc70) returned 1
[0078.011] GetClientRect (in: hWnd=0x301b8, lpRect=0x2edb20 | out: lpRect=0x2edb20) returned 1
[0078.011] GetWindowTextLengthW (hWnd=0x301b8) returned 0
[0078.011] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0078.011] GetSystemMetrics (nIndex=42) returned 0
[0078.011] CoTaskMemAlloc (cb=0x6) returned 0x1b57ec50
[0078.011] GetWindowTextW (in: hWnd=0x301b8, lpString=0x1b57ec50, nMaxCount=1 | out: lpString="") returned 0
[0078.011] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xd, wParam=0x1, lParam=0x1b57ec50) returned 0x0
[0078.011] CoTaskMemFree (pv=0x1b57ec50)
[0078.011] GetClientRect (in: hWnd=0x301b8, lpRect=0x2ed8c0 | out: lpRect=0x2ed8c0) returned 1
[0078.011] SelectPalette (hdc=0xb010833, hPal=0x13080713, bForceBkgd=1) returned 0x188000b
[0078.011] GdipCreateFromHDC (hdc=0xb010833, graphics=0x2ed490) returned 0x0
[0078.012] GdipSetPageUnit (graphics=0x1b047cc0, unit=0x2) returned 0x0
[0078.012] GdipCreateMatrix (matrix=0x2ed380) returned 0x0
[0078.012] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869df0) returned 0x0
[0078.012] GdipIsMatrixIdentity (matrix=0x1b869df0, result=0x2ed3e0) returned 0x0
[0078.012] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0078.012] GdipDeleteMatrix (matrix=0x1b869df0) returned 0x0
[0078.012] GdipCreateRegion (region=0x2ed380) returned 0x0
[0078.012] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0
[0078.012] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2ed3b0) returned 0x0
[0078.012] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0078.012] GdipDeleteRegion (region=0x1afad4d0) returned 0x0
[0078.012] GdipSaveGraphics (graphics=0x1b047cc0, state=0x2ed480) returned 0x0
[0078.012] GdipCreateRegion (region=0x2ed350) returned 0x0
[0078.012] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0
[0078.012] GdipCreateMatrix (matrix=0x2ed350) returned 0x0
[0078.012] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869e30) returned 0x0
[0078.012] GdipIsMatrixIdentity (matrix=0x1b869e30, result=0x2ed3b0) returned 0x0
[0078.012] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0
[0078.012] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fe0) returned 0x0
[0078.012] LocalFree (hMem=0x1b579fe0) returned 0x0
[0078.012] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0078.013] GdipDeleteMatrix (matrix=0x1b869e30) returned 0x0
[0078.013] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2ed400) returned 0x0
[0078.013] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0078.013] GdipDeleteRegion (region=0x1afad4d0) returned 0x0
[0078.013] GdipGetDC (graphics=0x1b047cc0, hdc=0x2ed430) returned 0x0
[0078.013] GetCurrentObject (hdc=0xb010833, type=0x1) returned 0x1b00017
[0078.013] GetCurrentObject (hdc=0xb010833, type=0x2) returned 0x1900010
[0078.013] GetCurrentObject (hdc=0xb010833, type=0x7) returned 0x1050032
[0078.013] GetCurrentObject (hdc=0xb010833, type=0x6) returned 0x18a002e
[0078.013] SaveDC (hdc=0xb010833) returned 1
[0078.013] OffsetViewportOrgEx (in: hdc=0xb010833, x=0, y=0, lppt=0x2885220 | out: lppt=0x2885220) returned 1
[0078.013] GetNearestColor (hdc=0xb010833, color=0xf0f0f0) returned 0xf0f0f0
[0078.013] CreateSolidBrush (color=0xf0f0f0) returned 0x20100720
[0078.013] FillRect (hDC=0xb010833, lprc=0x2ed400, hbr=0x20100720) returned 1
[0078.013] DeleteObject (ho=0x20100720) returned 1
[0078.013] RestoreDC (hdc=0xb010833, nSavedDC=-1) returned 1
[0078.013] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0078.014] GdipReleaseDC (graphics=0x1b047cc0, hdc=0xb010833) returned 0x0
[0078.014] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000
[0078.014] GdipDeleteGraphics (graphics=0x1b047cc0) returned 0x0
[0078.014] SelectPalette (hdc=0xb010833, hPal=0x188000b, bForceBkgd=0) returned 0x13080713
[0078.014] GetWindowPlacement (in: hWnd=0x301b8, lpwndpl=0x2edc50 | out: lpwndpl=0x2edc50) returned 1
[0078.014] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x47, wParam=0x0, lParam=0x2ee1f0) returned 0x0
[0078.014] GetClientRect (in: hWnd=0x301b8, lpRect=0x2ed9f0 | out: lpRect=0x2ed9f0) returned 1
[0078.014] GetWindowRect (in: hWnd=0x301b8, lpRect=0x2ed9f0 | out: lpRect=0x2ed9f0) returned 1
[0078.014] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x5, wParam=0x0, lParam=0x260084) returned 0x0
[0078.014] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x3, wParam=0x0, lParam=0xc800c8) returned 0x0
[0078.014] GetClientRect (in: hWnd=0x301b8, lpRect=0x2edac0 | out: lpRect=0x2edac0) returned 1
[0078.014] GetWindowRect (in: hWnd=0x301b8, lpRect=0x2edac0 | out: lpRect=0x2edac0) returned 1
[0078.014] GetWindowTextLengthW (hWnd=0x301b8) returned 0
[0078.014] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0078.014] GetSystemMetrics (nIndex=42) returned 0
[0078.014] CoTaskMemAlloc (cb=0x6) returned 0x1b57ec50
[0078.014] GetWindowTextW (in: hWnd=0x301b8, lpString=0x1b57ec50, nMaxCount=1 | out: lpString="") returned 0
[0078.014] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xd, wParam=0x1, lParam=0x1b57ec50) returned 0x0
[0078.015] CoTaskMemFree (pv=0x1b57ec50)
[0078.015] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 1
[0078.015] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x110189
[0078.015] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x601a1
[0078.015] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x601a1
[0078.015] IsWindowUnicode (hWnd=0x301b8) returned 1
[0078.015] GetMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ee230) returned 1
[0078.015] TranslateMessage (lpMsg=0x2ee240) returned 0
[0078.015] DispatchMessageW (lpMsg=0x2ee240) returned 0x0
[0078.015] BeginPaint (in: hWnd=0x301b8, lpPaint=0x2ed618 | out: lpPaint=0x2ed618) returned 0xb010833
[0078.015] SelectPalette (hdc=0xb010833, hPal=0x13080713, bForceBkgd=1) returned 0x188000b
[0078.015] GetWindowTextLengthW (hWnd=0x301b8) returned 0
[0078.015] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0078.015] GetSystemMetrics (nIndex=42) returned 0
[0078.015] CoTaskMemAlloc (cb=0x6) returned 0x1b57ec50
[0078.015] GetWindowTextW (in: hWnd=0x301b8, lpString=0x1b57ec50, nMaxCount=1 | out: lpString="") returned 0
[0078.015] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xd, wParam=0x1, lParam=0x1b57ec50) returned 0x0
[0078.015] CoTaskMemFree (pv=0x1b57ec50)
[0078.016] EndPaint (hWnd=0x301b8, lpPaint=0x2ed628) returned 1
[0078.016] SelectPalette (hdc=0xb010833, hPal=0x188000b, bForceBkgd=0) returned 0x0
[0078.016] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0
[0078.016] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0
[0078.016] WaitMessage () returned 1
[0078.116] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 1
[0078.116] IsWindowUnicode (hWnd=0x201d0) returned 1
[0078.116] GetMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ee230) returned 1
[0078.116] TranslateMessage (lpMsg=0x2ee240) returned 0
[0078.116] DispatchMessageW (lpMsg=0x2ee240) returned 0x0
[0078.117] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0
[0078.117] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0
[0078.117] WaitMessage () returned 1
[0078.304] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 1
[0078.304] IsWindowUnicode (hWnd=0x201d2) returned 1
[0078.304] GetMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ee230) returned 1
[0078.304] TranslateMessage (lpMsg=0x2ee240) returned 0
[0078.304] DispatchMessageW (lpMsg=0x2ee240) returned 0x0
[0078.304] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0
[0078.304] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0
[0078.304] WaitMessage () returned 1
[0105.445] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0
[0105.446] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1
[0105.446] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1
[0105.446] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0
[0105.446] WaitMessage ()
Thread:
id = 2
os_tid = 0x974
Thread:
id = 3
os_tid = 0x978
[0042.791] CoGetContextToken (in: pToken=0x1af4f590 | out: pToken=0x1af4f590) returned 0x800401f0
[0042.791] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
Thread:
id = 4
os_tid = 0x97c
Thread:
id = 5
os_tid = 0xa34
Thread:
id = 6
os_tid = 0xa38
Thread:
id = 7
os_tid = 0xa3c
Thread:
id = 8
os_tid = 0xa40
Thread:
id = 11
os_tid = 0xa54
Process:
id = "2"
image_name = "templanran.exe"
filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\templanran.exe"
page_root = "0x32e21000"
os_pid = "0xa44"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "1"
os_parent_pid = "0x964"
cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe\" "
cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:000104d7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 365
start_va = 0x10000
end_va = 0x2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 366
start_va = 0x30000
end_va = 0x31fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 367
start_va = 0x40000
end_va = 0x40fff
entry_point = 0x40000
region_type = mapped_file
name = "apisetschema.dll"
filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")
Region:
id = 368
start_va = 0x50000
end_va = 0x53fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000050000"
filename = ""
Region:
id = 369
start_va = 0x60000
end_va = 0x60fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000060000"
filename = ""
Region:
id = 370
start_va = 0x190000
end_va = 0x1cffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000190000"
filename = ""
Region:
id = 371
start_va = 0x1e0000
end_va = 0x2dffff
entry_point = 0x0
region_type = private
name = "private_0x00000000001e0000"
filename = ""
Region:
id = 372
start_va = 0x3a0000
end_va = 0x3adfff
entry_point = 0x3a0000
region_type = mapped_file
name = "templanran.exe"
filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\templanran.exe")
Region:
id = 373
start_va = 0x77c50000
end_va = 0x77df8fff
entry_point = 0x77c50000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 374
start_va = 0x77e30000
end_va = 0x77faffff
entry_point = 0x77e30000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 375
start_va = 0x7efb0000
end_va = 0x7efd2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007efb0000"
filename = ""
Region:
id = 376
start_va = 0x7efdb000
end_va = 0x7efddfff
entry_point = 0x0
region_type = private
name = "private_0x000000007efdb000"
filename = ""
Region:
id = 377
start_va = 0x7efde000
end_va = 0x7efdefff
entry_point = 0x0
region_type = private
name = "private_0x000000007efde000"
filename = ""
Region:
id = 378
start_va = 0x7efdf000
end_va = 0x7efdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007efdf000"
filename = ""
Region:
id = 379
start_va = 0x7efe0000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007efe0000"
filename = ""
Region:
id = 380
start_va = 0x7ffe0000
end_va = 0x7ffeffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 381
start_va = 0x7fff0000
end_va = 0x7fffffeffff
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 382
start_va = 0x80000
end_va = 0xfffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000080000"
filename = ""
Region:
id = 383
start_va = 0x75360000
end_va = 0x75367fff
entry_point = 0x75360000
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 384
start_va = 0x75370000
end_va = 0x753cbfff
entry_point = 0x75370000
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 385
start_va = 0x753d0000
end_va = 0x7540efff
entry_point = 0x753d0000
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 386
start_va = 0x3c0000
end_va = 0x4bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000003c0000"
filename = ""
Region:
id = 387
start_va = 0x75760000
end_va = 0x757a9fff
entry_point = 0x75760000
region_type = mapped_file
name = "mscoree.dll"
filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll")
Region:
id = 388
start_va = 0x75bb0000
end_va = 0x75bf5fff
entry_point = 0x75bb0000
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 389
start_va = 0x75fd0000
end_va = 0x760dffff
entry_point = 0x75fd0000
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 390
start_va = 0x77a30000
end_va = 0x77b4efff
entry_point = 0x0
region_type = private
name = "private_0x0000000077a30000"
filename = ""
Region:
id = 391
start_va = 0x77b50000
end_va = 0x77c49fff
entry_point = 0x0
region_type = private
name = "private_0x0000000077b50000"
filename = ""
Region:
id = 424
start_va = 0x10000
end_va = 0x1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 425
start_va = 0x100000
end_va = 0x166fff
entry_point = 0x100000
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 426
start_va = 0x300000
end_va = 0x33ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000300000"
filename = ""
Region:
id = 427
start_va = 0x590000
end_va = 0x59ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000590000"
filename = ""
Region:
id = 428
start_va = 0x75980000
end_va = 0x7598bfff
entry_point = 0x75980000
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 429
start_va = 0x75990000
end_va = 0x759effff
entry_point = 0x75990000
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 430
start_va = 0x75a30000
end_va = 0x75a48fff
entry_point = 0x75a30000
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 431
start_va = 0x760e0000
end_va = 0x7617ffff
entry_point = 0x760e0000
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")
Region:
id = 432
start_va = 0x76670000
end_va = 0x7671bfff
entry_point = 0x76670000
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 433
start_va = 0x775d0000
end_va = 0x776bffff
entry_point = 0x775d0000
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 434
start_va = 0x7efe0000
end_va = 0x7f0dffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007efe0000"
filename = ""
Region:
id = 435
start_va = 0x7f0e0000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007f0e0000"
filename = ""
Region:
id = 446
start_va = 0x370000
end_va = 0x37ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000370000"
filename = ""
Region:
id = 447
start_va = 0x756e0000
end_va = 0x75757fff
entry_point = 0x756e0000
region_type = mapped_file
name = "mscoreei.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")
Region:
id = 448
start_va = 0x76180000
end_va = 0x761d6fff
entry_point = 0x76180000
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Region:
id = 449
start_va = 0x763c0000
end_va = 0x763c9fff
entry_point = 0x763c0000
region_type = mapped_file
name = "lpk.dll"
filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")
Region:
id = 450
start_va = 0x763e0000
end_va = 0x764dffff
entry_point = 0x763e0000
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 451
start_va = 0x77820000
end_va = 0x778affff
entry_point = 0x77820000
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 452
start_va = 0x77990000
end_va = 0x77a2cfff
entry_point = 0x77990000
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")
Region:
id = 461
start_va = 0x5a0000
end_va = 0x727fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000005a0000"
filename = ""
Region:
id = 462
start_va = 0x76720000
end_va = 0x767ebfff
entry_point = 0x76720000
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")
Region:
id = 463
start_va = 0x77570000
end_va = 0x775cffff
entry_point = 0x77570000
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 469
start_va = 0x20000
end_va = 0x20fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 470
start_va = 0x30000
end_va = 0x30fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 471
start_va = 0x730000
end_va = 0x8b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000730000"
filename = ""
Region:
id = 472
start_va = 0x8c0000
end_va = 0x1cbffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000008c0000"
filename = ""
Region:
id = 473
start_va = 0x756d0000
end_va = 0x756d8fff
entry_point = 0x756d0000
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")
Region:
id = 535
start_va = 0x70000
end_va = 0x70fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000070000"
filename = ""
Region:
id = 536
start_va = 0x1e10000
end_va = 0x1e4ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001e10000"
filename = ""
Region:
id = 537
start_va = 0x74d00000
end_va = 0x752aafff
entry_point = 0x74d00000
region_type = mapped_file
name = "mscorwks.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll")
Region:
id = 538
start_va = 0x75630000
end_va = 0x756cafff
entry_point = 0x75630000
region_type = mapped_file
name = "msvcr80.dll"
filename = "\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll")
Region:
id = 552
start_va = 0x170000
end_va = 0x170fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000170000"
filename = ""
Region:
id = 553
start_va = 0x180000
end_va = 0x180fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000180000"
filename = ""
Region:
id = 554
start_va = 0x1d0000
end_va = 0x1dffff
entry_point = 0x0
region_type = private
name = "private_0x00000000001d0000"
filename = ""
Region:
id = 555
start_va = 0x2e0000
end_va = 0x2effff
entry_point = 0x0
region_type = private
name = "private_0x00000000002e0000"
filename = ""
Region:
id = 556
start_va = 0x2f0000
end_va = 0x2fffff
entry_point = 0x0
region_type = private
name = "private_0x00000000002f0000"
filename = ""
Region:
id = 557
start_va = 0x340000
end_va = 0x34ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000340000"
filename = ""
Region:
id = 558
start_va = 0x350000
end_va = 0x35ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000350000"
filename = ""
Region:
id = 559
start_va = 0x360000
end_va = 0x36ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000360000"
filename = ""
Region:
id = 560
start_va = 0x540000
end_va = 0x54ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000540000"
filename = ""
Region:
id = 561
start_va = 0x1da0000
end_va = 0x1ddffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001da0000"
filename = ""
Region:
id = 562
start_va = 0x1f50000
end_va = 0x204ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001f50000"
filename = ""
Region:
id = 563
start_va = 0x76920000
end_va = 0x77569fff
entry_point = 0x76920000
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")
Region:
id = 564
start_va = 0x7efd8000
end_va = 0x7efdafff
entry_point = 0x0
region_type = private
name = "private_0x000000007efd8000"
filename = ""
Region:
id = 565
start_va = 0x380000
end_va = 0x380fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000380000"
filename = ""
Region:
id = 566
start_va = 0x776c0000
end_va = 0x7781bfff
entry_point = 0x776c0000
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 571
start_va = 0x2050000
end_va = 0x231efff
entry_point = 0x2050000
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 572
start_va = 0x75620000
end_va = 0x7562afff
entry_point = 0x75620000
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")
Region:
id = 575
start_va = 0x1cc0000
end_va = 0x1d5ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001cc0000"
filename = ""
Region:
id = 576
start_va = 0x2320000
end_va = 0x431ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002320000"
filename = ""
Region:
id = 577
start_va = 0x4320000
end_va = 0x435ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004320000"
filename = ""
Region:
id = 578
start_va = 0x44d0000
end_va = 0x45cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000044d0000"
filename = ""
Region:
id = 579
start_va = 0x73870000
end_va = 0x74367fff
entry_point = 0x73870000
region_type = mapped_file
name = "mscorlib.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll")
Region:
id = 580
start_va = 0x7efd5000
end_va = 0x7efd7fff
entry_point = 0x0
region_type = private
name = "private_0x000000007efd5000"
filename = ""
Region:
id = 588
start_va = 0x752d0000
end_va = 0x7534ffff
entry_point = 0x752d0000
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")
Region:
id = 589
start_va = 0x1e50000
end_va = 0x1f3ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001e50000"
filename = ""
Region:
id = 591
start_va = 0x4360000
end_va = 0x443efff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004360000"
filename = ""
Region:
id = 593
start_va = 0x390000
end_va = 0x392fff
entry_point = 0x390000
region_type = mapped_file
name = "l_intl.nls"
filename = "\\Windows\\SysWOW64\\l_intl.nls" (normalized: "c:\\windows\\syswow64\\l_intl.nls")
Region:
id = 594
start_va = 0x3b0000
end_va = 0x3b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000003b0000"
filename = ""
Region:
id = 595
start_va = 0x755c0000
end_va = 0x7561afff
entry_point = 0x755c0000
region_type = mapped_file
name = "mscorjit.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll")
Region:
id = 596
start_va = 0x4c0000
end_va = 0x4cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000004c0000"
filename = ""
Region:
id = 597
start_va = 0x4d0000
end_va = 0x4dffff
entry_point = 0x0
region_type = private
name = "private_0x00000000004d0000"
filename = ""
Region:
id = 601
start_va = 0x4620000
end_va = 0x465ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004620000"
filename = ""
Region:
id = 602
start_va = 0x46e0000
end_va = 0x47dffff
entry_point = 0x0
region_type = private
name = "private_0x00000000046e0000"
filename = ""
Region:
id = 603
start_va = 0x7efad000
end_va = 0x7efaffff
entry_point = 0x0
region_type = private
name = "private_0x000000007efad000"
filename = ""
Region:
id = 604
start_va = 0x4490000
end_va = 0x44cffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004490000"
filename = ""
Region:
id = 605
start_va = 0x48c0000
end_va = 0x49bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000048c0000"
filename = ""
Region:
id = 606
start_va = 0x7efaa000
end_va = 0x7efacfff
entry_point = 0x0
region_type = private
name = "private_0x000000007efaa000"
filename = ""
Region:
id = 607
start_va = 0x4e0000
end_va = 0x51ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000004e0000"
filename = ""
Region:
id = 608
start_va = 0x4a00000
end_va = 0x4afffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004a00000"
filename = ""
Region:
id = 609
start_va = 0x74ce0000
end_va = 0x74cf5fff
entry_point = 0x74ce0000
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")
Region:
id = 610
start_va = 0x7efa7000
end_va = 0x7efa9fff
entry_point = 0x0
region_type = private
name = "private_0x000000007efa7000"
filename = ""
Region:
id = 611
start_va = 0x550000
end_va = 0x58bfff
entry_point = 0x550000
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 612
start_va = 0x550000
end_va = 0x58bfff
entry_point = 0x550000
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 613
start_va = 0x550000
end_va = 0x58bfff
entry_point = 0x550000
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 614
start_va = 0x550000
end_va = 0x58bfff
entry_point = 0x550000
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 615
start_va = 0x550000
end_va = 0x58bfff
entry_point = 0x550000
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 616
start_va = 0x74ca0000
end_va = 0x74cdafff
entry_point = 0x74ca0000
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 617
start_va = 0x75410000
end_va = 0x7541dfff
entry_point = 0x75410000
region_type = mapped_file
name = "rpcrtremote.dll"
filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")
Region:
id = 618
start_va = 0x730d0000
end_va = 0x7386bfff
entry_point = 0x730d0000
region_type = mapped_file
name = "system.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\9e0a3b9b9f457233a335d7fba8f95419\\system.ni.dll")
Region:
id = 619
start_va = 0x75420000
end_va = 0x755bafff
entry_point = 0x75420000
region_type = mapped_file
name = "microsoft.visualbasic.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualBas#\\08d608378aa405adc844f3cf36974b8c\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualbas#\\08d608378aa405adc844f3cf36974b8c\\microsoft.visualbasic.ni.dll")
Thread:
id = 9
os_tid = 0xa48
[0071.465] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0
[0072.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe", nBufferLength=0x105, lpBuffer=0x2de620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe", lpFilePart=0x0) returned 0x3a
[0072.021] GetLastError () returned 0x2
[0072.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe", nBufferLength=0x105, lpBuffer=0x2de5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe", lpFilePart=0x0) returned 0x3a
[0072.071] GetLastError () returned 0x2
[0072.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x2de584, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c
[0072.075] GetLastError () returned 0x2
[0072.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x2de620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c
[0072.089] GetLastError () returned 0x2
[0072.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x2de5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c
[0072.089] GetLastError () returned 0x2
[0072.138] GetVersionExW (in: lpVersionInformation=0x400c88*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x400c88*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0072.138] GetLastError () returned 0x2
[0072.139] GetVersionExW (in: lpVersionInformation=0x400c88*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x400c88*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0072.139] GetLastError () returned 0x2
[0073.051] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3dc024*=0x88, lpdwindex=0x2ded90)
Thread:
id = 14
os_tid = 0xa90
Thread:
id = 16
os_tid = 0xa98
[0071.810] CoGetContextToken (in: pToken=0x45cf788 | out: pToken=0x45cf788) returned 0x800401f0
[0071.811] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
Thread:
id = 17
os_tid = 0xa9c
[0073.047] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0075.384] GetLogicalDrives () returned 0x4
[0075.384] GetLastError () returned 0x0
[0075.417] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0075.417] GetLastError () returned 0x0
[0075.445] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0075.445] GetLastError () returned 0x0
[0075.445] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
[0075.445] GetLastError () returned 0x0
[0075.445] GetVersionExW (in: lpVersionInformation=0x4212c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x4212c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0075.445] GetLastError () returned 0x0
[0075.446] SetErrorMode (uMode=0x1) returned 0x0
[0075.448] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
[0075.448] GetLastError () returned 0x0
[0075.448] SetErrorMode (uMode=0x0) returned 0x1
[0081.990] GetLogicalDrives () returned 0x4
[0081.990] GetLastError () returned 0x0
[0081.990] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0081.990] GetLastError () returned 0x0
[0081.990] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0081.990] GetLastError () returned 0x0
[0081.991] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
[0081.991] GetLastError () returned 0x0
[0081.991] SetErrorMode (uMode=0x1) returned 0x0
[0081.991] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
[0081.991] GetLastError () returned 0x0
[0081.991] SetErrorMode (uMode=0x0) returned 0x1
[0087.211] GetLogicalDrives () returned 0x4
[0087.211] GetLastError () returned 0x0
[0087.211] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0087.211] GetLastError () returned 0x0
[0087.211] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0087.211] GetLastError () returned 0x0
[0087.211] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
[0087.211] GetLastError () returned 0x0
[0087.211] SetErrorMode (uMode=0x1) returned 0x0
[0087.211] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
[0087.212] GetLastError () returned 0x0
[0087.212] SetErrorMode (uMode=0x0) returned 0x1
[0092.218] GetLogicalDrives () returned 0x4
[0092.218] GetLastError () returned 0x0
[0092.218] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0092.219] GetLastError () returned 0x0
[0092.219] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0092.219] GetLastError () returned 0x0
[0092.219] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
[0092.219] GetLastError () returned 0x0
[0092.219] SetErrorMode (uMode=0x1) returned 0x0
[0092.219] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
[0092.219] GetLastError () returned 0x0
[0092.219] SetErrorMode (uMode=0x0) returned 0x1
[0100.236] GetLogicalDrives () returned 0x4
[0100.236] GetLastError () returned 0x0
[0100.236] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0100.236] GetLastError () returned 0x0
[0100.236] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0100.236] GetLastError () returned 0x0
[0100.236] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
[0100.236] GetLastError () returned 0x0
[0100.236] SetErrorMode (uMode=0x1) returned 0x0
[0100.236] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
[0100.245] GetLastError () returned 0x0
[0100.245] SetErrorMode (uMode=0x0) returned 0x1
[0105.411] GetLogicalDrives () returned 0x4
[0105.411] GetLastError () returned 0x0
[0105.411] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0105.411] GetLastError () returned 0x0
[0105.412] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0105.412] GetLastError () returned 0x0
[0105.412] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
[0105.412] GetLastError () returned 0x0
[0105.412] SetErrorMode (uMode=0x1) returned 0x0
[0105.412] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
[0105.412] GetLastError () returned 0x0
[0105.412] SetErrorMode (uMode=0x0) returned 0x1
[0110.438] GetLogicalDrives () returned 0x4
[0110.439] GetLastError () returned 0x0
[0110.439] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0110.439] GetLastError () returned 0x0
[0110.439] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0110.439] GetLastError () returned 0x0
[0110.439] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
[0110.439] GetLastError () returned 0x0
[0110.439] SetErrorMode (uMode=0x1) returned 0x0
[0110.439] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
[0110.439] GetLastError () returned 0x0
[0110.439] SetErrorMode (uMode=0x0) returned 0x1
[0115.449] GetLogicalDrives () returned 0x4
[0115.449] GetLastError () returned 0x0
[0115.450] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0115.450] GetLastError () returned 0x0
[0115.450] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0115.450] GetLastError () returned 0x0
[0115.450] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
[0115.450] GetLastError () returned 0x0
[0115.450] SetErrorMode (uMode=0x1) returned 0x0
[0115.450] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
[0115.450] GetLastError () returned 0x0
[0115.450] SetErrorMode (uMode=0x0) returned 0x1
[0120.460] GetLogicalDrives () returned 0x4
[0120.460] GetLastError () returned 0x0
[0120.460] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0120.460] GetLastError () returned 0x0
[0120.460] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0120.460] GetLastError () returned 0x0
[0120.460] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
[0120.460] GetLastError () returned 0x0
[0120.460] SetErrorMode (uMode=0x1) returned 0x0
[0120.460] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
[0120.460] GetLastError () returned 0x0
[0120.460] SetErrorMode (uMode=0x0) returned 0x1
[0125.459] GetLogicalDrives () returned 0x4
[0125.460] GetLastError () returned 0x0
[0125.460] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0125.460] GetLastError () returned 0x0
[0125.460] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0125.460] GetLastError () returned 0x0
[0125.460] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
[0125.460] GetLastError () returned 0x0
[0125.460] SetErrorMode (uMode=0x1) returned 0x0
[0125.460] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
[0125.460] GetLastError () returned 0x0
[0125.460] SetErrorMode (uMode=0x0) returned 0x1
[0130.469] GetLogicalDrives () returned 0x4
[0130.469] GetLastError () returned 0x0
[0130.469] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0130.469] GetLastError () returned 0x0
[0130.469] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0130.469] GetLastError () returned 0x0
[0130.469] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
[0130.469] GetLastError () returned 0x0
[0130.469] SetErrorMode (uMode=0x1) returned 0x0
[0130.469] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
[0130.469] GetLastError () returned 0x0
[0130.469] SetErrorMode (uMode=0x0) returned 0x1
[0135.476] GetLogicalDrives () returned 0x4
[0135.476] GetLastError () returned 0x0
[0135.476] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0135.476] GetLastError () returned 0x0
[0135.476] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0135.476] GetLastError () returned 0x0
[0135.476] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
[0135.477] GetLastError () returned 0x0
[0135.477] SetErrorMode (uMode=0x1) returned 0x0
[0135.477] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
[0135.477] GetLastError () returned 0x0
[0135.477] SetErrorMode (uMode=0x0) returned 0x1
[0140.484] GetLogicalDrives () returned 0x4
[0140.484] GetLastError () returned 0x0
[0140.484] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0140.484] GetLastError () returned 0x0
[0140.484] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0140.484] GetLastError () returned 0x0
[0140.484] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
[0140.484] GetLastError () returned 0x0
[0140.484] SetErrorMode (uMode=0x1) returned 0x0
[0140.484] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
[0140.484] GetLastError () returned 0x0
[0140.484] SetErrorMode (uMode=0x0) returned 0x1
[0145.491] GetLogicalDrives () returned 0x4
[0145.491] GetLastError () returned 0x0
[0145.492] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0145.492] GetLastError () returned 0x0
[0145.492] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0145.492] GetLastError () returned 0x0
[0145.492] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
[0145.492] GetLastError () returned 0x0
[0145.492] SetErrorMode (uMode=0x1) returned 0x0
[0145.492] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
[0145.492] GetLastError () returned 0x0
[0145.492] SetErrorMode (uMode=0x0) returned 0x1
[0150.499] GetLogicalDrives () returned 0x4
[0150.499] GetLastError () returned 0x0
[0150.499] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0150.500] GetLastError () returned 0x0
[0150.500] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0150.500] GetLastError () returned 0x0
[0150.500] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
[0150.500] GetLastError () returned 0x0
[0150.500] SetErrorMode (uMode=0x1) returned 0x0
[0150.500] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
[0150.500] GetLastError () returned 0x0
[0150.500] SetErrorMode (uMode=0x0) returned 0x1
[0155.507] GetLogicalDrives () returned 0x4
[0155.507] GetLastError () returned 0x0
[0155.507] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3
[0155.507] GetLastError () returned 0x0
[0155.507] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
[0155.507] GetLastError () returned 0x0
[0155.507] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa
[0155.507] GetLastError () returned 0x0
[0155.507] SetErrorMode (uMode=0x1) returned 0x0
[0155.507] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1
[0155.507] GetLastError () returned 0x0
[0155.507] SetErrorMode (uMode=0x0) returned 0x1
Thread:
id = 18
os_tid = 0xaa0
Thread:
id = 19
os_tid = 0xaa4
Thread:
id = 20
os_tid = 0xaa8
Thread:
id = 21
os_tid = 0xaac
Process:
id = "3"
image_name = "temprunsom.exe"
filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temprunsom.exe"
page_root = "0x31e66000"
os_pid = "0xa4c"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "1"
os_parent_pid = "0x964"
cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe\" "
cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:000104d7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 393
start_va = 0x10000
end_va = 0x2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 394
start_va = 0x30000
end_va = 0x31fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 395
start_va = 0x40000
end_va = 0x40fff
entry_point = 0x40000
region_type = mapped_file
name = "apisetschema.dll"
filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")
Region:
id = 396
start_va = 0x50000
end_va = 0x53fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000050000"
filename = ""
Region:
id = 397
start_va = 0x60000
end_va = 0x60fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000060000"
filename = ""
Region:
id = 398
start_va = 0x1d0000
end_va = 0x20ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000001d0000"
filename = ""
Region:
id = 399
start_va = 0x2a0000
end_va = 0x39ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000002a0000"
filename = ""
Region:
id = 400
start_va = 0xc80000
end_va = 0xc9ffff
entry_point = 0xc80000
region_type = mapped_file
name = "temprunsom.exe"
filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temprunsom.exe")
Region:
id = 401
start_va = 0x77c50000
end_va = 0x77df8fff
entry_point = 0x77c50000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 402
start_va = 0x77e30000
end_va = 0x77faffff
entry_point = 0x77e30000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 403
start_va = 0x7efb0000
end_va = 0x7efd2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007efb0000"
filename = ""
Region:
id = 404
start_va = 0x7efdb000
end_va = 0x7efddfff
entry_point = 0x0
region_type = private
name = "private_0x000000007efdb000"
filename = ""
Region:
id = 405
start_va = 0x7efde000
end_va = 0x7efdefff
entry_point = 0x0
region_type = private
name = "private_0x000000007efde000"
filename = ""
Region:
id = 406
start_va = 0x7efdf000
end_va = 0x7efdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007efdf000"
filename = ""
Region:
id = 407
start_va = 0x7efe0000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007efe0000"
filename = ""
Region:
id = 408
start_va = 0x7ffe0000
end_va = 0x7ffeffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 409
start_va = 0x7fff0000
end_va = 0x7fffffeffff
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 410
start_va = 0xb0000
end_va = 0x12ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000000b0000"
filename = ""
Region:
id = 411
start_va = 0x75360000
end_va = 0x75367fff
entry_point = 0x75360000
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 412
start_va = 0x75370000
end_va = 0x753cbfff
entry_point = 0x75370000
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 413
start_va = 0x753d0000
end_va = 0x7540efff
entry_point = 0x753d0000
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 414
start_va = 0x10000
end_va = 0x1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 415
start_va = 0x130000
end_va = 0x196fff
entry_point = 0x130000
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 416
start_va = 0x3e0000
end_va = 0x4dffff
entry_point = 0x0
region_type = private
name = "private_0x00000000003e0000"
filename = ""
Region:
id = 417
start_va = 0x75760000
end_va = 0x757a9fff
entry_point = 0x75760000
region_type = mapped_file
name = "mscoree.dll"
filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll")
Region:
id = 418
start_va = 0x75bb0000
end_va = 0x75bf5fff
entry_point = 0x75bb0000
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 419
start_va = 0x75fd0000
end_va = 0x760dffff
entry_point = 0x75fd0000
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 420
start_va = 0x77a30000
end_va = 0x77b4efff
entry_point = 0x0
region_type = private
name = "private_0x0000000077a30000"
filename = ""
Region:
id = 421
start_va = 0x77b50000
end_va = 0x77c49fff
entry_point = 0x0
region_type = private
name = "private_0x0000000077b50000"
filename = ""
Region:
id = 422
start_va = 0x7efe0000
end_va = 0x7f0dffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007efe0000"
filename = ""
Region:
id = 423
start_va = 0x7f0e0000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007f0e0000"
filename = ""
Region:
id = 436
start_va = 0x70000
end_va = 0xaffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000070000"
filename = ""
Region:
id = 437
start_va = 0x6b0000
end_va = 0x6bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000006b0000"
filename = ""
Region:
id = 438
start_va = 0x75980000
end_va = 0x7598bfff
entry_point = 0x75980000
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 439
start_va = 0x75990000
end_va = 0x759effff
entry_point = 0x75990000
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 440
start_va = 0x75a30000
end_va = 0x75a48fff
entry_point = 0x75a30000
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 441
start_va = 0x760e0000
end_va = 0x7617ffff
entry_point = 0x760e0000
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")
Region:
id = 442
start_va = 0x76670000
end_va = 0x7671bfff
entry_point = 0x76670000
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 443
start_va = 0x775d0000
end_va = 0x776bffff
entry_point = 0x775d0000
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 444
start_va = 0x690000
end_va = 0x69ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000690000"
filename = ""
Region:
id = 445
start_va = 0x756e0000
end_va = 0x75757fff
entry_point = 0x756e0000
region_type = mapped_file
name = "mscoreei.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")
Region:
id = 453
start_va = 0x76180000
end_va = 0x761d6fff
entry_point = 0x76180000
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Region:
id = 454
start_va = 0x763c0000
end_va = 0x763c9fff
entry_point = 0x763c0000
region_type = mapped_file
name = "lpk.dll"
filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")
Region:
id = 455
start_va = 0x763e0000
end_va = 0x764dffff
entry_point = 0x763e0000
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 456
start_va = 0x77820000
end_va = 0x778affff
entry_point = 0x77820000
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 457
start_va = 0x77990000
end_va = 0x77a2cfff
entry_point = 0x77990000
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")
Region:
id = 458
start_va = 0x4e0000
end_va = 0x667fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 459
start_va = 0x76720000
end_va = 0x767ebfff
entry_point = 0x76720000
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")
Region:
id = 460
start_va = 0x77570000
end_va = 0x775cffff
entry_point = 0x77570000
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 464
start_va = 0x20000
end_va = 0x20fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 465
start_va = 0x30000
end_va = 0x30fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 466
start_va = 0x6c0000
end_va = 0x840fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000006c0000"
filename = ""
Region:
id = 467
start_va = 0xca0000
end_va = 0x209ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000ca0000"
filename = ""
Region:
id = 468
start_va = 0x756d0000
end_va = 0x756d8fff
entry_point = 0x756d0000
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")
Region:
id = 531
start_va = 0x1a0000
end_va = 0x1a0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001a0000"
filename = ""
Region:
id = 532
start_va = 0x920000
end_va = 0x95ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000920000"
filename = ""
Region:
id = 533
start_va = 0x74d00000
end_va = 0x752aafff
entry_point = 0x74d00000
region_type = mapped_file
name = "mscorwks.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll")
Region:
id = 534
start_va = 0x75630000
end_va = 0x756cafff
entry_point = 0x75630000
region_type = mapped_file
name = "msvcr80.dll"
filename = "\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll")
Region:
id = 539
start_va = 0x1b0000
end_va = 0x1b0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001b0000"
filename = ""
Region:
id = 540
start_va = 0x1c0000
end_va = 0x1c0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001c0000"
filename = ""
Region:
id = 541
start_va = 0x210000
end_va = 0x21ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000210000"
filename = ""
Region:
id = 542
start_va = 0x220000
end_va = 0x22ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000220000"
filename = ""
Region:
id = 543
start_va = 0x230000
end_va = 0x23ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000230000"
filename = ""
Region:
id = 544
start_va = 0x240000
end_va = 0x24ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000240000"
filename = ""
Region:
id = 545
start_va = 0x250000
end_va = 0x25ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000250000"
filename = ""
Region:
id = 546
start_va = 0x260000
end_va = 0x26ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000260000"
filename = ""
Region:
id = 547
start_va = 0xa50000
end_va = 0xa5ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000a50000"
filename = ""
Region:
id = 548
start_va = 0xad0000
end_va = 0xb0ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000ad0000"
filename = ""
Region:
id = 549
start_va = 0x20c0000
end_va = 0x21bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 550
start_va = 0x76920000
end_va = 0x77569fff
entry_point = 0x76920000
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")
Region:
id = 551
start_va = 0x7efd8000
end_va = 0x7efdafff
entry_point = 0x0
region_type = private
name = "private_0x000000007efd8000"
filename = ""
Region:
id = 567
start_va = 0x270000
end_va = 0x270fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000270000"
filename = ""
Region:
id = 568
start_va = 0x776c0000
end_va = 0x7781bfff
entry_point = 0x776c0000
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 569
start_va = 0x21c0000
end_va = 0x248efff
entry_point = 0x21c0000
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 570
start_va = 0x75620000
end_va = 0x7562afff
entry_point = 0x75620000
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")
Region:
id = 581
start_va = 0x850000
end_va = 0x8effff
entry_point = 0x0
region_type = private
name = "private_0x0000000000850000"
filename = ""
Region:
id = 582
start_va = 0xa10000
end_va = 0xa4ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000a10000"
filename = ""
Region:
id = 583
start_va = 0xb50000
end_va = 0xc4ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000b50000"
filename = ""
Region:
id = 584
start_va = 0x2490000
end_va = 0x448ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002490000"
filename = ""
Region:
id = 585
start_va = 0x73870000
end_va = 0x74367fff
entry_point = 0x73870000
region_type = mapped_file
name = "mscorlib.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll")
Region:
id = 586
start_va = 0x7efd5000
end_va = 0x7efd7fff
entry_point = 0x0
region_type = private
name = "private_0x000000007efd5000"
filename = ""
Region:
id = 587
start_va = 0x752d0000
end_va = 0x7534ffff
entry_point = 0x752d0000
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")
Region:
id = 590
start_va = 0x960000
end_va = 0x9affff
entry_point = 0x0
region_type = private
name = "private_0x0000000000960000"
filename = ""
Region:
id = 592
start_va = 0x4490000
end_va = 0x456efff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004490000"
filename = ""
Region:
id = 621
start_va = 0x280000
end_va = 0x282fff
entry_point = 0x280000
region_type = mapped_file
name = "l_intl.nls"
filename = "\\Windows\\SysWOW64\\l_intl.nls" (normalized: "c:\\windows\\syswow64\\l_intl.nls")
Region:
id = 622
start_va = 0x290000
end_va = 0x290fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000290000"
filename = ""
Region:
id = 623
start_va = 0x730d0000
end_va = 0x7386bfff
entry_point = 0x730d0000
region_type = mapped_file
name = "system.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\9e0a3b9b9f457233a335d7fba8f95419\\system.ni.dll")
Region:
id = 624
start_va = 0x75420000
end_va = 0x755bafff
entry_point = 0x75420000
region_type = mapped_file
name = "microsoft.visualbasic.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualBas#\\08d608378aa405adc844f3cf36974b8c\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualbas#\\08d608378aa405adc844f3cf36974b8c\\microsoft.visualbasic.ni.dll")
Region:
id = 625
start_va = 0x755c0000
end_va = 0x7561afff
entry_point = 0x755c0000
region_type = mapped_file
name = "mscorjit.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll")
Region:
id = 626
start_va = 0x3a0000
end_va = 0x3affff
entry_point = 0x0
region_type = private
name = "private_0x00000000003a0000"
filename = ""
Region:
id = 627
start_va = 0x3b0000
end_va = 0x3bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000003b0000"
filename = ""
Region:
id = 628
start_va = 0x724f0000
end_va = 0x730cdfff
entry_point = 0x724f0000
region_type = mapped_file
name = "system.windows.forms.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.forms\\3afcd5168c7a6cb02eab99d7fd71e102\\system.windows.forms.ni.dll")
Region:
id = 629
start_va = 0x74b10000
end_va = 0x74c97fff
entry_point = 0x74b10000
region_type = mapped_file
name = "system.drawing.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\system.drawing.ni.dll")
Region:
id = 630
start_va = 0x3c0000
end_va = 0x3cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000003c0000"
filename = ""
Region:
id = 641
start_va = 0x71b50000
end_va = 0x7201dfff
entry_point = 0x71b50000
region_type = mapped_file
name = "system.windows.forms.dll"
filename = "\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.windows.forms\\2.0.0.0__b77a5c561934e089\\system.windows.forms.dll")
Region:
id = 642
start_va = 0x74a40000
end_va = 0x74b00fff
entry_point = 0x74a40000
region_type = mapped_file
name = "system.runtime.remoting.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\System.Runtime.Remoting.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.runtime.remo#\\5cae93d923c8378370758489e5535820\\system.runtime.remoting.ni.dll")
Region:
id = 643
start_va = 0x3d0000
end_va = 0x3d1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000003d0000"
filename = ""
Region:
id = 649
start_va = 0x7ef50000
end_va = 0x7ef5ffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ef50000"
filename = ""
Region:
id = 650
start_va = 0x7ef60000
end_va = 0x7efaffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ef60000"
filename = ""
Region:
id = 651
start_va = 0x670000
end_va = 0x674fff
entry_point = 0x670000
region_type = mapped_file
name = "sorttbls.nlp"
filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp")
Region:
id = 652
start_va = 0x9b0000
end_va = 0x9f0fff
entry_point = 0x9b0000
region_type = mapped_file
name = "sortkey.nlp"
filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp")
Region:
id = 653
start_va = 0x680000
end_va = 0x680fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000680000"
filename = ""
Region:
id = 654
start_va = 0x60340000
end_va = 0x60347fff
entry_point = 0x60340000
region_type = mapped_file
name = "culture.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\culture.dll")
Region:
id = 655
start_va = 0x8f0000
end_va = 0x90ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000008f0000"
filename = ""
Region:
id = 656
start_va = 0xa60000
end_va = 0xab3fff
entry_point = 0xa60000
region_type = mapped_file
name = "mscorrc.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorrc.dll")
Region:
id = 657
start_va = 0x748b0000
end_va = 0x74a3ffff
entry_point = 0x748b0000
region_type = mapped_file
name = "gdiplus.dll"
filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll")
Region:
id = 658
start_va = 0x680000
end_va = 0x68ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000680000"
filename = ""
Region:
id = 659
start_va = 0x6a0000
end_va = 0x6affff
entry_point = 0x0
region_type = private
name = "private_0x00000000006a0000"
filename = ""
Region:
id = 660
start_va = 0x4640000
end_va = 0x467ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004640000"
filename = ""
Region:
id = 661
start_va = 0x47c0000
end_va = 0x48bffff
entry_point = 0x0
region_type = private
name = "private_0x00000000047c0000"
filename = ""
Region:
id = 662
start_va = 0x747b0000
end_va = 0x748aafff
entry_point = 0x747b0000
region_type = mapped_file
name = "windowscodecs.dll"
filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll")
Region:
id = 663
start_va = 0x7ef4d000
end_va = 0x7ef4ffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ef4d000"
filename = ""
Region:
id = 664
start_va = 0x910000
end_va = 0x910fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000910000"
filename = ""
Region:
id = 665
start_va = 0x960000
end_va = 0x960fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000960000"
filename = ""
Region:
id = 666
start_va = 0x970000
end_va = 0x9affff
entry_point = 0x0
region_type = private
name = "private_0x0000000000970000"
filename = ""
Region:
id = 667
start_va = 0x48c0000
end_va = 0x4abefff
entry_point = 0x0
region_type = private
name = "private_0x00000000048c0000"
filename = ""
Region:
id = 668
start_va = 0xb10000
end_va = 0xb2afff
entry_point = 0xb10000
region_type = mapped_file
name = "gdipfontcachev1.dat"
filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat")
Region:
id = 669
start_va = 0x4680000
end_va = 0x477ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004680000"
filename = ""
Region:
id = 670
start_va = 0x4570000
end_va = 0x461afff
entry_point = 0x4570000
region_type = mapped_file
name = "tahoma.ttf"
filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf")
Region:
id = 671
start_va = 0x4570000
end_va = 0x461afff
entry_point = 0x4570000
region_type = mapped_file
name = "tahoma.ttf"
filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf")
Region:
id = 672
start_va = 0x4ac0000
end_va = 0x5f68fff
entry_point = 0x4ac0000
region_type = mapped_file
name = "msjh.ttf"
filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf")
Region:
id = 673
start_va = 0x4ac0000
end_va = 0x5f68fff
entry_point = 0x4ac0000
region_type = mapped_file
name = "msjh.ttf"
filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf")
Region:
id = 674
start_va = 0x4ac0000
end_va = 0x5f82fff
entry_point = 0x4ac0000
region_type = mapped_file
name = "msyh.ttf"
filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf")
Region:
id = 675
start_va = 0x4ac0000
end_va = 0x5f82fff
entry_point = 0x4ac0000
region_type = mapped_file
name = "msyh.ttf"
filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf")
Region:
id = 676
start_va = 0x4ac0000
end_va = 0x4ee2fff
entry_point = 0x4ac0000
region_type = mapped_file
name = "malgun.ttf"
filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf")
Region:
id = 677
start_va = 0x4ac0000
end_va = 0x4ee2fff
entry_point = 0x4ac0000
region_type = mapped_file
name = "malgun.ttf"
filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf")
Region:
id = 678
start_va = 0x4570000
end_va = 0x460ffff
entry_point = 0x4570000
region_type = mapped_file
name = "micross.ttf"
filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf")
Region:
id = 679
start_va = 0x4570000
end_va = 0x460ffff
entry_point = 0x4570000
region_type = mapped_file
name = "micross.ttf"
filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf")
Region:
id = 680
start_va = 0x4570000
end_va = 0x45eefff
entry_point = 0x4570000
region_type = mapped_file
name = "segoeui.ttf"
filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf")
Region:
id = 681
start_va = 0x4570000
end_va = 0x45eefff
entry_point = 0x4570000
region_type = mapped_file
name = "segoeui.ttf"
filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf")
Region:
id = 682
start_va = 0x4ac0000
end_va = 0x4cbffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004ac0000"
filename = ""
Region:
id = 683
start_va = 0xa00000
end_va = 0xa0ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000a00000"
filename = ""
Region:
id = 684
start_va = 0xb10000
end_va = 0xb4ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000b10000"
filename = ""
Region:
id = 685
start_va = 0x752b0000
end_va = 0x752c2fff
entry_point = 0x752b0000
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")
Region:
id = 686
start_va = 0x747a0000
end_va = 0x747a4fff
entry_point = 0x747a0000
region_type = mapped_file
name = "shfolder.dll"
filename = "\\Windows\\SysWOW64\\shfolder.dll" (normalized: "c:\\windows\\syswow64\\shfolder.dll")
Region:
id = 687
start_va = 0x74780000
end_va = 0x74796fff
entry_point = 0x74780000
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")
Region:
id = 688
start_va = 0x74ce0000
end_va = 0x74cf5fff
entry_point = 0x74ce0000
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")
Region:
id = 689
start_va = 0x4570000
end_va = 0x45abfff
entry_point = 0x4570000
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 690
start_va = 0x4570000
end_va = 0x45abfff
entry_point = 0x4570000
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 691
start_va = 0x4570000
end_va = 0x45abfff
entry_point = 0x4570000
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 692
start_va = 0x4570000
end_va = 0x45abfff
entry_point = 0x4570000
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 693
start_va = 0x4570000
end_va = 0x45abfff
entry_point = 0x4570000
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 694
start_va = 0x74ca0000
end_va = 0x74cdafff
entry_point = 0x74ca0000
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 695
start_va = 0x764e0000
end_va = 0x7656efff
entry_point = 0x764e0000
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 696
start_va = 0x4570000
end_va = 0x45effff
entry_point = 0x0
region_type = private
name = "private_0x0000000004570000"
filename = ""
Region:
id = 697
start_va = 0xac0000
end_va = 0xac0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000ac0000"
filename = ""
Region:
id = 698
start_va = 0x76890000
end_va = 0x76912fff
entry_point = 0x76890000
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")
Region:
id = 699
start_va = 0xc50000
end_va = 0xc50fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000c50000"
filename = ""
Region:
id = 700
start_va = 0x74740000
end_va = 0x74772fff
entry_point = 0x74740000
region_type = mapped_file
name = "windowscodecsext.dll"
filename = "\\Windows\\SysWOW64\\WindowsCodecsExt.dll" (normalized: "c:\\windows\\syswow64\\windowscodecsext.dll")
Region:
id = 701
start_va = 0x72390000
end_va = 0x724e7fff
entry_point = 0x72390000
region_type = mapped_file
name = "msxml6.dll"
filename = "\\Windows\\SysWOW64\\msxml6.dll" (normalized: "c:\\windows\\syswow64\\msxml6.dll")
Region:
id = 702
start_va = 0x4cc0000
end_va = 0x4d2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004cc0000"
filename = ""
Region:
id = 703
start_va = 0x4d30000
end_va = 0x4ddffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004d30000"
filename = ""
Region:
id = 704
start_va = 0x4de0000
end_va = 0x4e9ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004de0000"
filename = ""
Region:
id = 705
start_va = 0x4ea0000
end_va = 0x4f8ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004ea0000"
filename = ""
Region:
id = 706
start_va = 0x4f90000
end_va = 0x50affff
entry_point = 0x0
region_type = private
name = "private_0x0000000004f90000"
filename = ""
Region:
id = 707
start_va = 0xc60000
end_va = 0xc66fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000c60000"
filename = ""
Region:
id = 708
start_va = 0xc70000
end_va = 0xc71fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000c70000"
filename = ""
Region:
id = 709
start_va = 0x4f90000
end_va = 0x504ffff
entry_point = 0x4f90000
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")
Region:
id = 710
start_va = 0x5070000
end_va = 0x50affff
entry_point = 0x0
region_type = private
name = "private_0x0000000005070000"
filename = ""
Region:
id = 711
start_va = 0x50b0000
end_va = 0x54affff
entry_point = 0x0
region_type = private
name = "private_0x00000000050b0000"
filename = ""
Region:
id = 712
start_va = 0x20a0000
end_va = 0x20a0fff
entry_point = 0x20a0000
region_type = mapped_file
name = "msxml6r.dll"
filename = "\\Windows\\SysWOW64\\msxml6r.dll" (normalized: "c:\\windows\\syswow64\\msxml6r.dll")
Region:
id = 713
start_va = 0x45f0000
end_va = 0x460ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000045f0000"
filename = ""
Region:
id = 714
start_va = 0x20b0000
end_va = 0x20bffff
entry_point = 0x20b0000
region_type = mapped_file
name = "img.jpg"
filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\img.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\img.jpg")
Region:
id = 715
start_va = 0x74730000
end_va = 0x74735fff
entry_point = 0x74730000
region_type = mapped_file
name = "iconcodecservice.dll"
filename = "\\Windows\\SysWOW64\\IconCodecService.dll" (normalized: "c:\\windows\\syswow64\\iconcodecservice.dll")
Region:
id = 716
start_va = 0x54b0000
end_va = 0x56aefff
entry_point = 0x0
region_type = private
name = "private_0x00000000054b0000"
filename = ""
Region:
id = 717
start_va = 0x56b0000
end_va = 0x58aefff
entry_point = 0x0
region_type = private
name = "private_0x00000000056b0000"
filename = ""
Region:
id = 718
start_va = 0x54b0000
end_va = 0x56aefff
entry_point = 0x0
region_type = private
name = "private_0x00000000054b0000"
filename = ""
Region:
id = 719
start_va = 0x56b0000
end_va = 0x5a85fff
entry_point = 0x0
region_type = private
name = "private_0x00000000056b0000"
filename = ""
Region:
id = 720
start_va = 0x5a90000
end_va = 0x5e66fff
entry_point = 0x0
region_type = private
name = "private_0x0000000005a90000"
filename = ""
Region:
id = 721
start_va = 0x746d0000
end_va = 0x7472efff
entry_point = 0x746d0000
region_type = mapped_file
name = "sxs.dll"
filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")
Region:
id = 722
start_va = 0x72260000
end_va = 0x72389fff
entry_point = 0x72260000
region_type = mapped_file
name = "sapi.dll"
filename = "\\Windows\\SysWOW64\\Speech\\Common\\sapi.dll" (normalized: "c:\\windows\\syswow64\\speech\\common\\sapi.dll")
Region:
id = 723
start_va = 0x74690000
end_va = 0x746c1fff
entry_point = 0x74690000
region_type = mapped_file
name = "winmm.dll"
filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll")
Region:
id = 724
start_va = 0x74670000
end_va = 0x74683fff
entry_point = 0x74670000
region_type = mapped_file
name = "msacm32.dll"
filename = "\\Windows\\SysWOW64\\msacm32.dll" (normalized: "c:\\windows\\syswow64\\msacm32.dll")
Region:
id = 725
start_va = 0x74660000
end_va = 0x7466afff
entry_point = 0x74660000
region_type = mapped_file
name = "msdmo.dll"
filename = "\\Windows\\SysWOW64\\msdmo.dll" (normalized: "c:\\windows\\syswow64\\msdmo.dll")
Region:
id = 726
start_va = 0x54b0000
end_va = 0x566ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000054b0000"
filename = ""
Region:
id = 727
start_va = 0x74620000
end_va = 0x74658fff
entry_point = 0x74620000
region_type = mapped_file
name = "mmdevapi.dll"
filename = "\\Windows\\SysWOW64\\MMDevAPI.dll" (normalized: "c:\\windows\\syswow64\\mmdevapi.dll")
Region:
id = 728
start_va = 0x72160000
end_va = 0x72254fff
entry_point = 0x72160000
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")
Region:
id = 729
start_va = 0x75c30000
end_va = 0x75dccfff
entry_point = 0x75c30000
region_type = mapped_file
name = "setupapi.dll"
filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll")
Region:
id = 730
start_va = 0x75c00000
end_va = 0x75c26fff
entry_point = 0x75c00000
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")
Region:
id = 731
start_va = 0x76870000
end_va = 0x76881fff
entry_point = 0x76870000
region_type = mapped_file
name = "devobj.dll"
filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll")
Region:
id = 732
start_va = 0x5670000
end_va = 0x5a62fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000005670000"
filename = ""
Region:
id = 733
start_va = 0x4df0000
end_va = 0x4e2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004df0000"
filename = ""
Region:
id = 734
start_va = 0x4e60000
end_va = 0x4e9ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004e60000"
filename = ""
Region:
id = 735
start_va = 0x4f10000
end_va = 0x4f4ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004f10000"
filename = ""
Region:
id = 736
start_va = 0x4f50000
end_va = 0x4f8ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004f50000"
filename = ""
Region:
id = 737
start_va = 0x54b0000
end_va = 0x55affff
entry_point = 0x0
region_type = private
name = "private_0x00000000054b0000"
filename = ""
Region:
id = 738
start_va = 0x5660000
end_va = 0x566ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005660000"
filename = ""
Region:
id = 739
start_va = 0x5a90000
end_va = 0x5b8ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005a90000"
filename = ""
Region:
id = 740
start_va = 0x5be0000
end_va = 0x5c1ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005be0000"
filename = ""
Region:
id = 741
start_va = 0x5c50000
end_va = 0x5d4ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005c50000"
filename = ""
Region:
id = 742
start_va = 0x5d90000
end_va = 0x5dcffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005d90000"
filename = ""
Region:
id = 743
start_va = 0x5f50000
end_va = 0x604ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005f50000"
filename = ""
Region:
id = 744
start_va = 0x60e0000
end_va = 0x61dffff
entry_point = 0x0
region_type = private
name = "private_0x00000000060e0000"
filename = ""
Region:
id = 745
start_va = 0x743f0000
end_va = 0x74417fff
entry_point = 0x743f0000
region_type = mapped_file
name = "msttsengine.dll"
filename = "\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll")
Region:
id = 746
start_va = 0x7ef41000
end_va = 0x7ef43fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ef41000"
filename = ""
Region:
id = 747
start_va = 0x7ef44000
end_va = 0x7ef46fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ef44000"
filename = ""
Region:
id = 748
start_va = 0x7ef47000
end_va = 0x7ef49fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ef47000"
filename = ""
Region:
id = 749
start_va = 0x7ef4a000
end_va = 0x7ef4cfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ef4a000"
filename = ""
Region:
id = 750
start_va = 0x55e0000
end_va = 0x561ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000055e0000"
filename = ""
Region:
id = 751
start_va = 0x6310000
end_va = 0x640ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000006310000"
filename = ""
Region:
id = 752
start_va = 0x743a0000
end_va = 0x743e5fff
entry_point = 0x743a0000
region_type = mapped_file
name = "msttsfrontendenu.dll"
filename = "\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll")
Region:
id = 753
start_va = 0x7ef3e000
end_va = 0x7ef40fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ef3e000"
filename = ""
Region:
id = 754
start_va = 0x74610000
end_va = 0x7461afff
entry_point = 0x74610000
region_type = mapped_file
name = "msttscommon.dll"
filename = "\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll")
Region:
id = 755
start_va = 0x6410000
end_va = 0x6661fff
entry_point = 0x6410000
region_type = mapped_file
name = "m1033dsk.tts"
filename = "\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.TTS" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.tts")
Region:
id = 756
start_va = 0x72130000
end_va = 0x72150fff
entry_point = 0x72130000
region_type = mapped_file
name = "ntmarta.dll"
filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")
Region:
id = 757
start_va = 0x77940000
end_va = 0x77984fff
entry_point = 0x77940000
region_type = mapped_file
name = "wldap32.dll"
filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll")
Region:
id = 758
start_va = 0x6670000
end_va = 0x6a6ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000006670000"
filename = ""
Region:
id = 759
start_va = 0x5dd0000
end_va = 0x5ecffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005dd0000"
filename = ""
Region:
id = 760
start_va = 0x6a70000
end_va = 0x6d78fff
entry_point = 0x0
region_type = private
name = "private_0x0000000006a70000"
filename = ""
Region:
id = 761
start_va = 0x6d80000
end_va = 0x6f7ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000006d80000"
filename = ""
Region:
id = 762
start_va = 0x75410000
end_va = 0x7541dfff
entry_point = 0x75410000
region_type = mapped_file
name = "rpcrtremote.dll"
filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")
Region:
id = 763
start_va = 0x4d40000
end_va = 0x4d7ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004d40000"
filename = ""
Region:
id = 764
start_va = 0x4da0000
end_va = 0x4ddffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004da0000"
filename = ""
Region:
id = 765
start_va = 0x7120000
end_va = 0x721ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000007120000"
filename = ""
Region:
id = 766
start_va = 0x7ef3b000
end_va = 0x7ef3dfff
entry_point = 0x0
region_type = private
name = "private_0x000000007ef3b000"
filename = ""
Region:
id = 767
start_va = 0x20b0000
end_va = 0x20bafff
entry_point = 0x20b0000
region_type = mapped_file
name = "msttsdecwrp.dll"
filename = "\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSDecWrp.dll" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\msttsdecwrp.dll")
Region:
id = 768
start_va = 0x4610000
end_va = 0x4613fff
entry_point = 0x4610000
region_type = mapped_file
name = "stdole2.tlb"
filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")
Region:
id = 849
start_va = 0x4780000
end_va = 0x47b8fff
entry_point = 0x4780000
region_type = mapped_file
name = "sapi.dll"
filename = "\\Windows\\SysWOW64\\Speech\\Common\\sapi.dll" (normalized: "c:\\windows\\syswow64\\speech\\common\\sapi.dll")
Region:
id = 850
start_va = 0x20b0000
end_va = 0x20b3fff
entry_point = 0x20b0000
region_type = mapped_file
name = "stdole2.tlb"
filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")
Region:
id = 851
start_va = 0x4610000
end_va = 0x4610fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004610000"
filename = ""
Region:
id = 852
start_va = 0x71fe0000
end_va = 0x7200ffff
entry_point = 0x71fe0000
region_type = mapped_file
name = "wdmaud.drv"
filename = "\\Windows\\SysWOW64\\wdmaud.drv" (normalized: "c:\\windows\\syswow64\\wdmaud.drv")
Region:
id = 853
start_va = 0x74380000
end_va = 0x74383fff
entry_point = 0x74380000
region_type = mapped_file
name = "ksuser.dll"
filename = "\\Windows\\SysWOW64\\ksuser.dll" (normalized: "c:\\windows\\syswow64\\ksuser.dll")
Region:
id = 854
start_va = 0x74390000
end_va = 0x74396fff
entry_point = 0x74390000
region_type = mapped_file
name = "avrt.dll"
filename = "\\Windows\\SysWOW64\\avrt.dll" (normalized: "c:\\windows\\syswow64\\avrt.dll")
Region:
id = 855
start_va = 0x4620000
end_va = 0x4620fff
entry_point = 0x4620000
region_type = mapped_file
name = "wdmaud.drv.mui"
filename = "\\Windows\\SysWOW64\\en-US\\wdmaud.drv.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wdmaud.drv.mui")
Region:
id = 856
start_va = 0x4630000
end_va = 0x4630fff
entry_point = 0x4630000
region_type = mapped_file
name = "mmdevapi.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\MMDevAPI.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mmdevapi.dll.mui")
Region:
id = 857
start_va = 0x71fa0000
end_va = 0x71fd5fff
entry_point = 0x71fa0000
region_type = mapped_file
name = "audioses.dll"
filename = "\\Windows\\SysWOW64\\AudioSes.dll" (normalized: "c:\\windows\\syswow64\\audioses.dll")
Region:
id = 858
start_va = 0x4cc0000
end_va = 0x4cc1fff
entry_point = 0x0
region_type = private
name = "private_0x0000000004cc0000"
filename = ""
Region:
id = 859
start_va = 0x4cf0000
end_va = 0x4d2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004cf0000"
filename = ""
Region:
id = 860
start_va = 0x7220000
end_va = 0x7621fff
entry_point = 0x0
region_type = private
name = "private_0x0000000007220000"
filename = ""
Region:
id = 861
start_va = 0x71f90000
end_va = 0x71f97fff
entry_point = 0x71f90000
region_type = mapped_file
name = "msacm32.drv"
filename = "\\Windows\\SysWOW64\\msacm32.drv" (normalized: "c:\\windows\\syswow64\\msacm32.drv")
Region:
id = 862
start_va = 0x71f80000
end_va = 0x71f86fff
entry_point = 0x71f80000
region_type = mapped_file
name = "midimap.dll"
filename = "\\Windows\\SysWOW64\\midimap.dll" (normalized: "c:\\windows\\syswow64\\midimap.dll")
Region:
id = 863
start_va = 0x71f70000
end_va = 0x71f7cfff
entry_point = 0x71f70000
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll")
Region:
id = 864
start_va = 0x5f10000
end_va = 0x5f4ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005f10000"
filename = ""
Region:
id = 865
start_va = 0x7720000
end_va = 0x781ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000007720000"
filename = ""
Region:
id = 866
start_va = 0x71f40000
end_va = 0x71f68fff
entry_point = 0x71f40000
region_type = mapped_file
name = "winsta.dll"
filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll")
Region:
id = 867
start_va = 0x7ef38000
end_va = 0x7ef3afff
entry_point = 0x0
region_type = private
name = "private_0x000000007ef38000"
filename = ""
Region:
id = 868
start_va = 0x4cd0000
end_va = 0x4cd0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004cd0000"
filename = ""
Region:
id = 869
start_va = 0x4ce0000
end_va = 0x4ce0fff
entry_point = 0x0
region_type = private
name = "private_0x0000000004ce0000"
filename = ""
Region:
id = 870
start_va = 0x5ed0000
end_va = 0x5f0ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000005ed0000"
filename = ""
Region:
id = 871
start_va = 0x78d0000
end_va = 0x79cffff
entry_point = 0x0
region_type = private
name = "private_0x00000000078d0000"
filename = ""
Region:
id = 872
start_va = 0x7ef35000
end_va = 0x7ef37fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ef35000"
filename = ""
Region:
id = 873
start_va = 0x4d30000
end_va = 0x4d35fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004d30000"
filename = ""
Region:
id = 874
start_va = 0x61e0000
end_va = 0x62dffff
entry_point = 0x0
region_type = private
name = "private_0x00000000061e0000"
filename = ""
Region:
id = 875
start_va = 0x7040000
end_va = 0x707ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000007040000"
filename = ""
Region:
id = 876
start_va = 0x7b50000
end_va = 0x7c4ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000007b50000"
filename = ""
Region:
id = 877
start_va = 0x7ef32000
end_va = 0x7ef34fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ef32000"
filename = ""
Region:
id = 878
start_va = 0x7c50000
end_va = 0x804ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000007c50000"
filename = ""
Region:
id = 879
start_va = 0x4d30000
end_va = 0x4d35fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004d30000"
filename = ""
Region:
id = 880
start_va = 0x4ec0000
end_va = 0x4efffff
entry_point = 0x0
region_type = private
name = "private_0x0000000004ec0000"
filename = ""
Region:
id = 881
start_va = 0x7940000
end_va = 0x7a3ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000007940000"
filename = ""
Region:
id = 882
start_va = 0x7ef35000
end_va = 0x7ef37fff
entry_point = 0x0
region_type = private
name = "private_0x000000007ef35000"
filename = ""
Thread:
id = 10
os_tid = 0xa50
[0071.486] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0
[0072.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", nBufferLength=0x105, lpBuffer=0x39ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", lpFilePart=0x0) returned 0x3a
[0072.006] GetLastError () returned 0x2
[0072.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", nBufferLength=0x105, lpBuffer=0x39ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", lpFilePart=0x0) returned 0x3a
[0072.013] GetLastError () returned 0x2
[0072.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x39ebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c
[0072.038] GetLastError () returned 0x2
[0072.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x39ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c
[0072.068] GetLastError () returned 0x2
[0072.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x39ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c
[0072.068] GetLastError () returned 0x2
[0072.128] GetVersionExW (in: lpVersionInformation=0x420c78*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x420c78*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0072.128] GetLastError () returned 0x2
[0072.130] GetVersionExW (in: lpVersionInformation=0x420c78*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x420c78*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0072.130] GetLastError () returned 0x2
[0075.186] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc13e
[0075.186] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc140
[0075.497] GetVersionExW (in: lpVersionInformation=0x42ee90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x42ee90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0075.497] GetLastError () returned 0x2
[0075.500] GetCurrentProcess () returned 0xffffffff
[0075.500] GetLastError () returned 0x3f0
[0075.503] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39ed70 | out: TokenHandle=0x39ed70*=0x194) returned 1
[0075.503] GetLastError () returned 0x3f0
[0075.558] GetCurrentProcess () returned 0xffffffff
[0075.558] GetCurrentThread () returned 0xfffffffe
[0075.558] GetCurrentProcess () returned 0xffffffff
[0075.560] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x39edf8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x39edf8*=0x198) returned 1
[0075.560] GetLastError () returned 0x3f0
[0075.562] GetCurrentThreadId () returned 0xa50
[0075.565] GetSystemMetrics (nIndex=75) returned 1
[0075.890] lstrlenW (lpString="䅁") returned 1
[0075.899] GetModuleHandleW (lpModuleName="user32.dll") returned 0x763e0000
[0075.900] GetProcAddress (hModule=0x763e0000, lpProcName="DefWindowProcW") returned 0x77e625dd
[0075.901] GetStockObject (i=5) returned 0x1900015
[0075.901] GetLastError () returned 0x3f0
[0075.942] GetModuleHandleW (lpModuleName=0x0) returned 0xc80000
[0075.965] CoTaskMemAlloc (cb=0x4c) returned 0x41d200
[0075.965] RegisterClassW (lpWndClass=0x42ee90) returned 0xc141
[0075.966] GetLastError () returned 0x2
[0075.966] CoTaskMemFree (pv=0x41d200)
[0075.966] GetModuleHandleW (lpModuleName=0x0) returned 0xc80000
[0075.967] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0xc80000, lpParam=0x0) returned 0x201d4
[0075.968] SetWindowLongW (hWnd=0x201d4, nIndex=-4, dwNewLong=2011571677) returned 9570634
[0075.969] GetWindowLongW (hWnd=0x201d4, nIndex=-4) returned 2011571677
[0075.972] lstrlenW (lpString="䅁") returned 1
[0075.973] GetVersionExW (in: lpVersionInformation=0x42eeb0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x42eeb0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0075.973] GetLastError () returned 0x2
[0075.975] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x39e4ec | out: phkResult=0x39e4ec*=0x19c) returned 0x0
[0075.977] RegQueryValueExW (in: hKey=0x19c, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x39e534, lpData=0x0, lpcbData=0x39e530*=0x0 | out: lpType=0x39e534*=0x0, lpData=0x0, lpcbData=0x39e530*=0x0) returned 0x2
[0075.977] RegQueryValueExW (in: hKey=0x19c, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x39e534, lpData=0x0, lpcbData=0x39e530*=0x0 | out: lpType=0x39e534*=0x0, lpData=0x0, lpcbData=0x39e530*=0x0) returned 0x2
[0075.977] RegCloseKey (hKey=0x19c) returned 0x0
[0075.980] SetWindowLongW (hWnd=0x201d4, nIndex=-4, dwNewLong=9570954) returned 2011571677
[0075.980] GetWindowLongW (hWnd=0x201d4, nIndex=-4) returned 9570954
[0075.980] GetWindowLongW (hWnd=0x201d4, nIndex=-16) returned 113311744
[0075.982] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc137
[0075.982] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x201d4, Msg=0x24, wParam=0x0, lParam=0x39e7c8) returned 0x0
[0075.983] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc138
[0075.983] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x201d4, Msg=0x81, wParam=0x0, lParam=0x39e7bc) returned 0x1
[0075.983] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x201d4, Msg=0x83, wParam=0x0, lParam=0x39e7a8) returned 0x0
[0075.983] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x201d4, Msg=0x1, wParam=0x0, lParam=0x39e7bc) returned 0x0
[0075.984] GetClientRect (in: hWnd=0x201d4, lpRect=0x39e538 | out: lpRect=0x39e538) returned 1
[0075.984] GetWindowRect (in: hWnd=0x201d4, lpRect=0x39e538 | out: lpRect=0x39e538) returned 1
[0075.985] GetLastError () returned 0x7f
[0075.986] GetParent (hWnd=0x201d4) returned 0x0
[0077.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x39ed18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x64
[0077.607] GetLastError () returned 0x7f
[0077.686] IsAppThemed () returned 0x1
[0077.688] CoTaskMemAlloc (cb=0xca) returned 0x421338
[0077.688] CreateActCtxA (pActCtx=0x42ee78) returned 0x43b7cc
[0077.698] CoTaskMemFree (pv=0x421338)
[0078.269] _finite (_X=0x0) returned 1
[0078.559] AdjustWindowRectEx (in: lpRect=0x39ecec, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x39ecec) returned 1
[0078.573] GetUserNameW (in: lpBuffer=0x42ee78, pcbBuffer=0x39ed54 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x39ed54) returned 1
[0078.576] GetComputerNameW (in: lpBuffer=0x42ee78, nSize=0x39ed54 | out: lpBuffer="XDUWTFONO", nSize=0x39ed54) returned 1
[0079.796] AdjustWindowRectEx (in: lpRect=0x39ed10, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x39ed10) returned 1
[0079.932] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.config", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.config", lpFilePart=0x0) returned 0x3d
[0079.932] GetLastError () returned 0x0
[0079.932] SetErrorMode (uMode=0x1) returned 0x0
[0079.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temprunsom.config"), fInfoLevelId=0x0, lpFileInformation=0x39ebf8 | out: lpFileInformation=0x39ebf8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0079.934] GetLastError () returned 0x2
[0079.934] SetErrorMode (uMode=0x0) returned 0x1
[0080.575] GetCurrentProcessId () returned 0xa4c
[0080.575] GetLastError () returned 0x57
[0080.577] FindAtomW (lpString="GDI+Atom_2636_1") returned 0x0
[0080.577] GetLastError () returned 0x2
[0080.578] AddAtomW (lpString="GDI+Atom_2636_1") returned 0xc000
[0080.580] GetLastError () returned 0x2
[0080.730] GdiplusStartup (in: token=0x235b68, input=0x42ee78, output=0x39de30 | out: token=0x235b68, output=0x39de30) returned 0x0
[0080.774] GetLastError () returned 0x0
[0080.786] GdipLoadImageFromStream (stream=0x6a0030, image=0x39e62c) returned 0x0
[0081.170] GetLastError () returned 0x0
[0081.171] GdipImageForceValidation (image=0x682230) returned 0x0
[0081.208] GetLastError () returned 0x0
[0081.209] GdipGetImageType (image=0x682230, type=0x39e628) returned 0x0
[0081.209] GetLastError () returned 0x0
[0081.209] GdipGetImageRawFormat (image=0x682230, format=0x39e594*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0
[0081.209] GetLastError () returned 0x0
[0081.238] AdjustWindowRectEx (in: lpRect=0x39ec8c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x39ec8c) returned 1
[0081.295] GetProcessWindowStation () returned 0x5c
[0081.296] GetUserObjectInformationA (in: hObj=0x5c, nIndex=1, pvInfo=0x24d9948, nLength=0xc, lpnLengthNeeded=0x39eb64 | out: pvInfo=0x24d9948, lpnLengthNeeded=0x39eb64) returned 1
[0081.296] GetLastError () returned 0x0
[0081.299] SetConsoleCtrlHandler (HandlerRoutine=0x92143a, Add=1) returned 1
[0081.299] GetModuleHandleW (lpModuleName=0x0) returned 0xc80000
[0081.300] GetModuleHandleW (lpModuleName=0x0) returned 0xc80000
[0081.304] GetClassInfoW (in: hInstance=0xc80000, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", lpWndClass=0x24d9990 | out: lpWndClass=0x24d9990) returned 0
[0081.306] CoTaskMemAlloc (cb=0x58) returned 0x42d590
[0081.307] RegisterClassW (lpWndClass=0x42ee90) returned 0xc144
[0081.307] GetLastError () returned 0x583
[0081.307] CoTaskMemFree (pv=0x42d590)
[0081.308] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", lpWindowName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xc80000, lpParam=0x0) returned 0x301ca
[0081.309] NtdllDefWindowProc_W () returned 0x1
[0081.310] NtdllDefWindowProc_W () returned 0x0
[0081.310] NtdllDefWindowProc_W () returned 0x0
[0081.310] NtdllDefWindowProc_W () returned 0x0
[0081.310] NtdllDefWindowProc_W () returned 0x0
[0081.310] GetLastError () returned 0x0
[0081.324] GetSysColor (nIndex=10) returned 0xb4b4b4
[0081.324] GetLastError () returned 0x0
[0081.324] GetSysColor (nIndex=2) returned 0xd1b499
[0081.324] GetLastError () returned 0x0
[0081.324] GetSysColor (nIndex=9) returned 0x0
[0081.324] GetLastError () returned 0x0
[0081.324] GetSysColor (nIndex=12) returned 0xababab
[0081.324] GetLastError () returned 0x0
[0081.324] GetSysColor (nIndex=15) returned 0xf0f0f0
[0081.324] GetLastError () returned 0x0
[0081.324] GetSysColor (nIndex=20) returned 0xffffff
[0081.324] GetLastError () returned 0x0
[0081.324] GetSysColor (nIndex=16) returned 0xa0a0a0
[0081.324] GetLastError () returned 0x0
[0081.324] GetSysColor (nIndex=15) returned 0xf0f0f0
[0081.324] GetLastError () returned 0x0
[0081.324] GetSysColor (nIndex=16) returned 0xa0a0a0
[0081.324] GetLastError () returned 0x0
[0081.324] GetSysColor (nIndex=21) returned 0x696969
[0081.324] GetLastError () returned 0x0
[0081.324] GetSysColor (nIndex=22) returned 0xe3e3e3
[0081.324] GetLastError () returned 0x0
[0081.324] GetSysColor (nIndex=20) returned 0xffffff
[0081.324] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=18) returned 0x0
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=1) returned 0x0
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=27) returned 0xead1b9
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=28) returned 0xf2e4d7
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=17) returned 0x6d6d6d
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=13) returned 0xff9933
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=14) returned 0xffffff
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=26) returned 0xcc6600
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=11) returned 0xfcf7f4
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=3) returned 0xdbcdbf
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=19) returned 0x544e43
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=24) returned 0xe1ffff
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=23) returned 0x0
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=4) returned 0xf0f0f0
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=30) returned 0xf0f0f0
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=29) returned 0xff9933
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=7) returned 0x0
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=0) returned 0xc8c8c8
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=5) returned 0xffffff
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=6) returned 0x646464
[0081.325] GetLastError () returned 0x0
[0081.325] GetSysColor (nIndex=8) returned 0x0
[0081.325] GetLastError () returned 0x0
[0081.348] AdjustWindowRectEx (in: lpRect=0x39ec8c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x39ec8c) returned 1
[0081.388] AdjustWindowRectEx (in: lpRect=0x39ecb4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39ecb4) returned 1
[0081.388] GetSystemMetrics (nIndex=59) returned 1460
[0081.388] GetSystemMetrics (nIndex=60) returned 920
[0081.388] GetSystemMetrics (nIndex=34) returned 132
[0081.388] GetSystemMetrics (nIndex=35) returned 38
[0081.417] AdjustWindowRectEx (in: lpRect=0x39ebb8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39ebb8) returned 1
[0081.418] GetCurrentThreadId () returned 0xa50
[0081.418] GetCurrentThreadId () returned 0xa50
[0081.419] GetSystemDefaultLCID () returned 0x409
[0081.419] GetLastError () returned 0x0
[0081.419] GetStockObject (i=17) returned 0x18a0025
[0081.419] GetLastError () returned 0x0
[0081.421] GetObjectW (in: h=0x18a0025, c=92, pv=0x42ee90 | out: pv=0x42ee90) returned 92
[0081.421] GetLastError () returned 0x0
[0081.421] GetDC (hWnd=0x0) returned 0x201082d
[0081.421] GetLastError () returned 0x0
[0081.477] GdipCreateFontFromLogfontW (hdc=0x201082d, logfont=0x42ee90, font=0x39ebfc) returned 0x0
[0081.665] GetLastError () returned 0x0
[0081.666] GdipGetFontUnit (font=0x682f20, unit=0x39ebc0) returned 0x0
[0081.666] GetLastError () returned 0x7f
[0081.667] GdipGetFontSize (font=0x682f20, size=0x39ebc4) returned 0x0
[0081.667] GetLastError () returned 0x7f
[0081.667] GdipGetFontStyle (font=0x682f20, style=0x39ebbc) returned 0x0
[0081.667] GetLastError () returned 0x7f
[0081.667] GdipGetFamily (font=0x682f20, family=0x39ebb8) returned 0x0
[0081.667] GetLastError () returned 0x7f
[0081.667] GdipGetFontSize (font=0x682f20, size=0x24da6d0) returned 0x0
[0081.667] GetLastError () returned 0x7f
[0081.668] ReleaseDC (hWnd=0x0, hDC=0x201082d) returned 1
[0081.668] GetLastError () returned 0x7f
[0081.668] GetDC (hWnd=0x0) returned 0x201082d
[0081.668] GetLastError () returned 0x7f
[0081.668] GdipCreateFromHDC (hdc=0x201082d, graphics=0x39ebf4) returned 0x0
[0081.669] GetLastError () returned 0x7f
[0081.670] GdipGetDpiY (graphics=0x47691f0, dpi=0x24da7d8) returned 0x0
[0081.670] GetLastError () returned 0x7f
[0081.670] GdipGetFontHeight (font=0x682f20, graphics=0x47691f0, height=0x39ebec) returned 0x0
[0081.670] GetLastError () returned 0x7f
[0081.671] GdipGetEmHeight (family=0x469cbc0, style=0, EmHeight=0x39ebf4) returned 0x0
[0081.671] GetLastError () returned 0x7f
[0081.671] GdipGetLineSpacing (family=0x469cbc0, style=0, LineSpacing=0x39ebf4) returned 0x0
[0081.671] GetLastError () returned 0x7f
[0081.672] FindAtomW (lpString="GDI+Atom_2636_1") returned 0xc000
[0081.672] GetLastError () returned 0x7f
[0081.672] GdipDeleteGraphics (graphics=0x47691f0) returned 0x0
[0081.672] GetLastError () returned 0x7f
[0081.672] ReleaseDC (hWnd=0x0, hDC=0x201082d) returned 1
[0081.672] GetLastError () returned 0x7f
[0081.673] GdipCreateFont (fontFamily=0x469cbc0, emSize=0x41040000, style=0, unit=0x3, font=0x24da798) returned 0x0
[0081.673] GetLastError () returned 0x7f
[0081.673] GdipGetFontSize (font=0x4722a10, size=0x24da79c) returned 0x0
[0081.673] GetLastError () returned 0x7f
[0081.673] FindAtomW (lpString="GDI+Atom_2636_1") returned 0xc000
[0081.673] GetLastError () returned 0x7f
[0081.673] GdipDeleteFont (font=0x682f20) returned 0x0
[0081.674] GetLastError () returned 0x7f
[0081.676] AdjustWindowRectEx (in: lpRect=0x39ebd4, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39ebd4) returned 1
[0081.676] AdjustWindowRectEx (in: lpRect=0x39ec8c, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39ec8c) returned 1
[0081.676] GetSystemMetrics (nIndex=59) returned 1460
[0081.676] GetSystemMetrics (nIndex=60) returned 920
[0081.676] AdjustWindowRectEx (in: lpRect=0x39eae0, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39eae0) returned 1
[0081.676] AdjustWindowRectEx (in: lpRect=0x39eb90, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39eb90) returned 1
[0082.297] GetSystemMetrics (nIndex=11) returned 32
[0082.297] GetLastError () returned 0x57
[0082.297] GetSystemMetrics (nIndex=12) returned 32
[0082.297] GetLastError () returned 0x57
[0082.298] GetDC (hWnd=0x0) returned 0x201082d
[0082.298] GetLastError () returned 0x57
[0082.300] GetDeviceCaps (hdc=0x201082d, index=12) returned 32
[0082.300] GetLastError () returned 0x57
[0082.300] GetDeviceCaps (hdc=0x201082d, index=14) returned 1
[0082.300] GetLastError () returned 0x57
[0082.300] ReleaseDC (hWnd=0x0, hDC=0x201082d) returned 1
[0082.300] GetLastError () returned 0x57
[0082.301] CreateIconFromResourceEx (presbits=0x24e15b4, dwResSize=0x2e8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x11019f
[0082.302] GetLastError () returned 0x57
[0082.304] CreateCompatibleDC (hdc=0x0) returned 0x23010828
[0082.305] GetLastError () returned 0x57
[0082.305] GetDC (hWnd=0x0) returned 0x201082d
[0082.305] GetLastError () returned 0x57
[0082.305] GdipCreateFromHDC (hdc=0x201082d, graphics=0x39eb1c) returned 0x0
[0082.305] GetLastError () returned 0x57
[0082.308] GdipGetLogFontW (font=0x4722a10, graphics=0x47691f0, logfontW=0x42ee90) returned 0x0
[0082.308] GetLastError () returned 0x57
[0082.311] FindAtomW (lpString="GDI+Atom_2636_1") returned 0xc000
[0082.311] GetLastError () returned 0x7f
[0082.311] GdipDeleteGraphics (graphics=0x47691f0) returned 0x0
[0082.311] GetLastError () returned 0x7f
[0082.311] ReleaseDC (hWnd=0x0, hDC=0x201082d) returned 1
[0082.312] GetLastError () returned 0x7f
[0082.313] CreateFontIndirectW (lplf=0x42ee90) returned 0xe0a0284
[0082.313] GetLastError () returned 0x7f
[0082.314] SelectObject (hdc=0x23010828, h=0xe0a0284) returned 0x18a002e
[0082.314] GetLastError () returned 0x7f
[0082.346] GetTextMetricsW (in: hdc=0x23010828, lptm=0x39ec08 | out: lptm=0x39ec08) returned 1
[0082.346] GetLastError () returned 0x7f
[0082.350] GetTextExtentPoint32W (in: hdc=0x23010828, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x24e1ba0 | out: psizl=0x24e1ba0) returned 1
[0082.353] GetLastError () returned 0x0
[0082.353] SelectObject (hdc=0x23010828, h=0x18a002e) returned 0xe0a0284
[0082.353] GetLastError () returned 0x0
[0082.355] DeleteDC (hdc=0x23010828) returned 1
[0082.355] GetLastError () returned 0x0
[0082.356] AdjustWindowRectEx (in: lpRect=0x39ea28, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39ea28) returned 1
[0082.356] AdjustWindowRectEx (in: lpRect=0x39eb9c, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39eb9c) returned 1
[0082.356] AdjustWindowRectEx (in: lpRect=0x39e994, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39e994) returned 1
[0082.356] AdjustWindowRectEx (in: lpRect=0x39ea68, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39ea68) returned 1
[0082.358] AdjustWindowRectEx (in: lpRect=0x39eb80, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x39eb80) returned 1
[0082.358] AdjustWindowRectEx (in: lpRect=0x39ea7c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x39ea7c) returned 1
[0082.373] GetCurrentActCtx (in: lphActCtx=0x39f208 | out: lphActCtx=0x39f208*=0x0) returned 1
[0082.375] ActivateActCtx (in: hActCtx=0x43b7cc, lpCookie=0x39f21c | out: hActCtx=0x43b7cc, lpCookie=0x39f21c) returned 1
[0082.375] GetCurrentActCtx (in: lphActCtx=0x39f048 | out: lphActCtx=0x39f048*=0x43b7cc) returned 1
[0082.375] AdjustWindowRectEx (in: lpRect=0x39efbc, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39efbc) returned 1
[0082.376] GetModuleHandleW (lpModuleName=0x0) returned 0xc80000
[0082.376] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName=0x0, dwStyle=0x2010000, X=-2147483648, Y=-2147483648, nWidth=10, nHeight=10, hWndParent=0x0, hMenu=0x0, hInstance=0xc80000, lpParam=0x0) returned 0x301ce
[0082.376] SetWindowLongW (hWnd=0x301ce, nIndex=-4, dwNewLong=2011571677) returned 9570634
[0082.376] GetWindowLongW (hWnd=0x301ce, nIndex=-4) returned 2011571677
[0082.377] SetWindowLongW (hWnd=0x301ce, nIndex=-4, dwNewLong=9573530) returned 2011571677
[0082.377] GetWindowLongW (hWnd=0x301ce, nIndex=-4) returned 9573530
[0082.377] GetWindowLongW (hWnd=0x301ce, nIndex=-16) returned 113311744
[0082.377] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x81, wParam=0x0, lParam=0x39eaac) returned 0x1
[0082.378] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x83, wParam=0x0, lParam=0x39ea98) returned 0x0
[0082.517] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x1, wParam=0x0, lParam=0x39eaac) returned 0x0
[0082.517] GetClientRect (in: hWnd=0x301ce, lpRect=0x39e7f0 | out: lpRect=0x39e7f0) returned 1
[0082.517] GetWindowRect (in: hWnd=0x301ce, lpRect=0x39e7f0 | out: lpRect=0x39e7f0) returned 1
[0082.518] GetWindowTextLengthW (hWnd=0x301ce) returned 0
[0082.518] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0082.518] GetSystemMetrics (nIndex=42) returned 0
[0082.519] GetWindowTextW (in: hWnd=0x301ce, lpString=0x42ee98, nMaxCount=1 | out: lpString="") returned 0
[0082.519] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0xd, wParam=0x1, lParam=0x42ee98) returned 0x0
[0082.520] GetStartupInfoW (in: lpStartupInfo=0x24e1f4c | out: lpStartupInfo=0x24e1f4c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0))
[0082.521] GetLastError () returned 0x0
[0082.521] GetParent (hWnd=0x301ce) returned 0x0
[0082.521] SetWindowLongW (hWnd=0x301ce, nIndex=-8, dwNewLong=0) returned 0
[0082.521] GetSystemMetrics (nIndex=49) returned 16
[0082.521] GetSystemMetrics (nIndex=50) returned 16
[0082.521] CreateIconFromResourceEx (presbits=0x24e1fc4, dwResSize=0x2e8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x700f9
[0082.522] GetLastError () returned 0x578
[0082.523] SendMessageW (hWnd=0x301ce, Msg=0x80, wParam=0x0, lParam=0x700f9) returned 0x0
[0082.523] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x80, wParam=0x0, lParam=0x700f9) returned 0x0
[0082.524] SendMessageW (hWnd=0x301ce, Msg=0x80, wParam=0x1, lParam=0x11019f) returned 0x0
[0082.524] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x80, wParam=0x1, lParam=0x11019f) returned 0x0
[0082.524] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0xd, wParam=0x104, lParam=0x97c5e0) returned 0x0
[0082.525] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0xd, wParam=0x104, lParam=0x97c5e0) returned 0x0
[0082.525] GetSystemMenu (hWnd=0x301ce, bRevert=0) returned 0x0
[0082.526] GetWindowPlacement (in: hWnd=0x301ce, lpwndpl=0x39f058 | out: lpwndpl=0x39f058) returned 1
[0082.527] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1
[0082.527] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1
[0082.527] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1
[0082.527] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1
[0082.527] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1
[0082.527] GetClientRect (in: hWnd=0x301ce, lpRect=0x39f098 | out: lpRect=0x39f098) returned 1
[0082.527] GetClientRect (in: hWnd=0x301ce, lpRect=0x39f04c | out: lpRect=0x39f04c) returned 1
[0082.527] GetWindowRect (in: hWnd=0x301ce, lpRect=0x39f04c | out: lpRect=0x39f04c) returned 1
[0082.527] GetWindowLongW (hWnd=0x301ce, nIndex=-16) returned 113311744
[0082.527] GetWindowLongW (hWnd=0x301ce, nIndex=-16) returned 113311744
[0082.527] GetWindowLongW (hWnd=0x301ce, nIndex=-20) returned 327936
[0082.527] SetWindowLongW (hWnd=0x301ce, nIndex=-16, dwNewLong=33619968) returned 113311744
[0082.527] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x7c, wParam=0xfffffff0, lParam=0x39efcc) returned 0x0
[0082.527] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x7d, wParam=0xfffffff0, lParam=0x39efcc) returned 0x0
[0082.528] SetWindowLongW (hWnd=0x301ce, nIndex=-20, dwNewLong=327680) returned 327680
[0082.528] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x7c, wParam=0xffffffec, lParam=0x39efcc) returned 0x0
[0082.528] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x7d, wParam=0xffffffec, lParam=0x39efcc) returned 0x0
[0082.529] SetWindowPos (hWnd=0x301ce, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1
[0082.529] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x46, wParam=0x0, lParam=0x39f004) returned 0x0
[0082.529] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x83, wParam=0x1, lParam=0x39efdc) returned 0x0
[0082.529] GetWindowPlacement (in: hWnd=0x301ce, lpwndpl=0x39edc4 | out: lpwndpl=0x39edc4) returned 1
[0082.529] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x47, wParam=0x0, lParam=0x39f004) returned 0x0
[0082.529] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x3, wParam=0x0, lParam=0x190019) returned 0x0
[0082.529] GetClientRect (in: hWnd=0x301ce, lpRect=0x39e8b0 | out: lpRect=0x39e8b0) returned 1
[0082.529] GetWindowRect (in: hWnd=0x301ce, lpRect=0x39e8b0 | out: lpRect=0x39e8b0) returned 1
[0082.530] GetWindowTextLengthW (hWnd=0x301ce) returned 0
[0082.530] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0082.530] GetSystemMetrics (nIndex=42) returned 0
[0082.530] GetWindowTextW (in: hWnd=0x301ce, lpString=0x42ee78, nMaxCount=1 | out: lpString="") returned 0
[0082.530] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0xd, wParam=0x1, lParam=0x42ee78) returned 0x0
[0082.530] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x5, wParam=0x0, lParam=0x260084) returned 0x0
[0082.530] GetClientRect (in: hWnd=0x301ce, lpRect=0x39ed60 | out: lpRect=0x39ed60) returned 1
[0082.530] GetWindowRect (in: hWnd=0x301ce, lpRect=0x39ed60 | out: lpRect=0x39ed60) returned 1
[0082.531] RedrawWindow (hWnd=0x301ce, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
[0082.531] GetSystemMenu (hWnd=0x301ce, bRevert=0) returned 0x0
[0082.531] GetWindowPlacement (in: hWnd=0x301ce, lpwndpl=0x39f03c | out: lpwndpl=0x39f03c) returned 1
[0082.531] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1
[0082.531] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1
[0082.531] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1
[0082.531] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1
[0082.531] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1
[0082.532] ShowWindow (hWnd=0x301ce, nCmdShow=5) returned 0
[0082.532] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0082.532] GetCurrentActCtx (in: lphActCtx=0x39ed14 | out: lphActCtx=0x39ed14*=0x43b7cc) returned 1
[0082.532] GetModuleHandleW (lpModuleName=0x0) returned 0xc80000
[0082.532] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName=0x0, dwStyle=0x56000000, X=292, Y=321, nWidth=10, nHeight=10, hWndParent=0x301ce, hMenu=0x0, hInstance=0xc80000, lpParam=0x0) returned 0x301da
[0082.532] SetWindowLongW (hWnd=0x301da, nIndex=-4, dwNewLong=2011571677) returned 9570634
[0082.533] GetWindowLongW (hWnd=0x301da, nIndex=-4) returned 2011571677
[0082.533] SetWindowLongW (hWnd=0x301da, nIndex=-4, dwNewLong=9573578) returned 2011571677
[0082.533] GetWindowLongW (hWnd=0x301da, nIndex=-4) returned 9573578
[0082.533] GetWindowLongW (hWnd=0x301da, nIndex=-16) returned 1174405120
[0082.533] GetWindowLongW (hWnd=0x301da, nIndex=-12) returned 0
[0082.533] SetWindowLongW (hWnd=0x301da, nIndex=-12, dwNewLong=197082) returned 0
[0082.533] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x81, wParam=0x0, lParam=0x39e778) returned 0x1
[0082.533] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x83, wParam=0x0, lParam=0x39e764) returned 0x0
[0082.533] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x1, wParam=0x0, lParam=0x39e778) returned 0x0
[0082.534] GetWindow (hWnd=0x301da, uCmd=0x3) returned 0x0
[0082.534] GetClientRect (in: hWnd=0x301da, lpRect=0x39e4f4 | out: lpRect=0x39e4f4) returned 1
[0082.534] GetWindowRect (in: hWnd=0x301da, lpRect=0x39e4f4 | out: lpRect=0x39e4f4) returned 1
[0082.534] GetParent (hWnd=0x301da) returned 0x301ce
[0082.535] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x301ce, lpPoints=0x39e4f4, cPoints=0x2 | out: lpPoints=0x39e4f4) returned -1572889
[0082.535] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x5, wParam=0x0, lParam=0xa000a) returned 0x0
[0082.535] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x3, wParam=0x0, lParam=0x1410124) returned 0x0
[0082.535] GetClientRect (in: hWnd=0x301da, lpRect=0x39e54c | out: lpRect=0x39e54c) returned 1
[0082.535] GetWindowRect (in: hWnd=0x301da, lpRect=0x39e54c | out: lpRect=0x39e54c) returned 1
[0082.535] GetParent (hWnd=0x301da) returned 0x301ce
[0082.535] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x301ce, lpPoints=0x39e54c, cPoints=0x2 | out: lpPoints=0x39e54c) returned -1572889
[0082.535] SendMessageW (hWnd=0x301da, Msg=0x2210, wParam=0x1da0001, lParam=0x301da) returned 0x0
[0082.535] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x2210, wParam=0x1da0001, lParam=0x301da) returned 0x0
[0082.535] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0082.535] GetLastError () returned 0x0
[0082.535] GetParent (hWnd=0x301da) returned 0x301ce
[0082.536] GetWindowTextLengthW (hWnd=0x301ce) returned 0
[0082.536] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0082.536] GetSystemMetrics (nIndex=42) returned 0
[0082.536] GetWindowTextW (in: hWnd=0x301ce, lpString=0x42ee78, nMaxCount=1 | out: lpString="") returned 0
[0082.536] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0xd, wParam=0x1, lParam=0x42ee78) returned 0x0
[0082.601] GetUserNameW (in: lpBuffer=0x42ee78, pcbBuffer=0x39ed0c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x39ed0c) returned 1
[0082.672] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0
[0082.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27
[0082.673] GetLastError () returned 0x3f0
[0082.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28
[0082.698] GetLastError () returned 0x3f0
[0082.700] SetErrorMode (uMode=0x1) returned 0x0
[0082.703] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c2b0
[0082.703] GetLastError () returned 0x3f0
[0082.704] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.704] GetLastError () returned 0x3f0
[0082.704] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.704] GetLastError () returned 0x3f0
[0082.705] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.705] GetLastError () returned 0x3f0
[0082.705] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.705] GetLastError () returned 0x3f0
[0082.705] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.705] GetLastError () returned 0x3f0
[0082.705] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.705] GetLastError () returned 0x3f0
[0082.705] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.705] GetLastError () returned 0x3f0
[0082.706] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.706] GetLastError () returned 0x3f0
[0082.706] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.706] GetLastError () returned 0x3f0
[0082.706] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.706] GetLastError () returned 0x3f0
[0082.706] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.706] GetLastError () returned 0x3f0
[0082.707] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.707] GetLastError () returned 0x3f0
[0082.707] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.707] GetLastError () returned 0x3f0
[0082.707] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.707] GetLastError () returned 0x3f0
[0082.707] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.707] GetLastError () returned 0x3f0
[0082.707] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.707] GetLastError () returned 0x3f0
[0082.708] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.708] GetLastError () returned 0x3f0
[0082.708] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.708] GetLastError () returned 0x3f0
[0082.708] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.708] GetLastError () returned 0x3f0
[0082.708] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.708] GetLastError () returned 0x3f0
[0082.709] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.709] GetLastError () returned 0x3f0
[0082.709] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.709] GetLastError () returned 0x3f0
[0082.709] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.709] GetLastError () returned 0x3f0
[0082.709] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.709] GetLastError () returned 0x3f0
[0082.709] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.709] GetLastError () returned 0x3f0
[0082.710] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.710] GetLastError () returned 0x3f0
[0082.710] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.710] GetLastError () returned 0x3f0
[0082.710] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.710] GetLastError () returned 0x3f0
[0082.710] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0082.710] GetLastError () returned 0x12
[0082.711] FindClose (in: hFindFile=0x42c2b0 | out: hFindFile=0x42c2b0) returned 1
[0082.711] SetErrorMode (uMode=0x0) returned 0x1
[0082.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28
[0082.711] GetLastError () returned 0x12
[0082.711] SetErrorMode (uMode=0x1) returned 0x0
[0082.711] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c2b0
[0082.711] GetLastError () returned 0x12
[0082.712] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.712] GetLastError () returned 0x12
[0082.712] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.712] GetLastError () returned 0x12
[0082.712] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.712] GetLastError () returned 0x12
[0082.712] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.712] GetLastError () returned 0x12
[0082.712] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.712] GetLastError () returned 0x12
[0082.713] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.713] GetLastError () returned 0x12
[0082.713] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.713] GetLastError () returned 0x12
[0082.713] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.713] GetLastError () returned 0x12
[0082.713] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.713] GetLastError () returned 0x12
[0082.714] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.714] GetLastError () returned 0x12
[0082.714] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.714] GetLastError () returned 0x12
[0082.714] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.714] GetLastError () returned 0x12
[0082.714] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.714] GetLastError () returned 0x12
[0082.714] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.714] GetLastError () returned 0x12
[0082.715] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.715] GetLastError () returned 0x12
[0082.715] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.715] GetLastError () returned 0x12
[0082.715] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.715] GetLastError () returned 0x12
[0082.715] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.715] GetLastError () returned 0x12
[0082.716] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.716] GetLastError () returned 0x12
[0082.716] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.716] GetLastError () returned 0x12
[0082.716] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.716] GetLastError () returned 0x12
[0082.716] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.716] GetLastError () returned 0x12
[0082.717] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.717] GetLastError () returned 0x12
[0082.717] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.717] GetLastError () returned 0x12
[0082.717] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.717] GetLastError () returned 0x12
[0082.717] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.717] GetLastError () returned 0x12
[0082.717] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.717] GetLastError () returned 0x12
[0082.717] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0082.718] GetLastError () returned 0x12
[0082.718] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0082.718] GetLastError () returned 0x12
[0082.718] FindClose (in: hFindFile=0x42c2b0 | out: hFindFile=0x42c2b0) returned 1
[0082.718] SetErrorMode (uMode=0x0) returned 0x1
[0082.858] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx", lpFilePart=0x0) returned 0x31
[0082.858] GetLastError () returned 0x12
[0082.858] SetErrorMode (uMode=0x1) returned 0x0
[0082.860] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0xz6.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204
[0082.860] GetLastError () returned 0x0
[0082.861] GetFileType (hFile=0x204) returned 0x1
[0082.861] SetErrorMode (uMode=0x0) returned 0x1
[0082.861] GetFileType (hFile=0x204) returned 0x1
[0082.863] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0x12db6
[0082.863] GetLastError () returned 0x0
[0082.865] ReadFile (in: hFile=0x204, lpBuffer=0x24e6bb4, nNumberOfBytesToRead=0x12db6, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x24e6bb4*, lpNumberOfBytesRead=0x39ec18*=0x12db6, lpOverlapped=0x0) returned 1
[0082.865] GetLastError () returned 0x0
[0082.866] CloseHandle (hObject=0x204) returned 1
[0082.866] GetLastError () returned 0x0
[0082.894] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x39e6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x43
[0082.894] GetLastError () returned 0xb7
[0082.894] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x43
[0082.894] GetLastError () returned 0xb7
[0082.894] SetErrorMode (uMode=0x1) returned 0x0
[0082.895] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x39eb70 | out: lpFileInformation=0x39eb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf973529, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf973529, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xc2c74ba0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x60ed)) returned 1
[0082.895] GetLastError () returned 0xb7
[0082.895] SetErrorMode (uMode=0x0) returned 0x1
[0082.895] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x43
[0082.895] GetLastError () returned 0xb7
[0082.895] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x39e658, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x43
[0082.896] GetLastError () returned 0xb7
[0083.147] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x39e67c | out: pfEnabled=0x39e67c) returned 0x0
[0083.210] GetVersionExW (in: lpVersionInformation=0x42ee90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x42ee90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
[0083.210] GetLastError () returned 0x0
[0083.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx", lpFilePart=0x0) returned 0x31
[0083.303] GetLastError () returned 0x0
[0083.303] SetErrorMode (uMode=0x1) returned 0x0
[0083.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0xz6.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.304] GetLastError () returned 0xb7
[0083.304] GetFileType (hFile=0x214) returned 0x1
[0083.304] GetFileType (hFile=0x214) returned 0x1
[0083.304] WriteFile (in: hFile=0x214, lpBuffer=0x25cead4*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x39ec24, lpOverlapped=0x0 | out: lpBuffer=0x25cead4*, lpNumberOfBytesWritten=0x39ec24*=0x12dc0, lpOverlapped=0x0) returned 1
[0083.306] GetLastError () returned 0xb7
[0083.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx", lpFilePart=0x0) returned 0x31
[0083.306] GetLastError () returned 0xb7
[0083.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x3d
[0083.306] GetLastError () returned 0xb7
[0083.306] SetErrorMode (uMode=0x1) returned 0x0
[0083.306] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0xz6.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f83a4a0, ftCreationTime.dwHighDateTime=0x1d3fd6d, ftLastAccessTime.dwLowDateTime=0x3680eb00, ftLastAccessTime.dwHighDateTime=0x1d386d9, ftLastWriteTime.dwLowDateTime=0x7d3980, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x12dc0)) returned 1
[0083.306] GetLastError () returned 0xb7
[0083.306] SetErrorMode (uMode=0x0) returned 0x1
[0083.308] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0xz6.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0xz6.docx.lanran2.0.5")) returned 1
[0083.310] GetLastError () returned 0xb7
[0083.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx", lpFilePart=0x0) returned 0x32
[0083.310] GetLastError () returned 0xb7
[0083.310] SetErrorMode (uMode=0x1) returned 0x0
[0083.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5aqvg.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.310] GetLastError () returned 0x0
[0083.310] GetFileType (hFile=0x214) returned 0x1
[0083.310] SetErrorMode (uMode=0x0) returned 0x1
[0083.310] GetFileType (hFile=0x214) returned 0x1
[0083.310] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0xc98c
[0083.310] GetLastError () returned 0x0
[0083.311] ReadFile (in: hFile=0x214, lpBuffer=0x25e212c, nNumberOfBytesToRead=0xc98c, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25e212c*, lpNumberOfBytesRead=0x39ec18*=0xc98c, lpOverlapped=0x0) returned 1
[0083.312] GetLastError () returned 0x0
[0083.312] CloseHandle (hObject=0x214) returned 1
[0083.312] GetLastError () returned 0x0
[0083.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx", lpFilePart=0x0) returned 0x32
[0083.381] GetLastError () returned 0x0
[0083.381] SetErrorMode (uMode=0x1) returned 0x0
[0083.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5aqvg.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.382] GetLastError () returned 0xb7
[0083.382] GetFileType (hFile=0x214) returned 0x1
[0083.382] GetFileType (hFile=0x214) returned 0x1
[0083.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx", lpFilePart=0x0) returned 0x32
[0083.384] GetLastError () returned 0xb7
[0083.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x3e
[0083.384] GetLastError () returned 0xb7
[0083.384] SetErrorMode (uMode=0x1) returned 0x0
[0083.384] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5aqvg.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49536e50, ftCreationTime.dwHighDateTime=0x1d3bf5b, ftLastAccessTime.dwLowDateTime=0xde8c3610, ftLastAccessTime.dwHighDateTime=0x1d3f70e, ftLastWriteTime.dwLowDateTime=0x892060, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xc990)) returned 1
[0083.384] GetLastError () returned 0xb7
[0083.384] SetErrorMode (uMode=0x0) returned 0x1
[0083.384] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5aqvg.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5aqvg.docx.lanran2.0.5")) returned 1
[0083.385] GetLastError () returned 0xb7
[0083.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx", lpFilePart=0x0) returned 0x3f
[0083.385] GetLastError () returned 0xb7
[0083.385] SetErrorMode (uMode=0x1) returned 0x0
[0083.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9xfuxm 1vtcblypynm.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.385] GetLastError () returned 0x0
[0083.385] GetFileType (hFile=0x214) returned 0x1
[0083.385] GetFileType (hFile=0x214) returned 0x1
[0083.514] ReadFile (in: hFile=0x214, lpBuffer=0x24bdcdc, nNumberOfBytesToRead=0xda8e, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x24bdcdc*, lpNumberOfBytesRead=0x39ec18*=0xda8e, lpOverlapped=0x0) returned 1
[0083.515] GetLastError () returned 0x0
[0083.515] CloseHandle (hObject=0x214) returned 1
[0083.515] GetLastError () returned 0x0
[0083.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx", lpFilePart=0x0) returned 0x3f
[0083.577] GetLastError () returned 0x0
[0083.577] SetErrorMode (uMode=0x1) returned 0x0
[0083.577] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9xfuxm 1vtcblypynm.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.578] GetLastError () returned 0xb7
[0083.578] GetFileType (hFile=0x214) returned 0x1
[0083.578] GetFileType (hFile=0x214) returned 0x1
[0083.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx", lpFilePart=0x0) returned 0x3f
[0083.580] GetLastError () returned 0xb7
[0083.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x4b
[0083.580] GetLastError () returned 0xb7
[0083.580] SetErrorMode (uMode=0x1) returned 0x0
[0083.580] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9xfuxm 1vtcblypynm.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2333d360, ftCreationTime.dwHighDateTime=0x1d3bbda, ftLastAccessTime.dwLowDateTime=0xca950830, ftLastAccessTime.dwHighDateTime=0x1d3bd34, ftLastWriteTime.dwLowDateTime=0xa81240, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xda90)) returned 1
[0083.580] GetLastError () returned 0xb7
[0083.580] SetErrorMode (uMode=0x0) returned 0x1
[0083.580] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9xfuxm 1vtcblypynm.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9xfuxm 1vtcblypynm.docx.lanran2.0.5")) returned 1
[0083.581] GetLastError () returned 0xb7
[0083.581] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx", lpFilePart=0x0) returned 0x37
[0083.581] GetLastError () returned 0xb7
[0083.581] SetErrorMode (uMode=0x1) returned 0x0
[0083.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aa_k6kqhwa.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.581] GetLastError () returned 0x0
[0083.581] GetFileType (hFile=0x214) returned 0x1
[0083.581] GetFileType (hFile=0x214) returned 0x1
[0083.581] ReadFile (in: hFile=0x214, lpBuffer=0x257c964, nNumberOfBytesToRead=0x14b8e, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x257c964*, lpNumberOfBytesRead=0x39ec18*=0x14b8e, lpOverlapped=0x0) returned 1
[0083.582] GetLastError () returned 0x0
[0083.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx", lpFilePart=0x0) returned 0x37
[0083.609] GetLastError () returned 0x0
[0083.609] SetErrorMode (uMode=0x1) returned 0x0
[0083.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aa_k6kqhwa.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.612] GetLastError () returned 0xb7
[0083.612] GetFileType (hFile=0x214) returned 0x1
[0083.612] GetFileType (hFile=0x214) returned 0x1
[0083.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx", lpFilePart=0x0) returned 0x37
[0083.614] GetLastError () returned 0xb7
[0083.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx.LanRan2.0.5", lpFilePart=0x0) returned 0x43
[0083.614] GetLastError () returned 0xb7
[0083.614] SetErrorMode (uMode=0x1) returned 0x0
[0083.614] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aa_k6kqhwa.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa447dfe0, ftCreationTime.dwHighDateTime=0x1d3efb1, ftLastAccessTime.dwLowDateTime=0x67ccd2d0, ftLastAccessTime.dwHighDateTime=0x1d3bbce, ftLastWriteTime.dwLowDateTime=0xacd500, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x14b90)) returned 1
[0083.614] GetLastError () returned 0xb7
[0083.614] SetErrorMode (uMode=0x0) returned 0x1
[0083.614] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aa_k6kqhwa.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aa_k6kqhwa.xlsx.lanran2.0.5")) returned 1
[0083.615] GetLastError () returned 0xb7
[0083.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx", lpFilePart=0x0) returned 0x38
[0083.615] GetLastError () returned 0xb7
[0083.615] SetErrorMode (uMode=0x1) returned 0x0
[0083.615] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gspnh93gcri.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.615] GetLastError () returned 0x0
[0083.615] GetFileType (hFile=0x214) returned 0x1
[0083.615] GetFileType (hFile=0x214) returned 0x1
[0083.615] ReadFile (in: hFile=0x214, lpBuffer=0x2657838, nNumberOfBytesToRead=0x13432, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2657838*, lpNumberOfBytesRead=0x39ec18*=0x13432, lpOverlapped=0x0) returned 1
[0083.616] GetLastError () returned 0x0
[0083.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx", lpFilePart=0x0) returned 0x38
[0083.654] GetLastError () returned 0x0
[0083.654] SetErrorMode (uMode=0x1) returned 0x0
[0083.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gspnh93gcri.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.656] GetLastError () returned 0xb7
[0083.656] GetFileType (hFile=0x214) returned 0x1
[0083.656] SetErrorMode (uMode=0x0) returned 0x1
[0083.656] GetFileType (hFile=0x214) returned 0x1
[0083.656] WriteFile (in: hFile=0x214, lpBuffer=0x252c494*, nNumberOfBytesToWrite=0x13440, lpNumberOfBytesWritten=0x39ec24, lpOverlapped=0x0 | out: lpBuffer=0x252c494*, lpNumberOfBytesWritten=0x39ec24*=0x13440, lpOverlapped=0x0) returned 1
[0083.658] GetLastError () returned 0xb7
[0083.658] CloseHandle (hObject=0x214) returned 1
[0083.659] GetLastError () returned 0xb7
[0083.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx", lpFilePart=0x0) returned 0x38
[0083.659] GetLastError () returned 0xb7
[0083.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x44
[0083.659] GetLastError () returned 0xb7
[0083.659] SetErrorMode (uMode=0x1) returned 0x0
[0083.659] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gspnh93gcri.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37f066a0, ftCreationTime.dwHighDateTime=0x1d3d553, ftLastAccessTime.dwLowDateTime=0x862ed00, ftLastAccessTime.dwHighDateTime=0x1d38499, ftLastWriteTime.dwLowDateTime=0xb3f920, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x13440)) returned 1
[0083.659] GetLastError () returned 0xb7
[0083.659] SetErrorMode (uMode=0x0) returned 0x1
[0083.659] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gspnh93gcri.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gspnh93gcri.pptx.lanran2.0.5")) returned 1
[0083.660] GetLastError () returned 0xb7
[0083.660] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx", lpFilePart=0x0) returned 0x40
[0083.660] GetLastError () returned 0xb7
[0083.660] SetErrorMode (uMode=0x1) returned 0x0
[0083.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\joza9ejryoprehlv0-r.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.660] GetLastError () returned 0x0
[0083.660] GetFileType (hFile=0x214) returned 0x1
[0083.660] SetErrorMode (uMode=0x0) returned 0x1
[0083.660] GetFileType (hFile=0x214) returned 0x1
[0083.660] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0x49e7
[0083.660] GetLastError () returned 0x0
[0083.660] ReadFile (in: hFile=0x214, lpBuffer=0x2540174, nNumberOfBytesToRead=0x49e7, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2540174*, lpNumberOfBytesRead=0x39ec18*=0x49e7, lpOverlapped=0x0) returned 1
[0083.661] GetLastError () returned 0x0
[0083.661] CloseHandle (hObject=0x214) returned 1
[0083.661] GetLastError () returned 0x0
[0083.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx", lpFilePart=0x0) returned 0x40
[0083.716] GetLastError () returned 0x0
[0083.716] SetErrorMode (uMode=0x1) returned 0x0
[0083.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\joza9ejryoprehlv0-r.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.717] GetLastError () returned 0xb7
[0083.717] GetFileType (hFile=0x214) returned 0x1
[0083.718] GetFileType (hFile=0x214) returned 0x1
[0083.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx", lpFilePart=0x0) returned 0x40
[0083.719] GetLastError () returned 0xb7
[0083.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x4c
[0083.719] GetLastError () returned 0xb7
[0083.719] SetErrorMode (uMode=0x1) returned 0x0
[0083.719] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\joza9ejryoprehlv0-r.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x420eb4a0, ftCreationTime.dwHighDateTime=0x1d3ff21, ftLastAccessTime.dwLowDateTime=0x4a8310, ftLastAccessTime.dwHighDateTime=0x1d3d31a, ftLastWriteTime.dwLowDateTime=0xbd7ea0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x49f0)) returned 1
[0083.719] GetLastError () returned 0xb7
[0083.719] SetErrorMode (uMode=0x0) returned 0x1
[0083.719] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\joza9ejryoprehlv0-r.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\joza9ejryoprehlv0-r.pptx.lanran2.0.5")) returned 1
[0083.720] GetLastError () returned 0xb7
[0083.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx", lpFilePart=0x0) returned 0x35
[0083.720] GetLastError () returned 0xb7
[0083.720] SetErrorMode (uMode=0x1) returned 0x0
[0083.720] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kxh8rnph.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.720] GetLastError () returned 0x0
[0083.720] GetFileType (hFile=0x214) returned 0x1
[0083.720] GetFileType (hFile=0x214) returned 0x1
[0083.720] ReadFile (in: hFile=0x214, lpBuffer=0x25e3f54, nNumberOfBytesToRead=0xd2a7, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25e3f54*, lpNumberOfBytesRead=0x39ec18*=0xd2a7, lpOverlapped=0x0) returned 1
[0083.721] GetLastError () returned 0x0
[0083.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx", lpFilePart=0x0) returned 0x35
[0083.749] GetLastError () returned 0x0
[0083.749] SetErrorMode (uMode=0x1) returned 0x0
[0083.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kxh8rnph.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.751] GetLastError () returned 0xb7
[0083.751] GetFileType (hFile=0x214) returned 0x1
[0083.751] GetFileType (hFile=0x214) returned 0x1
[0083.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx", lpFilePart=0x0) returned 0x35
[0083.752] GetLastError () returned 0xb7
[0083.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x41
[0083.752] GetLastError () returned 0xb7
[0083.752] SetErrorMode (uMode=0x1) returned 0x0
[0083.752] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kxh8rnph.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363f8c60, ftCreationTime.dwHighDateTime=0x1d3be28, ftLastAccessTime.dwLowDateTime=0x5023d000, ftLastAccessTime.dwHighDateTime=0x1d40dab, ftLastWriteTime.dwLowDateTime=0xc24160, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xd2b0)) returned 1
[0083.752] GetLastError () returned 0xb7
[0083.752] SetErrorMode (uMode=0x0) returned 0x1
[0083.752] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kxh8rnph.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kxh8rnph.docx.lanran2.0.5")) returned 1
[0083.753] GetLastError () returned 0xb7
[0083.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx", lpFilePart=0x0) returned 0x31
[0083.753] GetLastError () returned 0xb7
[0083.753] SetErrorMode (uMode=0x1) returned 0x0
[0083.753] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\msvk.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.753] GetLastError () returned 0x0
[0083.753] GetFileType (hFile=0x214) returned 0x1
[0083.753] GetFileType (hFile=0x214) returned 0x1
[0083.753] ReadFile (in: hFile=0x214, lpBuffer=0x26a0a3c, nNumberOfBytesToRead=0xed9e, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26a0a3c*, lpNumberOfBytesRead=0x39ec18*=0xed9e, lpOverlapped=0x0) returned 1
[0083.754] GetLastError () returned 0x0
[0083.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx", lpFilePart=0x0) returned 0x31
[0083.822] GetLastError () returned 0x0
[0083.822] SetErrorMode (uMode=0x1) returned 0x0
[0083.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\msvk.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.823] GetLastError () returned 0xb7
[0083.823] GetFileType (hFile=0x214) returned 0x1
[0083.823] GetFileType (hFile=0x214) returned 0x1
[0083.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx", lpFilePart=0x0) returned 0x31
[0083.824] GetLastError () returned 0xb7
[0083.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x3d
[0083.824] GetLastError () returned 0xb7
[0083.824] SetErrorMode (uMode=0x1) returned 0x0
[0083.824] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\msvk.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x754cbf10, ftCreationTime.dwHighDateTime=0x1d3f837, ftLastAccessTime.dwLowDateTime=0x28e69a60, ftLastAccessTime.dwHighDateTime=0x1d386f4, ftLastWriteTime.dwLowDateTime=0xcbc6e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xeda0)) returned 1
[0083.824] GetLastError () returned 0xb7
[0083.825] SetErrorMode (uMode=0x0) returned 0x1
[0083.825] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\msvk.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\msvk.pptx.lanran2.0.5")) returned 1
[0083.825] GetLastError () returned 0xb7
[0083.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx", lpFilePart=0x0) returned 0x32
[0083.825] GetLastError () returned 0xb7
[0083.825] SetErrorMode (uMode=0x1) returned 0x0
[0083.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\osafg.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.826] GetLastError () returned 0x0
[0083.826] GetFileType (hFile=0x214) returned 0x1
[0083.826] GetFileType (hFile=0x214) returned 0x1
[0083.826] ReadFile (in: hFile=0x214, lpBuffer=0x35791f0, nNumberOfBytesToRead=0x1668e, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x35791f0*, lpNumberOfBytesRead=0x39ec18*=0x1668e, lpOverlapped=0x0) returned 1
[0083.827] GetLastError () returned 0x0
[0083.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx", lpFilePart=0x0) returned 0x32
[0083.890] GetLastError () returned 0x0
[0083.890] SetErrorMode (uMode=0x1) returned 0x0
[0083.891] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\osafg.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.892] GetLastError () returned 0xb7
[0083.892] GetFileType (hFile=0x214) returned 0x1
[0083.892] GetFileType (hFile=0x214) returned 0x1
[0083.894] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx", lpFilePart=0x0) returned 0x32
[0083.894] GetLastError () returned 0xb7
[0083.894] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx.LanRan2.0.5", lpFilePart=0x0) returned 0x3e
[0083.894] GetLastError () returned 0xb7
[0083.894] SetErrorMode (uMode=0x1) returned 0x0
[0083.894] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\osafg.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbeed2b0, ftCreationTime.dwHighDateTime=0x1d40f75, ftLastAccessTime.dwLowDateTime=0x823f09d0, ftLastAccessTime.dwHighDateTime=0x1d3a13e, ftLastWriteTime.dwLowDateTime=0xd7adc0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x16690)) returned 1
[0083.894] GetLastError () returned 0xb7
[0083.894] SetErrorMode (uMode=0x0) returned 0x1
[0083.894] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\osafg.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\osafg.xlsx.lanran2.0.5")) returned 1
[0083.895] GetLastError () returned 0xb7
[0083.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx", lpFilePart=0x0) returned 0x34
[0083.895] GetLastError () returned 0xb7
[0083.895] SetErrorMode (uMode=0x1) returned 0x0
[0083.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qohwpoo.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.895] GetLastError () returned 0x0
[0083.896] GetFileType (hFile=0x214) returned 0x1
[0083.896] GetFileType (hFile=0x214) returned 0x1
[0083.896] ReadFile (in: hFile=0x214, lpBuffer=0x25e7a80, nNumberOfBytesToRead=0x10cd3, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25e7a80*, lpNumberOfBytesRead=0x39ec18*=0x10cd3, lpOverlapped=0x0) returned 1
[0083.896] GetLastError () returned 0x0
[0083.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx", lpFilePart=0x0) returned 0x34
[0083.928] GetLastError () returned 0x0
[0083.928] SetErrorMode (uMode=0x1) returned 0x0
[0083.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qohwpoo.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.929] GetLastError () returned 0xb7
[0083.929] GetFileType (hFile=0x214) returned 0x1
[0083.929] GetFileType (hFile=0x214) returned 0x1
[0083.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx", lpFilePart=0x0) returned 0x34
[0083.931] GetLastError () returned 0xb7
[0083.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx.LanRan2.0.5", lpFilePart=0x0) returned 0x40
[0083.931] GetLastError () returned 0xb7
[0083.931] SetErrorMode (uMode=0x1) returned 0x0
[0083.931] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qohwpoo.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60ae6a20, ftCreationTime.dwHighDateTime=0x1d3a221, ftLastAccessTime.dwLowDateTime=0xc8f9c1c0, ftLastAccessTime.dwHighDateTime=0x1d3f379, ftLastWriteTime.dwLowDateTime=0xdc7080, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x10ce0)) returned 1
[0083.931] GetLastError () returned 0xb7
[0083.931] SetErrorMode (uMode=0x0) returned 0x1
[0083.931] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qohwpoo.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qohwpoo.xlsx.lanran2.0.5")) returned 1
[0083.934] GetLastError () returned 0xb7
[0083.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx", lpFilePart=0x0) returned 0x31
[0083.934] GetLastError () returned 0xb7
[0083.934] SetErrorMode (uMode=0x1) returned 0x0
[0083.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tcca.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.934] GetLastError () returned 0x0
[0083.934] GetFileType (hFile=0x214) returned 0x1
[0083.934] GetFileType (hFile=0x214) returned 0x1
[0083.935] ReadFile (in: hFile=0x214, lpBuffer=0x26b3348, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26b3348*, lpNumberOfBytesRead=0x39ec18*=0x511, lpOverlapped=0x0) returned 1
[0083.935] GetLastError () returned 0x0
[0083.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx", lpFilePart=0x0) returned 0x31
[0083.967] GetLastError () returned 0x0
[0083.967] SetErrorMode (uMode=0x1) returned 0x0
[0083.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tcca.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.968] GetLastError () returned 0xb7
[0083.968] GetFileType (hFile=0x214) returned 0x1
[0083.968] SetErrorMode (uMode=0x0) returned 0x1
[0083.968] GetFileType (hFile=0x214) returned 0x1
[0083.969] WriteFile (in: hFile=0x214, lpBuffer=0x253dfa8*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x39ebec, lpOverlapped=0x0 | out: lpBuffer=0x253dfa8*, lpNumberOfBytesWritten=0x39ebec*=0x520, lpOverlapped=0x0) returned 1
[0083.969] GetLastError () returned 0xb7
[0083.969] CloseHandle (hObject=0x214) returned 1
[0083.970] GetLastError () returned 0xb7
[0083.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx", lpFilePart=0x0) returned 0x31
[0083.970] GetLastError () returned 0xb7
[0083.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx.LanRan2.0.5", lpFilePart=0x0) returned 0x3d
[0083.970] GetLastError () returned 0xb7
[0083.970] SetErrorMode (uMode=0x1) returned 0x0
[0083.970] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tcca.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbebe42d0, ftCreationTime.dwHighDateTime=0x1d3bb89, ftLastAccessTime.dwLowDateTime=0x301e5680, ftLastAccessTime.dwHighDateTime=0x1d3877e, ftLastWriteTime.dwLowDateTime=0xe394a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x520)) returned 1
[0083.970] GetLastError () returned 0xb7
[0083.971] SetErrorMode (uMode=0x0) returned 0x1
[0083.971] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tcca.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tcca.xlsx.lanran2.0.5")) returned 1
[0083.971] GetLastError () returned 0xb7
[0083.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv", lpFilePart=0x0) returned 0x35
[0083.971] GetLastError () returned 0xb7
[0083.971] SetErrorMode (uMode=0x1) returned 0x0
[0083.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vaotvcj53.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0083.972] GetLastError () returned 0x0
[0083.972] GetFileType (hFile=0x214) returned 0x1
[0083.972] SetErrorMode (uMode=0x0) returned 0x1
[0083.972] GetFileType (hFile=0x214) returned 0x1
[0083.972] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0x14cc8
[0083.972] GetLastError () returned 0x0
[0083.973] ReadFile (in: hFile=0x214, lpBuffer=0x3621370, nNumberOfBytesToRead=0x14cc8, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x3621370*, lpNumberOfBytesRead=0x39ec18*=0x14cc8, lpOverlapped=0x0) returned 1
[0083.975] GetLastError () returned 0x0
[0083.975] CloseHandle (hObject=0x214) returned 1
[0083.975] GetLastError () returned 0x0
[0084.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv", lpFilePart=0x0) returned 0x35
[0084.056] GetLastError () returned 0x0
[0084.056] SetErrorMode (uMode=0x1) returned 0x0
[0084.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vaotvcj53.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.057] GetLastError () returned 0xb7
[0084.057] GetFileType (hFile=0x214) returned 0x1
[0084.057] GetFileType (hFile=0x214) returned 0x1
[0084.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv", lpFilePart=0x0) returned 0x35
[0084.059] GetLastError () returned 0xb7
[0084.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv.LanRan2.0.5", lpFilePart=0x0) returned 0x41
[0084.059] GetLastError () returned 0xb7
[0084.059] SetErrorMode (uMode=0x1) returned 0x0
[0084.059] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vaotvcj53.csv"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c751890, ftCreationTime.dwHighDateTime=0x1d3ae28, ftLastAccessTime.dwLowDateTime=0xccc10030, ftLastAccessTime.dwHighDateTime=0x1d3a26a, ftLastWriteTime.dwLowDateTime=0xef7b80, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x14cd0)) returned 1
[0084.059] GetLastError () returned 0xb7
[0084.059] SetErrorMode (uMode=0x0) returned 0x1
[0084.059] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vaotvcj53.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vaotvcj53.csv.lanran2.0.5")) returned 1
[0084.060] GetLastError () returned 0xb7
[0084.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv", lpFilePart=0x0) returned 0x3e
[0084.060] GetLastError () returned 0xb7
[0084.060] SetErrorMode (uMode=0x1) returned 0x0
[0084.060] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvim8uklhfcnysa9mi.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.060] GetLastError () returned 0x0
[0084.060] GetFileType (hFile=0x214) returned 0x1
[0084.061] GetFileType (hFile=0x214) returned 0x1
[0084.061] ReadFile (in: hFile=0x214, lpBuffer=0x25c77b0, nNumberOfBytesToRead=0xa6c9, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25c77b0*, lpNumberOfBytesRead=0x39ec18*=0xa6c9, lpOverlapped=0x0) returned 1
[0084.061] GetLastError () returned 0x0
[0084.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv", lpFilePart=0x0) returned 0x3e
[0084.090] GetLastError () returned 0x0
[0084.090] SetErrorMode (uMode=0x1) returned 0x0
[0084.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvim8uklhfcnysa9mi.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.091] GetLastError () returned 0xb7
[0084.092] GetFileType (hFile=0x214) returned 0x1
[0084.092] GetFileType (hFile=0x214) returned 0x1
[0084.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv", lpFilePart=0x0) returned 0x3e
[0084.093] GetLastError () returned 0xb7
[0084.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv.LanRan2.0.5", lpFilePart=0x0) returned 0x4a
[0084.093] GetLastError () returned 0xb7
[0084.093] SetErrorMode (uMode=0x1) returned 0x0
[0084.093] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvim8uklhfcnysa9mi.csv"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aaa500, ftCreationTime.dwHighDateTime=0x1d3a5eb, ftLastAccessTime.dwLowDateTime=0x32734c90, ftLastAccessTime.dwHighDateTime=0x1d3ae9a, ftLastWriteTime.dwLowDateTime=0xf69fa0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xa6d0)) returned 1
[0084.093] GetLastError () returned 0xb7
[0084.093] SetErrorMode (uMode=0x0) returned 0x1
[0084.093] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvim8uklhfcnysa9mi.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvim8uklhfcnysa9mi.csv.lanran2.0.5")) returned 1
[0084.094] GetLastError () returned 0xb7
[0084.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx", lpFilePart=0x0) returned 0x39
[0084.094] GetLastError () returned 0xb7
[0084.094] SetErrorMode (uMode=0x1) returned 0x0
[0084.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvsqepacekks.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.094] GetLastError () returned 0x0
[0084.094] GetFileType (hFile=0x214) returned 0x1
[0084.094] GetFileType (hFile=0x214) returned 0x1
[0084.094] ReadFile (in: hFile=0x214, lpBuffer=0x267939c, nNumberOfBytesToRead=0x3de3, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x267939c*, lpNumberOfBytesRead=0x39ec18*=0x3de3, lpOverlapped=0x0) returned 1
[0084.095] GetLastError () returned 0x0
[0084.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx", lpFilePart=0x0) returned 0x39
[0084.120] GetLastError () returned 0x0
[0084.120] SetErrorMode (uMode=0x1) returned 0x0
[0084.120] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvsqepacekks.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.121] GetLastError () returned 0xb7
[0084.121] GetFileType (hFile=0x214) returned 0x1
[0084.121] SetErrorMode (uMode=0x0) returned 0x1
[0084.121] GetFileType (hFile=0x214) returned 0x1
[0084.121] WriteFile (in: hFile=0x214, lpBuffer=0x2518d1c*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x39ec24, lpOverlapped=0x0 | out: lpBuffer=0x2518d1c*, lpNumberOfBytesWritten=0x39ec24*=0x3df0, lpOverlapped=0x0) returned 1
[0084.122] GetLastError () returned 0xb7
[0084.122] CloseHandle (hObject=0x214) returned 1
[0084.123] GetLastError () returned 0xb7
[0084.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx", lpFilePart=0x0) returned 0x39
[0084.123] GetLastError () returned 0xb7
[0084.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x45
[0084.123] GetLastError () returned 0xb7
[0084.123] SetErrorMode (uMode=0x1) returned 0x0
[0084.123] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvsqepacekks.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fc52840, ftCreationTime.dwHighDateTime=0x1d3975c, ftLastAccessTime.dwLowDateTime=0x465b3b90, ftLastAccessTime.dwHighDateTime=0x1d3fc25, ftLastWriteTime.dwLowDateTime=0xfb6260, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x3df0)) returned 1
[0084.123] GetLastError () returned 0xb7
[0084.123] SetErrorMode (uMode=0x0) returned 0x1
[0084.123] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvsqepacekks.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvsqepacekks.docx.lanran2.0.5")) returned 1
[0084.123] GetLastError () returned 0xb7
[0084.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx", lpFilePart=0x0) returned 0x41
[0084.123] GetLastError () returned 0xb7
[0084.123] SetErrorMode (uMode=0x1) returned 0x0
[0084.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wibix_1nev11d6kwm05l.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.124] GetLastError () returned 0x0
[0084.124] GetFileType (hFile=0x214) returned 0x1
[0084.124] SetErrorMode (uMode=0x0) returned 0x1
[0084.124] GetFileType (hFile=0x214) returned 0x1
[0084.124] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0xb062
[0084.124] GetLastError () returned 0x0
[0084.124] ReadFile (in: hFile=0x214, lpBuffer=0x251d390, nNumberOfBytesToRead=0xb062, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x251d390*, lpNumberOfBytesRead=0x39ec18*=0xb062, lpOverlapped=0x0) returned 1
[0084.124] GetLastError () returned 0x0
[0084.124] CloseHandle (hObject=0x214) returned 1
[0084.124] GetLastError () returned 0x0
[0084.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx", lpFilePart=0x0) returned 0x41
[0084.181] GetLastError () returned 0x0
[0084.181] SetErrorMode (uMode=0x1) returned 0x0
[0084.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wibix_1nev11d6kwm05l.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.182] GetLastError () returned 0xb7
[0084.182] GetFileType (hFile=0x214) returned 0x1
[0084.182] GetFileType (hFile=0x214) returned 0x1
[0084.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx", lpFilePart=0x0) returned 0x41
[0084.184] GetLastError () returned 0xb7
[0084.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x4d
[0084.184] GetLastError () returned 0xb7
[0084.184] SetErrorMode (uMode=0x1) returned 0x0
[0084.184] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wibix_1nev11d6kwm05l.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a2d88c0, ftCreationTime.dwHighDateTime=0x1d3d5f1, ftLastAccessTime.dwLowDateTime=0xe494d3d0, ftLastAccessTime.dwHighDateTime=0x1d3f431, ftLastWriteTime.dwLowDateTime=0x1028680, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xb070)) returned 1
[0084.184] GetLastError () returned 0xb7
[0084.184] SetErrorMode (uMode=0x0) returned 0x1
[0084.184] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wibix_1nev11d6kwm05l.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wibix_1nev11d6kwm05l.pptx.lanran2.0.5")) returned 1
[0084.184] GetLastError () returned 0xb7
[0084.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx", lpFilePart=0x0) returned 0x33
[0084.185] GetLastError () returned 0xb7
[0084.185] SetErrorMode (uMode=0x1) returned 0x0
[0084.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x7thqq.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.185] GetLastError () returned 0x0
[0084.185] GetFileType (hFile=0x214) returned 0x1
[0084.185] GetFileType (hFile=0x214) returned 0x1
[0084.185] ReadFile (in: hFile=0x214, lpBuffer=0x25d179c, nNumberOfBytesToRead=0x122ee, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25d179c*, lpNumberOfBytesRead=0x39ec18*=0x122ee, lpOverlapped=0x0) returned 1
[0084.186] GetLastError () returned 0x0
[0084.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx", lpFilePart=0x0) returned 0x33
[0084.210] GetLastError () returned 0x0
[0084.210] SetErrorMode (uMode=0x1) returned 0x0
[0084.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x7thqq.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.211] GetLastError () returned 0xb7
[0084.211] GetFileType (hFile=0x214) returned 0x1
[0084.211] GetFileType (hFile=0x214) returned 0x1
[0084.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx", lpFilePart=0x0) returned 0x33
[0084.213] GetLastError () returned 0xb7
[0084.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx.LanRan2.0.5", lpFilePart=0x0) returned 0x3f
[0084.213] GetLastError () returned 0xb7
[0084.213] SetErrorMode (uMode=0x1) returned 0x0
[0084.213] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x7thqq.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cc67d10, ftCreationTime.dwHighDateTime=0x1d3adc4, ftLastAccessTime.dwLowDateTime=0x93a800e0, ftLastAccessTime.dwHighDateTime=0x1d3b5b7, ftLastWriteTime.dwLowDateTime=0x1074940, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x122f0)) returned 1
[0084.213] GetLastError () returned 0xb7
[0084.213] SetErrorMode (uMode=0x0) returned 0x1
[0084.213] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x7thqq.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x7thqq.xlsx.lanran2.0.5")) returned 1
[0084.213] GetLastError () returned 0xb7
[0084.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx", lpFilePart=0x0) returned 0x40
[0084.213] GetLastError () returned 0xb7
[0084.213] SetErrorMode (uMode=0x1) returned 0x0
[0084.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xsyb4due828s75ucs t.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.214] GetLastError () returned 0x0
[0084.214] GetFileType (hFile=0x214) returned 0x1
[0084.214] GetFileType (hFile=0x214) returned 0x1
[0084.214] ReadFile (in: hFile=0x214, lpBuffer=0x26a23b0, nNumberOfBytesToRead=0x1330d, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26a23b0*, lpNumberOfBytesRead=0x39ec18*=0x1330d, lpOverlapped=0x0) returned 1
[0084.214] GetLastError () returned 0x0
[0084.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx", lpFilePart=0x0) returned 0x40
[0084.262] GetLastError () returned 0x0
[0084.262] SetErrorMode (uMode=0x1) returned 0x0
[0084.262] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xsyb4due828s75ucs t.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.263] GetLastError () returned 0xb7
[0084.263] GetFileType (hFile=0x214) returned 0x1
[0084.263] GetFileType (hFile=0x214) returned 0x1
[0084.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx", lpFilePart=0x0) returned 0x40
[0084.264] GetLastError () returned 0xb7
[0084.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x4c
[0084.264] GetLastError () returned 0xb7
[0084.264] SetErrorMode (uMode=0x1) returned 0x0
[0084.264] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xsyb4due828s75ucs t.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9acd930, ftCreationTime.dwHighDateTime=0x1d3f165, ftLastAccessTime.dwLowDateTime=0x9dfa1fa0, ftLastAccessTime.dwHighDateTime=0x1d3d53e, ftLastWriteTime.dwLowDateTime=0x110cec0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x13310)) returned 1
[0084.265] GetLastError () returned 0xb7
[0084.265] SetErrorMode (uMode=0x0) returned 0x1
[0084.265] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xsyb4due828s75ucs t.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xsyb4due828s75ucs t.pptx.lanran2.0.5")) returned 1
[0084.265] GetLastError () returned 0xb7
[0084.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF", lpFilePart=0x0) returned 0x37
[0084.265] GetLastError () returned 0xb7
[0084.265] SetErrorMode (uMode=0x1) returned 0x0
[0084.265] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0
[0084.265] GetLastError () returned 0xb7
[0084.265] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.265] GetLastError () returned 0xb7
[0084.265] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.265] GetLastError () returned 0xb7
[0084.265] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.265] GetLastError () returned 0xb7
[0084.265] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.265] GetLastError () returned 0xb7
[0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.266] GetLastError () returned 0xb7
[0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.266] GetLastError () returned 0xb7
[0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.266] GetLastError () returned 0xb7
[0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.266] GetLastError () returned 0xb7
[0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.266] GetLastError () returned 0xb7
[0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0084.266] GetLastError () returned 0x12
[0084.266] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1
[0084.266] SetErrorMode (uMode=0x0) returned 0x1
[0084.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF", lpFilePart=0x0) returned 0x37
[0084.266] GetLastError () returned 0x12
[0084.266] SetErrorMode (uMode=0x1) returned 0x0
[0084.266] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0
[0084.266] GetLastError () returned 0x12
[0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.266] GetLastError () returned 0x12
[0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.266] GetLastError () returned 0x12
[0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.266] GetLastError () returned 0x12
[0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.266] GetLastError () returned 0x12
[0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.266] GetLastError () returned 0x12
[0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.266] GetLastError () returned 0x12
[0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.266] GetLastError () returned 0x12
[0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.266] GetLastError () returned 0x12
[0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.267] GetLastError () returned 0x12
[0084.267] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0084.267] GetLastError () returned 0x12
[0084.267] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1
[0084.267] SetErrorMode (uMode=0x0) returned 0x1
[0084.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv", lpFilePart=0x0) returned 0x42
[0084.267] GetLastError () returned 0x12
[0084.267] SetErrorMode (uMode=0x1) returned 0x0
[0084.267] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\9ohwcx.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.267] GetLastError () returned 0x0
[0084.267] GetFileType (hFile=0x214) returned 0x1
[0084.267] GetFileType (hFile=0x214) returned 0x1
[0084.267] ReadFile (in: hFile=0x214, lpBuffer=0x2593f3c, nNumberOfBytesToRead=0xb9a3, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x2593f3c*, lpNumberOfBytesRead=0x39ebb8*=0xb9a3, lpOverlapped=0x0) returned 1
[0084.268] GetLastError () returned 0x0
[0084.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv", lpFilePart=0x0) returned 0x42
[0084.285] GetLastError () returned 0x0
[0084.285] SetErrorMode (uMode=0x1) returned 0x0
[0084.285] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\9ohwcx.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.286] GetLastError () returned 0xb7
[0084.286] GetFileType (hFile=0x214) returned 0x1
[0084.286] SetErrorMode (uMode=0x0) returned 0x1
[0084.286] GetFileType (hFile=0x214) returned 0x1
[0084.286] WriteFile (in: hFile=0x214, lpBuffer=0x263e5fc*, nNumberOfBytesToWrite=0xb9b0, lpNumberOfBytesWritten=0x39ebc4, lpOverlapped=0x0 | out: lpBuffer=0x263e5fc*, lpNumberOfBytesWritten=0x39ebc4*=0xb9b0, lpOverlapped=0x0) returned 1
[0084.287] GetLastError () returned 0xb7
[0084.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv", lpFilePart=0x0) returned 0x42
[0084.287] GetLastError () returned 0xb7
[0084.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv.LanRan2.0.5", lpFilePart=0x0) returned 0x4e
[0084.287] GetLastError () returned 0xb7
[0084.287] SetErrorMode (uMode=0x1) returned 0x0
[0084.287] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\9ohwcx.csv"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd24744d0, ftCreationTime.dwHighDateTime=0x1d3a1cd, ftLastAccessTime.dwLowDateTime=0x1e5b7f70, ftLastAccessTime.dwHighDateTime=0x1d3a143, ftLastWriteTime.dwLowDateTime=0x1133020, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xb9b0)) returned 1
[0084.287] GetLastError () returned 0xb7
[0084.287] SetErrorMode (uMode=0x0) returned 0x1
[0084.287] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\9ohwcx.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\9ohwcx.csv.lanran2.0.5")) returned 1
[0084.289] GetLastError () returned 0xb7
[0084.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc", lpFilePart=0x0) returned 0x4d
[0084.289] GetLastError () returned 0xb7
[0084.289] SetErrorMode (uMode=0x1) returned 0x0
[0084.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\is2fbgoyb_drve2 p.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.289] GetLastError () returned 0x0
[0084.289] GetFileType (hFile=0x214) returned 0x1
[0084.289] SetErrorMode (uMode=0x0) returned 0x1
[0084.289] GetFileType (hFile=0x214) returned 0x1
[0084.289] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ec10 | out: lpFileSizeHigh=0x39ec10*=0x0) returned 0x939f
[0084.289] GetLastError () returned 0x0
[0084.289] ReadFile (in: hFile=0x214, lpBuffer=0x264a8a0, nNumberOfBytesToRead=0x939f, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x264a8a0*, lpNumberOfBytesRead=0x39ebb8*=0x939f, lpOverlapped=0x0) returned 1
[0084.290] GetLastError () returned 0x0
[0084.290] CloseHandle (hObject=0x214) returned 1
[0084.290] GetLastError () returned 0x0
[0084.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc", lpFilePart=0x0) returned 0x4d
[0084.403] GetLastError () returned 0x0
[0084.403] SetErrorMode (uMode=0x1) returned 0x0
[0084.403] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\is2fbgoyb_drve2 p.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.404] GetLastError () returned 0xb7
[0084.404] GetFileType (hFile=0x214) returned 0x1
[0084.404] GetFileType (hFile=0x214) returned 0x1
[0084.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc", lpFilePart=0x0) returned 0x4d
[0084.405] GetLastError () returned 0xb7
[0084.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc.LanRan2.0.5", lpFilePart=0x0) returned 0x59
[0084.405] GetLastError () returned 0xb7
[0084.405] SetErrorMode (uMode=0x1) returned 0x0
[0084.405] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\is2fbgoyb_drve2 p.doc"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71cbb0d0, ftCreationTime.dwHighDateTime=0x1d3a7b5, ftLastAccessTime.dwLowDateTime=0xe4bb8310, ftLastAccessTime.dwHighDateTime=0x1d3a24a, ftLastWriteTime.dwLowDateTime=0x1263b20, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x93a0)) returned 1
[0084.405] GetLastError () returned 0xb7
[0084.405] SetErrorMode (uMode=0x0) returned 0x1
[0084.406] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\is2fbgoyb_drve2 p.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\is2fbgoyb_drve2 p.doc.lanran2.0.5")) returned 1
[0084.406] GetLastError () returned 0xb7
[0084.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls", lpFilePart=0x0) returned 0x4f
[0084.406] GetLastError () returned 0xb7
[0084.406] SetErrorMode (uMode=0x1) returned 0x0
[0084.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\lwxjfvxbet 7vcegygl.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.406] GetLastError () returned 0x0
[0084.406] GetFileType (hFile=0x214) returned 0x1
[0084.406] SetErrorMode (uMode=0x0) returned 0x1
[0084.406] GetFileType (hFile=0x214) returned 0x1
[0084.407] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ec10 | out: lpFileSizeHigh=0x39ec10*=0x0) returned 0xc8e4
[0084.407] GetLastError () returned 0x0
[0084.407] ReadFile (in: hFile=0x214, lpBuffer=0x251361c, nNumberOfBytesToRead=0xc8e4, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x251361c*, lpNumberOfBytesRead=0x39ebb8*=0xc8e4, lpOverlapped=0x0) returned 1
[0084.407] GetLastError () returned 0x0
[0084.407] CloseHandle (hObject=0x214) returned 1
[0084.407] GetLastError () returned 0x0
[0084.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls", lpFilePart=0x0) returned 0x4f
[0084.456] GetLastError () returned 0x0
[0084.456] SetErrorMode (uMode=0x1) returned 0x0
[0084.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\lwxjfvxbet 7vcegygl.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.457] GetLastError () returned 0xb7
[0084.457] GetFileType (hFile=0x214) returned 0x1
[0084.457] GetFileType (hFile=0x214) returned 0x1
[0084.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls", lpFilePart=0x0) returned 0x4f
[0084.458] GetLastError () returned 0xb7
[0084.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls.LanRan2.0.5", lpFilePart=0x0) returned 0x5b
[0084.458] GetLastError () returned 0xb7
[0084.458] SetErrorMode (uMode=0x1) returned 0x0
[0084.458] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\lwxjfvxbet 7vcegygl.xls"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5ddce0, ftCreationTime.dwHighDateTime=0x1d3ae71, ftLastAccessTime.dwLowDateTime=0xeb7bb670, ftLastAccessTime.dwHighDateTime=0x1d3a12d, ftLastWriteTime.dwLowDateTime=0x12d5f40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xc8f0)) returned 1
[0084.458] GetLastError () returned 0xb7
[0084.458] SetErrorMode (uMode=0x0) returned 0x1
[0084.458] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\lwxjfvxbet 7vcegygl.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\lwxjfvxbet 7vcegygl.xls.lanran2.0.5")) returned 1
[0084.459] GetLastError () returned 0xb7
[0084.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc", lpFilePart=0x0) returned 0x4e
[0084.459] GetLastError () returned 0xb7
[0084.459] SetErrorMode (uMode=0x1) returned 0x0
[0084.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\uuqj2vsov--zktoa9e.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.459] GetLastError () returned 0x0
[0084.459] GetFileType (hFile=0x214) returned 0x1
[0084.459] GetFileType (hFile=0x214) returned 0x1
[0084.459] ReadFile (in: hFile=0x214, lpBuffer=0x25cdce0, nNumberOfBytesToRead=0x1a59, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x25cdce0*, lpNumberOfBytesRead=0x39ebb8*=0x1a59, lpOverlapped=0x0) returned 1
[0084.460] GetLastError () returned 0x0
[0084.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc", lpFilePart=0x0) returned 0x4e
[0084.477] GetLastError () returned 0x0
[0084.477] SetErrorMode (uMode=0x1) returned 0x0
[0084.477] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\uuqj2vsov--zktoa9e.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.477] GetLastError () returned 0xb7
[0084.477] GetFileType (hFile=0x214) returned 0x1
[0084.477] GetFileType (hFile=0x214) returned 0x1
[0084.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc", lpFilePart=0x0) returned 0x4e
[0084.478] GetLastError () returned 0xb7
[0084.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc.LanRan2.0.5", lpFilePart=0x0) returned 0x5a
[0084.478] GetLastError () returned 0xb7
[0084.478] SetErrorMode (uMode=0x1) returned 0x0
[0084.478] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\uuqj2vsov--zktoa9e.doc"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec817740, ftCreationTime.dwHighDateTime=0x1d3a50a, ftLastAccessTime.dwLowDateTime=0x54ae98b0, ftLastAccessTime.dwHighDateTime=0x1d3a5f7, ftLastWriteTime.dwLowDateTime=0x12fc0a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x1a60)) returned 1
[0084.478] GetLastError () returned 0xb7
[0084.478] SetErrorMode (uMode=0x0) returned 0x1
[0084.478] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\uuqj2vsov--zktoa9e.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\uuqj2vsov--zktoa9e.doc.lanran2.0.5")) returned 1
[0084.479] GetLastError () returned 0xb7
[0084.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx", lpFilePart=0x0) returned 0x43
[0084.479] GetLastError () returned 0xb7
[0084.479] SetErrorMode (uMode=0x1) returned 0x0
[0084.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\vcksfe.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.479] GetLastError () returned 0x0
[0084.479] GetFileType (hFile=0x214) returned 0x1
[0084.479] GetFileType (hFile=0x214) returned 0x1
[0084.479] ReadFile (in: hFile=0x214, lpBuffer=0x3744068, nNumberOfBytesToRead=0x15766, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x3744068*, lpNumberOfBytesRead=0x39ebb8*=0x15766, lpOverlapped=0x0) returned 1
[0084.480] GetLastError () returned 0x0
[0084.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx", lpFilePart=0x0) returned 0x43
[0084.515] GetLastError () returned 0x0
[0084.515] SetErrorMode (uMode=0x1) returned 0x0
[0084.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\vcksfe.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.516] GetLastError () returned 0xb7
[0084.516] GetFileType (hFile=0x214) returned 0x1
[0084.516] SetErrorMode (uMode=0x0) returned 0x1
[0084.516] GetFileType (hFile=0x214) returned 0x1
[0084.516] WriteFile (in: hFile=0x214, lpBuffer=0x3496de0*, nNumberOfBytesToWrite=0x15770, lpNumberOfBytesWritten=0x39ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3496de0*, lpNumberOfBytesWritten=0x39ebc4*=0x15770, lpOverlapped=0x0) returned 1
[0084.517] GetLastError () returned 0xb7
[0084.518] CloseHandle (hObject=0x214) returned 1
[0084.519] GetLastError () returned 0xb7
[0084.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx", lpFilePart=0x0) returned 0x43
[0084.519] GetLastError () returned 0xb7
[0084.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx.LanRan2.0.5", lpFilePart=0x0) returned 0x4f
[0084.519] GetLastError () returned 0xb7
[0084.519] SetErrorMode (uMode=0x1) returned 0x0
[0084.519] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\vcksfe.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5ee9530, ftCreationTime.dwHighDateTime=0x1d3abcf, ftLastAccessTime.dwLowDateTime=0xacc6f00, ftLastAccessTime.dwHighDateTime=0x1d3aff3, ftLastWriteTime.dwLowDateTime=0x136e4c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x15770)) returned 1
[0084.519] GetLastError () returned 0xb7
[0084.519] SetErrorMode (uMode=0x0) returned 0x1
[0084.519] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\vcksfe.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\vcksfe.xlsx.lanran2.0.5")) returned 1
[0084.520] GetLastError () returned 0xb7
[0084.520] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO", lpFilePart=0x0) returned 0x4a
[0084.520] GetLastError () returned 0xb7
[0084.520] SetErrorMode (uMode=0x1) returned 0x0
[0084.520] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570
[0084.520] GetLastError () returned 0xb7
[0084.521] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.521] GetLastError () returned 0xb7
[0084.521] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.521] GetLastError () returned 0xb7
[0084.521] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.521] GetLastError () returned 0xb7
[0084.521] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.521] GetLastError () returned 0xb7
[0084.521] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.521] GetLastError () returned 0xb7
[0084.522] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.522] GetLastError () returned 0xb7
[0084.522] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.522] GetLastError () returned 0xb7
[0084.522] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.522] GetLastError () returned 0xb7
[0084.522] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0084.522] GetLastError () returned 0x12
[0084.522] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1
[0084.523] SetErrorMode (uMode=0x0) returned 0x1
[0084.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO", lpFilePart=0x0) returned 0x4a
[0084.523] GetLastError () returned 0x12
[0084.523] SetErrorMode (uMode=0x1) returned 0x0
[0084.523] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570
[0084.523] GetLastError () returned 0x12
[0084.523] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.523] GetLastError () returned 0x12
[0084.523] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.523] GetLastError () returned 0x12
[0084.524] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.524] GetLastError () returned 0x12
[0084.524] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.524] GetLastError () returned 0x12
[0084.524] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.524] GetLastError () returned 0x12
[0084.524] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.524] GetLastError () returned 0x12
[0084.524] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.524] GetLastError () returned 0x12
[0084.525] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.525] GetLastError () returned 0x12
[0084.525] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0084.525] GetLastError () returned 0x12
[0084.525] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1
[0084.525] SetErrorMode (uMode=0x0) returned 0x1
[0084.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls", lpFilePart=0x0) returned 0x61
[0084.525] GetLastError () returned 0x12
[0084.525] SetErrorMode (uMode=0x1) returned 0x0
[0084.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\9x4ox9zi66worq566n.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.526] GetLastError () returned 0x0
[0084.526] GetFileType (hFile=0x214) returned 0x1
[0084.526] SetErrorMode (uMode=0x0) returned 0x1
[0084.526] GetFileType (hFile=0x214) returned 0x1
[0084.526] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0x15590
[0084.526] GetLastError () returned 0x0
[0084.527] ReadFile (in: hFile=0x214, lpBuffer=0x34ac570, nNumberOfBytesToRead=0x15590, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x34ac570*, lpNumberOfBytesRead=0x39eb58*=0x15590, lpOverlapped=0x0) returned 1
[0084.528] GetLastError () returned 0x0
[0084.528] CloseHandle (hObject=0x214) returned 1
[0084.528] GetLastError () returned 0x0
[0084.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls", lpFilePart=0x0) returned 0x61
[0084.608] GetLastError () returned 0x0
[0084.608] SetErrorMode (uMode=0x1) returned 0x0
[0084.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\9x4ox9zi66worq566n.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.609] GetLastError () returned 0xb7
[0084.609] GetFileType (hFile=0x214) returned 0x1
[0084.610] GetFileType (hFile=0x214) returned 0x1
[0084.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls", lpFilePart=0x0) returned 0x61
[0084.611] GetLastError () returned 0xb7
[0084.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls.LanRan2.0.5", lpFilePart=0x0) returned 0x6d
[0084.611] GetLastError () returned 0xb7
[0084.611] SetErrorMode (uMode=0x1) returned 0x0
[0084.611] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\9x4ox9zi66worq566n.xls"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6fde9b0, ftCreationTime.dwHighDateTime=0x1d3a8bf, ftLastAccessTime.dwLowDateTime=0xf64b85e0, ftLastAccessTime.dwHighDateTime=0x1d3a406, ftLastWriteTime.dwLowDateTime=0x1452d00, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x155a0)) returned 1
[0084.611] GetLastError () returned 0xb7
[0084.611] SetErrorMode (uMode=0x0) returned 0x1
[0084.612] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\9x4ox9zi66worq566n.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\9x4ox9zi66worq566n.xls.lanran2.0.5")) returned 1
[0084.612] GetLastError () returned 0xb7
[0084.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt", lpFilePart=0x0) returned 0x5a
[0084.612] GetLastError () returned 0xb7
[0084.612] SetErrorMode (uMode=0x1) returned 0x0
[0084.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\mxzhtw exvo.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.612] GetLastError () returned 0x0
[0084.612] GetFileType (hFile=0x214) returned 0x1
[0084.612] GetFileType (hFile=0x214) returned 0x1
[0084.612] ReadFile (in: hFile=0x214, lpBuffer=0x25449f4, nNumberOfBytesToRead=0x10c7d, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25449f4*, lpNumberOfBytesRead=0x39eb58*=0x10c7d, lpOverlapped=0x0) returned 1
[0084.613] GetLastError () returned 0x0
[0084.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt", lpFilePart=0x0) returned 0x5a
[0084.647] GetLastError () returned 0x0
[0084.647] SetErrorMode (uMode=0x1) returned 0x0
[0084.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\mxzhtw exvo.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.648] GetLastError () returned 0xb7
[0084.648] GetFileType (hFile=0x214) returned 0x1
[0084.649] GetFileType (hFile=0x214) returned 0x1
[0084.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt", lpFilePart=0x0) returned 0x5a
[0084.650] GetLastError () returned 0xb7
[0084.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt.LanRan2.0.5", lpFilePart=0x0) returned 0x66
[0084.650] GetLastError () returned 0xb7
[0084.650] SetErrorMode (uMode=0x1) returned 0x0
[0084.650] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\mxzhtw exvo.odt"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10a9b160, ftCreationTime.dwHighDateTime=0x1d3b013, ftLastAccessTime.dwLowDateTime=0xb2968ac0, ftLastAccessTime.dwHighDateTime=0x1d3ab9a, ftLastWriteTime.dwLowDateTime=0x149efc0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x10c80)) returned 1
[0084.650] GetLastError () returned 0xb7
[0084.650] SetErrorMode (uMode=0x0) returned 0x1
[0084.650] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\mxzhtw exvo.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\mxzhtw exvo.odt.lanran2.0.5")) returned 1
[0084.651] GetLastError () returned 0xb7
[0084.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc", lpFilePart=0x0) returned 0x58
[0084.651] GetLastError () returned 0xb7
[0084.651] SetErrorMode (uMode=0x1) returned 0x0
[0084.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\qcfc96mjr.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.651] GetLastError () returned 0x0
[0084.651] GetFileType (hFile=0x214) returned 0x1
[0084.651] GetFileType (hFile=0x214) returned 0x1
[0084.652] ReadFile (in: hFile=0x214, lpBuffer=0x354e080, nNumberOfBytesToRead=0x18855, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x354e080*, lpNumberOfBytesRead=0x39eb58*=0x18855, lpOverlapped=0x0) returned 1
[0084.653] GetLastError () returned 0x0
[0084.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc", lpFilePart=0x0) returned 0x58
[0084.681] GetLastError () returned 0x0
[0084.681] SetErrorMode (uMode=0x1) returned 0x0
[0084.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\qcfc96mjr.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.682] GetLastError () returned 0xb7
[0084.682] GetFileType (hFile=0x214) returned 0x1
[0084.682] GetFileType (hFile=0x214) returned 0x1
[0084.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc", lpFilePart=0x0) returned 0x58
[0084.684] GetLastError () returned 0xb7
[0084.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc.LanRan2.0.5", lpFilePart=0x0) returned 0x64
[0084.684] GetLastError () returned 0xb7
[0084.684] SetErrorMode (uMode=0x1) returned 0x0
[0084.684] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\qcfc96mjr.doc"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbc95710, ftCreationTime.dwHighDateTime=0x1d3a40e, ftLastAccessTime.dwLowDateTime=0x8ba4ef20, ftLastAccessTime.dwHighDateTime=0x1d3a72f, ftLastWriteTime.dwLowDateTime=0x15113e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x18860)) returned 1
[0084.684] GetLastError () returned 0xb7
[0084.684] SetErrorMode (uMode=0x0) returned 0x1
[0084.684] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\qcfc96mjr.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\qcfc96mjr.doc.lanran2.0.5")) returned 1
[0084.685] GetLastError () returned 0xb7
[0084.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6", lpFilePart=0x0) returned 0x5e
[0084.685] GetLastError () returned 0xb7
[0084.685] SetErrorMode (uMode=0x1) returned 0x0
[0084.685] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3b0
[0084.685] GetLastError () returned 0xb7
[0084.685] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.685] GetLastError () returned 0xb7
[0084.685] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.685] GetLastError () returned 0xb7
[0084.686] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.686] GetLastError () returned 0xb7
[0084.686] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.686] GetLastError () returned 0xb7
[0084.686] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0084.686] GetLastError () returned 0x12
[0084.686] FindClose (in: hFindFile=0x42c3b0 | out: hFindFile=0x42c3b0) returned 1
[0084.686] SetErrorMode (uMode=0x0) returned 0x1
[0084.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6", lpFilePart=0x0) returned 0x5e
[0084.686] GetLastError () returned 0x12
[0084.686] SetErrorMode (uMode=0x1) returned 0x0
[0084.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3b0
[0084.686] GetLastError () returned 0x12
[0084.686] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.686] GetLastError () returned 0x12
[0084.686] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.686] GetLastError () returned 0x12
[0084.686] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.686] GetLastError () returned 0x12
[0084.687] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.687] GetLastError () returned 0x12
[0084.687] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0084.687] GetLastError () returned 0x12
[0084.687] FindClose (in: hFindFile=0x42c3b0 | out: hFindFile=0x42c3b0) returned 1
[0084.687] SetErrorMode (uMode=0x0) returned 0x1
[0084.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf", lpFilePart=0x0) returned 0x72
[0084.687] GetLastError () returned 0x12
[0084.687] SetErrorMode (uMode=0x1) returned 0x0
[0084.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\7mo7p2ajxryjr9e.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.687] GetLastError () returned 0x0
[0084.687] GetFileType (hFile=0x214) returned 0x1
[0084.687] SetErrorMode (uMode=0x0) returned 0x1
[0084.687] GetFileType (hFile=0x214) returned 0x1
[0084.687] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39eb50 | out: lpFileSizeHigh=0x39eb50*=0x0) returned 0x142f1
[0084.688] GetLastError () returned 0x0
[0084.688] ReadFile (in: hFile=0x214, lpBuffer=0x2699764, nNumberOfBytesToRead=0x142f1, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x2699764*, lpNumberOfBytesRead=0x39eaf8*=0x142f1, lpOverlapped=0x0) returned 1
[0084.688] GetLastError () returned 0x0
[0084.689] CloseHandle (hObject=0x214) returned 1
[0084.689] GetLastError () returned 0x0
[0084.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf", lpFilePart=0x0) returned 0x72
[0084.747] GetLastError () returned 0x0
[0084.747] SetErrorMode (uMode=0x1) returned 0x0
[0084.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\7mo7p2ajxryjr9e.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.748] GetLastError () returned 0xb7
[0084.748] GetFileType (hFile=0x214) returned 0x1
[0084.748] GetFileType (hFile=0x214) returned 0x1
[0084.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf", lpFilePart=0x0) returned 0x72
[0084.749] GetLastError () returned 0xb7
[0084.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf.LanRan2.0.5", lpFilePart=0x0) returned 0x7e
[0084.749] GetLastError () returned 0xb7
[0084.749] SetErrorMode (uMode=0x1) returned 0x0
[0084.749] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\7mo7p2ajxryjr9e.rtf"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e4b1620, ftCreationTime.dwHighDateTime=0x1d3a899, ftLastAccessTime.dwLowDateTime=0x7684afe0, ftLastAccessTime.dwHighDateTime=0x1d3a653, ftLastWriteTime.dwLowDateTime=0x15a9960, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x14300)) returned 1
[0084.750] GetLastError () returned 0xb7
[0084.750] SetErrorMode (uMode=0x0) returned 0x1
[0084.750] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\7mo7p2ajxryjr9e.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\7mo7p2ajxryjr9e.rtf.lanran2.0.5")) returned 1
[0084.750] GetLastError () returned 0xb7
[0084.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf", lpFilePart=0x0) returned 0x6d
[0084.750] GetLastError () returned 0xb7
[0084.750] SetErrorMode (uMode=0x1) returned 0x0
[0084.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\vhpzchnm-9.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.750] GetLastError () returned 0x0
[0084.750] GetFileType (hFile=0x214) returned 0x1
[0084.750] SetErrorMode (uMode=0x0) returned 0x1
[0084.750] GetFileType (hFile=0x214) returned 0x1
[0084.750] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39eb50 | out: lpFileSizeHigh=0x39eb50*=0x0) returned 0x9263
[0084.750] GetLastError () returned 0x0
[0084.750] ReadFile (in: hFile=0x214, lpBuffer=0x2587564, nNumberOfBytesToRead=0x9263, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x2587564*, lpNumberOfBytesRead=0x39eaf8*=0x9263, lpOverlapped=0x0) returned 1
[0084.751] GetLastError () returned 0x0
[0084.751] CloseHandle (hObject=0x214) returned 1
[0084.751] GetLastError () returned 0x0
[0084.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf", lpFilePart=0x0) returned 0x6d
[0084.817] GetLastError () returned 0x0
[0084.817] SetErrorMode (uMode=0x1) returned 0x0
[0084.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\vhpzchnm-9.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.826] GetLastError () returned 0xb7
[0084.826] GetFileType (hFile=0x214) returned 0x1
[0084.826] GetFileType (hFile=0x214) returned 0x1
[0084.832] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf", lpFilePart=0x0) returned 0x6d
[0084.832] GetLastError () returned 0xb7
[0084.832] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf.LanRan2.0.5", lpFilePart=0x0) returned 0x79
[0084.832] GetLastError () returned 0xb7
[0084.832] SetErrorMode (uMode=0x1) returned 0x0
[0084.832] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\vhpzchnm-9.pdf"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc68ea0, ftCreationTime.dwHighDateTime=0x1d3a6c4, ftLastAccessTime.dwLowDateTime=0xc90cdd00, ftLastAccessTime.dwHighDateTime=0x1d3abda, ftLastWriteTime.dwLowDateTime=0x1668040, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x9270)) returned 1
[0084.832] GetLastError () returned 0xb7
[0084.832] SetErrorMode (uMode=0x0) returned 0x1
[0084.832] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\vhpzchnm-9.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\vhpzchnm-9.pdf.lanran2.0.5")) returned 1
[0084.832] GetLastError () returned 0xb7
[0084.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44", lpFilePart=0x0) returned 0x47
[0084.833] GetLastError () returned 0xb7
[0084.833] SetErrorMode (uMode=0x1) returned 0x0
[0084.833] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0
[0084.833] GetLastError () returned 0xb7
[0084.833] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.833] GetLastError () returned 0xb7
[0084.833] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.833] GetLastError () returned 0xb7
[0084.833] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.833] GetLastError () returned 0xb7
[0084.833] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.833] GetLastError () returned 0xb7
[0084.833] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.833] GetLastError () returned 0xb7
[0084.833] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.833] GetLastError () returned 0xb7
[0084.833] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.834] GetLastError () returned 0xb7
[0084.834] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.834] GetLastError () returned 0xb7
[0084.834] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0084.834] GetLastError () returned 0x12
[0084.834] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1
[0084.834] SetErrorMode (uMode=0x0) returned 0x1
[0084.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44", lpFilePart=0x0) returned 0x47
[0084.834] GetLastError () returned 0x12
[0084.834] SetErrorMode (uMode=0x1) returned 0x0
[0084.834] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0
[0084.834] GetLastError () returned 0x12
[0084.834] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.834] GetLastError () returned 0x12
[0084.834] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.834] GetLastError () returned 0x12
[0084.835] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.835] GetLastError () returned 0x12
[0084.835] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.835] GetLastError () returned 0x12
[0084.835] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.835] GetLastError () returned 0x12
[0084.835] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.835] GetLastError () returned 0x12
[0084.835] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.835] GetLastError () returned 0x12
[0084.835] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.835] GetLastError () returned 0x12
[0084.835] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0084.835] GetLastError () returned 0x12
[0084.835] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1
[0084.835] SetErrorMode (uMode=0x0) returned 0x1
[0084.835] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx", lpFilePart=0x0) returned 0x52
[0084.835] GetLastError () returned 0x12
[0084.835] SetErrorMode (uMode=0x1) returned 0x0
[0084.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\hlmh4.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.836] GetLastError () returned 0x0
[0084.836] GetFileType (hFile=0x214) returned 0x1
[0084.836] GetFileType (hFile=0x214) returned 0x1
[0084.836] ReadFile (in: hFile=0x214, lpBuffer=0x3609918, nNumberOfBytesToRead=0x160c3, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x3609918*, lpNumberOfBytesRead=0x39eb58*=0x160c3, lpOverlapped=0x0) returned 1
[0084.837] GetLastError () returned 0x0
[0084.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx", lpFilePart=0x0) returned 0x52
[0084.881] GetLastError () returned 0x0
[0084.881] SetErrorMode (uMode=0x1) returned 0x0
[0084.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\hlmh4.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.882] GetLastError () returned 0xb7
[0084.882] GetFileType (hFile=0x214) returned 0x1
[0084.882] SetErrorMode (uMode=0x0) returned 0x1
[0084.882] GetFileType (hFile=0x214) returned 0x1
[0084.884] CloseHandle (hObject=0x214) returned 1
[0084.884] GetLastError () returned 0xb7
[0084.884] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx", lpFilePart=0x0) returned 0x52
[0084.884] GetLastError () returned 0xb7
[0084.884] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx.LanRan2.0.5", lpFilePart=0x0) returned 0x5e
[0084.884] GetLastError () returned 0xb7
[0084.884] SetErrorMode (uMode=0x1) returned 0x0
[0084.884] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\hlmh4.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4920d10, ftCreationTime.dwHighDateTime=0x1d3ab6e, ftLastAccessTime.dwLowDateTime=0xb2fe4de0, ftLastAccessTime.dwHighDateTime=0x1d3ab45, ftLastWriteTime.dwLowDateTime=0x16da460, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x160d0)) returned 1
[0084.884] GetLastError () returned 0xb7
[0084.884] SetErrorMode (uMode=0x0) returned 0x1
[0084.884] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\hlmh4.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\hlmh4.xlsx.lanran2.0.5")) returned 1
[0084.885] GetLastError () returned 0xb7
[0084.885] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf", lpFilePart=0x0) returned 0x50
[0084.885] GetLastError () returned 0xb7
[0084.885] SetErrorMode (uMode=0x1) returned 0x0
[0084.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\jdzs.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.885] GetLastError () returned 0x0
[0084.885] GetFileType (hFile=0x214) returned 0x1
[0084.885] SetErrorMode (uMode=0x0) returned 0x1
[0084.885] GetFileType (hFile=0x214) returned 0x1
[0084.885] ReadFile (in: hFile=0x214, lpBuffer=0x24d0e84, nNumberOfBytesToRead=0x1d1c, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x24d0e84*, lpNumberOfBytesRead=0x39eb58*=0x1d1c, lpOverlapped=0x0) returned 1
[0084.886] GetLastError () returned 0x0
[0084.886] CloseHandle (hObject=0x214) returned 1
[0084.886] GetLastError () returned 0x0
[0084.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf", lpFilePart=0x0) returned 0x50
[0084.931] GetLastError () returned 0x0
[0084.931] SetErrorMode (uMode=0x1) returned 0x0
[0084.931] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\jdzs.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.931] GetLastError () returned 0xb7
[0084.931] GetFileType (hFile=0x214) returned 0x1
[0084.931] GetFileType (hFile=0x214) returned 0x1
[0084.932] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf", lpFilePart=0x0) returned 0x50
[0084.932] GetLastError () returned 0xb7
[0084.932] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf.LanRan2.0.5", lpFilePart=0x0) returned 0x5c
[0084.932] GetLastError () returned 0xb7
[0084.932] SetErrorMode (uMode=0x1) returned 0x0
[0084.932] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\jdzs.rtf"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58ccaf70, ftCreationTime.dwHighDateTime=0x1d3a5d6, ftLastAccessTime.dwLowDateTime=0x30d6bda0, ftLastAccessTime.dwHighDateTime=0x1d3ad68, ftLastWriteTime.dwLowDateTime=0x174c880, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x1d20)) returned 1
[0084.932] GetLastError () returned 0xb7
[0084.932] SetErrorMode (uMode=0x0) returned 0x1
[0084.932] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\jdzs.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\jdzs.rtf.lanran2.0.5")) returned 1
[0084.933] GetLastError () returned 0xb7
[0084.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf", lpFilePart=0x0) returned 0x5b
[0084.933] GetLastError () returned 0xb7
[0084.933] SetErrorMode (uMode=0x1) returned 0x0
[0084.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\kmqwqfsabihhi9p.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.933] GetLastError () returned 0x0
[0084.933] GetFileType (hFile=0x214) returned 0x1
[0084.933] GetFileType (hFile=0x214) returned 0x1
[0084.933] ReadFile (in: hFile=0x214, lpBuffer=0x2564038, nNumberOfBytesToRead=0x1057f, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x2564038*, lpNumberOfBytesRead=0x39eb58*=0x1057f, lpOverlapped=0x0) returned 1
[0084.934] GetLastError () returned 0x0
[0084.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf", lpFilePart=0x0) returned 0x5b
[0084.951] GetLastError () returned 0x0
[0084.951] SetErrorMode (uMode=0x1) returned 0x0
[0084.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\kmqwqfsabihhi9p.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.952] GetLastError () returned 0xb7
[0084.952] GetFileType (hFile=0x214) returned 0x1
[0084.952] GetFileType (hFile=0x214) returned 0x1
[0084.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf", lpFilePart=0x0) returned 0x5b
[0084.953] GetLastError () returned 0xb7
[0084.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf.LanRan2.0.5", lpFilePart=0x0) returned 0x67
[0084.953] GetLastError () returned 0xb7
[0084.953] SetErrorMode (uMode=0x1) returned 0x0
[0084.953] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\kmqwqfsabihhi9p.pdf"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7f0c8f0, ftCreationTime.dwHighDateTime=0x1d3a59c, ftLastAccessTime.dwLowDateTime=0x9c4dd7d0, ftLastAccessTime.dwHighDateTime=0x1d3ab10, ftLastWriteTime.dwLowDateTime=0x1798b40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x10580)) returned 1
[0084.953] GetLastError () returned 0xb7
[0084.953] SetErrorMode (uMode=0x0) returned 0x1
[0084.953] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\kmqwqfsabihhi9p.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\kmqwqfsabihhi9p.pdf.lanran2.0.5")) returned 1
[0084.954] GetLastError () returned 0xb7
[0084.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV", lpFilePart=0x0) returned 0x55
[0084.954] GetLastError () returned 0xb7
[0084.954] SetErrorMode (uMode=0x1) returned 0x0
[0084.954] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270
[0084.954] GetLastError () returned 0xb7
[0084.954] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.954] GetLastError () returned 0xb7
[0084.954] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.954] GetLastError () returned 0xb7
[0084.954] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.954] GetLastError () returned 0xb7
[0084.954] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0084.954] GetLastError () returned 0x12
[0084.954] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1
[0084.954] SetErrorMode (uMode=0x0) returned 0x1
[0084.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV", lpFilePart=0x0) returned 0x55
[0084.954] GetLastError () returned 0x12
[0084.954] SetErrorMode (uMode=0x1) returned 0x0
[0084.955] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270
[0084.955] GetLastError () returned 0x12
[0084.955] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.955] GetLastError () returned 0x12
[0084.955] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.955] GetLastError () returned 0x12
[0084.955] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0084.955] GetLastError () returned 0x12
[0084.955] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0084.955] GetLastError () returned 0x12
[0084.955] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1
[0084.955] SetErrorMode (uMode=0x0) returned 0x1
[0084.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf", lpFilePart=0x0) returned 0x6a
[0084.955] GetLastError () returned 0x12
[0084.955] SetErrorMode (uMode=0x1) returned 0x0
[0084.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\68pvefv6kr3oep2i.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0084.955] GetLastError () returned 0x0
[0084.955] GetFileType (hFile=0x214) returned 0x1
[0084.955] SetErrorMode (uMode=0x0) returned 0x1
[0084.955] GetFileType (hFile=0x214) returned 0x1
[0084.955] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39eb50 | out: lpFileSizeHigh=0x39eb50*=0x0) returned 0x162e9
[0084.955] GetLastError () returned 0x0
[0084.956] ReadFile (in: hFile=0x214, lpBuffer=0x36ae948, nNumberOfBytesToRead=0x162e9, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x36ae948*, lpNumberOfBytesRead=0x39eaf8*=0x162e9, lpOverlapped=0x0) returned 1
[0084.957] GetLastError () returned 0x0
[0084.957] CloseHandle (hObject=0x214) returned 1
[0084.957] GetLastError () returned 0x0
[0085.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf", lpFilePart=0x0) returned 0x6a
[0085.002] GetLastError () returned 0x0
[0085.002] SetErrorMode (uMode=0x1) returned 0x0
[0085.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\68pvefv6kr3oep2i.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.003] GetLastError () returned 0xb7
[0085.003] GetFileType (hFile=0x214) returned 0x1
[0085.003] GetFileType (hFile=0x214) returned 0x1
[0085.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf", lpFilePart=0x0) returned 0x6a
[0085.005] GetLastError () returned 0xb7
[0085.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf.LanRan2.0.5", lpFilePart=0x0) returned 0x76
[0085.005] GetLastError () returned 0xb7
[0085.005] SetErrorMode (uMode=0x1) returned 0x0
[0085.005] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\68pvefv6kr3oep2i.pdf"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x115bcd30, ftCreationTime.dwHighDateTime=0x1d3a4f8, ftLastAccessTime.dwLowDateTime=0x987d5c30, ftLastAccessTime.dwHighDateTime=0x1d3a0ba, ftLastWriteTime.dwLowDateTime=0x180af60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x162f0)) returned 1
[0085.005] GetLastError () returned 0xb7
[0085.005] SetErrorMode (uMode=0x0) returned 0x1
[0085.005] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\68pvefv6kr3oep2i.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\68pvefv6kr3oep2i.pdf.lanran2.0.5")) returned 1
[0085.005] GetLastError () returned 0xb7
[0085.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu", lpFilePart=0x0) returned 0x65
[0085.005] GetLastError () returned 0xb7
[0085.005] SetErrorMode (uMode=0x1) returned 0x0
[0085.005] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0085.006] GetLastError () returned 0xb7
[0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.006] GetLastError () returned 0xb7
[0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.006] GetLastError () returned 0xb7
[0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.006] GetLastError () returned 0xb7
[0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.006] GetLastError () returned 0xb7
[0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.006] GetLastError () returned 0xb7
[0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.006] GetLastError () returned 0xb7
[0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.006] GetLastError () returned 0xb7
[0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0085.006] GetLastError () returned 0x12
[0085.006] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0085.006] SetErrorMode (uMode=0x0) returned 0x1
[0085.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu", lpFilePart=0x0) returned 0x65
[0085.006] GetLastError () returned 0x12
[0085.006] SetErrorMode (uMode=0x1) returned 0x0
[0085.006] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0085.006] GetLastError () returned 0x12
[0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.006] GetLastError () returned 0x12
[0085.007] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.007] GetLastError () returned 0x12
[0085.007] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.007] GetLastError () returned 0x12
[0085.007] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.007] GetLastError () returned 0x12
[0085.007] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.007] GetLastError () returned 0x12
[0085.007] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.007] GetLastError () returned 0x12
[0085.007] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.007] GetLastError () returned 0x12
[0085.007] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0085.007] GetLastError () returned 0x12
[0085.007] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0085.007] SetErrorMode (uMode=0x0) returned 0x1
[0085.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx", lpFilePart=0x0) returned 0x7d
[0085.007] GetLastError () returned 0x12
[0085.007] SetErrorMode (uMode=0x1) returned 0x0
[0085.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\8frj-ri0s0j5l0bnl0.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.007] GetLastError () returned 0x0
[0085.007] GetFileType (hFile=0x214) returned 0x1
[0085.007] GetFileType (hFile=0x214) returned 0x1
[0085.007] ReadFile (in: hFile=0x214, lpBuffer=0x26b8f78, nNumberOfBytesToRead=0xc23b, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x26b8f78*, lpNumberOfBytesRead=0x39ea98*=0xc23b, lpOverlapped=0x0) returned 1
[0085.008] GetLastError () returned 0x0
[0085.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx", lpFilePart=0x0) returned 0x7d
[0085.057] GetLastError () returned 0x0
[0085.057] SetErrorMode (uMode=0x1) returned 0x0
[0085.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\8frj-ri0s0j5l0bnl0.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.058] GetLastError () returned 0xb7
[0085.058] GetFileType (hFile=0x214) returned 0x1
[0085.058] GetFileType (hFile=0x214) returned 0x1
[0085.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx", lpFilePart=0x0) returned 0x7d
[0085.059] GetLastError () returned 0xb7
[0085.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x89
[0085.059] GetLastError () returned 0xb7
[0085.059] SetErrorMode (uMode=0x1) returned 0x0
[0085.060] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\8frj-ri0s0j5l0bnl0.docx"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1a7f650, ftCreationTime.dwHighDateTime=0x1d3a97c, ftLastAccessTime.dwLowDateTime=0x32b93cb0, ftLastAccessTime.dwHighDateTime=0x1d3a309, ftLastWriteTime.dwLowDateTime=0x18a34e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xc240)) returned 1
[0085.060] GetLastError () returned 0xb7
[0085.060] SetErrorMode (uMode=0x0) returned 0x1
[0085.060] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\8frj-ri0s0j5l0bnl0.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\8frj-ri0s0j5l0bnl0.docx.lanran2.0.5")) returned 1
[0085.060] GetLastError () returned 0xb7
[0085.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx", lpFilePart=0x0) returned 0x6f
[0085.060] GetLastError () returned 0xb7
[0085.060] SetErrorMode (uMode=0x1) returned 0x0
[0085.060] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\sknb.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.060] GetLastError () returned 0x0
[0085.061] GetFileType (hFile=0x214) returned 0x1
[0085.061] GetFileType (hFile=0x214) returned 0x1
[0085.061] ReadFile (in: hFile=0x214, lpBuffer=0x257ea28, nNumberOfBytesToRead=0x207e, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x257ea28*, lpNumberOfBytesRead=0x39ea98*=0x207e, lpOverlapped=0x0) returned 1
[0085.061] GetLastError () returned 0x0
[0085.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx", lpFilePart=0x0) returned 0x6f
[0085.086] GetLastError () returned 0x0
[0085.086] SetErrorMode (uMode=0x1) returned 0x0
[0085.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\sknb.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.087] GetLastError () returned 0xb7
[0085.087] GetFileType (hFile=0x214) returned 0x1
[0085.087] GetFileType (hFile=0x214) returned 0x1
[0085.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx", lpFilePart=0x0) returned 0x6f
[0085.087] GetLastError () returned 0xb7
[0085.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x7b
[0085.088] GetLastError () returned 0xb7
[0085.088] SetErrorMode (uMode=0x1) returned 0x0
[0085.088] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\sknb.docx"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a04c0, ftCreationTime.dwHighDateTime=0x1d3ae4b, ftLastAccessTime.dwLowDateTime=0xbdfa7a60, ftLastAccessTime.dwHighDateTime=0x1d3a650, ftLastWriteTime.dwLowDateTime=0x18c9640, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x2080)) returned 1
[0085.088] GetLastError () returned 0xb7
[0085.088] SetErrorMode (uMode=0x0) returned 0x1
[0085.088] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\sknb.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\sknb.docx.lanran2.0.5")) returned 1
[0085.088] GetLastError () returned 0xb7
[0085.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc", lpFilePart=0x0) returned 0x77
[0085.088] GetLastError () returned 0xb7
[0085.088] SetErrorMode (uMode=0x1) returned 0x0
[0085.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\zks2iiid esy6.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.088] GetLastError () returned 0x0
[0085.089] GetFileType (hFile=0x214) returned 0x1
[0085.089] GetFileType (hFile=0x214) returned 0x1
[0085.089] ReadFile (in: hFile=0x214, lpBuffer=0x2613160, nNumberOfBytesToRead=0xa92a, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2613160*, lpNumberOfBytesRead=0x39ea98*=0xa92a, lpOverlapped=0x0) returned 1
[0085.089] GetLastError () returned 0x0
[0085.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc", lpFilePart=0x0) returned 0x77
[0085.115] GetLastError () returned 0x0
[0085.116] SetErrorMode (uMode=0x1) returned 0x0
[0085.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\zks2iiid esy6.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.116] GetLastError () returned 0xb7
[0085.117] GetFileType (hFile=0x214) returned 0x1
[0085.117] GetFileType (hFile=0x214) returned 0x1
[0085.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc", lpFilePart=0x0) returned 0x77
[0085.118] GetLastError () returned 0xb7
[0085.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc.LanRan2.0.5", lpFilePart=0x0) returned 0x83
[0085.118] GetLastError () returned 0xb7
[0085.118] SetErrorMode (uMode=0x1) returned 0x0
[0085.118] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\zks2iiid esy6.doc"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25616600, ftCreationTime.dwHighDateTime=0x1d3a516, ftLastAccessTime.dwLowDateTime=0xce5d3680, ftLastAccessTime.dwHighDateTime=0x1d3ac9b, ftLastWriteTime.dwLowDateTime=0x1915900, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xa930)) returned 1
[0085.118] GetLastError () returned 0xb7
[0085.118] SetErrorMode (uMode=0x0) returned 0x1
[0085.118] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\zks2iiid esy6.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\zks2iiid esy6.doc.lanran2.0.5")) returned 1
[0085.118] GetLastError () returned 0xb7
[0085.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x", lpFilePart=0x0) returned 0x4e
[0085.118] GetLastError () returned 0xb7
[0085.118] SetErrorMode (uMode=0x1) returned 0x0
[0085.119] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0085.119] GetLastError () returned 0xb7
[0085.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.119] GetLastError () returned 0xb7
[0085.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.119] GetLastError () returned 0xb7
[0085.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.119] GetLastError () returned 0xb7
[0085.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.119] GetLastError () returned 0xb7
[0085.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.119] GetLastError () returned 0xb7
[0085.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.119] GetLastError () returned 0xb7
[0085.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0085.119] GetLastError () returned 0x12
[0085.119] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0085.119] SetErrorMode (uMode=0x0) returned 0x1
[0085.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x", lpFilePart=0x0) returned 0x4e
[0085.119] GetLastError () returned 0x12
[0085.119] SetErrorMode (uMode=0x1) returned 0x0
[0085.119] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0085.120] GetLastError () returned 0x12
[0085.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.120] GetLastError () returned 0x12
[0085.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.120] GetLastError () returned 0x12
[0085.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.120] GetLastError () returned 0x12
[0085.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.120] GetLastError () returned 0x12
[0085.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.120] GetLastError () returned 0x12
[0085.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.120] GetLastError () returned 0x12
[0085.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0085.120] GetLastError () returned 0x12
[0085.120] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0085.120] SetErrorMode (uMode=0x0) returned 0x1
[0085.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf", lpFilePart=0x0) returned 0x62
[0085.120] GetLastError () returned 0x12
[0085.120] SetErrorMode (uMode=0x1) returned 0x0
[0085.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\bjjubvkfsudxx8e.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.121] GetLastError () returned 0x0
[0085.121] GetFileType (hFile=0x214) returned 0x1
[0085.121] SetErrorMode (uMode=0x0) returned 0x1
[0085.121] GetFileType (hFile=0x214) returned 0x1
[0085.121] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39eb50 | out: lpFileSizeHigh=0x39eb50*=0x0) returned 0x6a12
[0085.121] GetLastError () returned 0x0
[0085.121] ReadFile (in: hFile=0x214, lpBuffer=0x26c7270, nNumberOfBytesToRead=0x6a12, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x26c7270*, lpNumberOfBytesRead=0x39eaf8*=0x6a12, lpOverlapped=0x0) returned 1
[0085.122] GetLastError () returned 0x0
[0085.122] CloseHandle (hObject=0x214) returned 1
[0085.122] GetLastError () returned 0x0
[0085.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf", lpFilePart=0x0) returned 0x62
[0085.185] GetLastError () returned 0x0
[0085.185] SetErrorMode (uMode=0x1) returned 0x0
[0085.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\bjjubvkfsudxx8e.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.186] GetLastError () returned 0xb7
[0085.186] GetFileType (hFile=0x214) returned 0x1
[0085.186] GetFileType (hFile=0x214) returned 0x1
[0085.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf", lpFilePart=0x0) returned 0x62
[0085.187] GetLastError () returned 0xb7
[0085.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf.LanRan2.0.5", lpFilePart=0x0) returned 0x6e
[0085.187] GetLastError () returned 0xb7
[0085.187] SetErrorMode (uMode=0x1) returned 0x0
[0085.187] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\bjjubvkfsudxx8e.pdf"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc662c580, ftCreationTime.dwHighDateTime=0x1d3b015, ftLastAccessTime.dwLowDateTime=0x1f5c2910, ftLastAccessTime.dwHighDateTime=0x1d3a4d1, ftLastWriteTime.dwLowDateTime=0x19d3fe0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x6a20)) returned 1
[0085.187] GetLastError () returned 0xb7
[0085.187] SetErrorMode (uMode=0x0) returned 0x1
[0085.187] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\bjjubvkfsudxx8e.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\bjjubvkfsudxx8e.pdf.lanran2.0.5")) returned 1
[0085.187] GetLastError () returned 0xb7
[0085.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt", lpFilePart=0x0) returned 0x5c
[0085.187] GetLastError () returned 0xb7
[0085.187] SetErrorMode (uMode=0x1) returned 0x0
[0085.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\byp3mohke.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.188] GetLastError () returned 0x0
[0085.188] GetFileType (hFile=0x214) returned 0x1
[0085.188] SetErrorMode (uMode=0x0) returned 0x1
[0085.188] GetFileType (hFile=0x214) returned 0x1
[0085.188] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39eb50 | out: lpFileSizeHigh=0x39eb50*=0x0) returned 0xbf74
[0085.188] GetLastError () returned 0x0
[0085.188] ReadFile (in: hFile=0x214, lpBuffer=0x257e358, nNumberOfBytesToRead=0xbf74, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x257e358*, lpNumberOfBytesRead=0x39eaf8*=0xbf74, lpOverlapped=0x0) returned 1
[0085.189] GetLastError () returned 0x0
[0085.189] CloseHandle (hObject=0x214) returned 1
[0085.189] GetLastError () returned 0x0
[0085.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt", lpFilePart=0x0) returned 0x5c
[0085.244] GetLastError () returned 0x0
[0085.244] SetErrorMode (uMode=0x1) returned 0x0
[0085.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\byp3mohke.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.245] GetLastError () returned 0xb7
[0085.245] GetFileType (hFile=0x214) returned 0x1
[0085.245] GetFileType (hFile=0x214) returned 0x1
[0085.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt", lpFilePart=0x0) returned 0x5c
[0085.247] GetLastError () returned 0xb7
[0085.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt.LanRan2.0.5", lpFilePart=0x0) returned 0x68
[0085.247] GetLastError () returned 0xb7
[0085.247] SetErrorMode (uMode=0x1) returned 0x0
[0085.247] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\byp3mohke.odt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a810e0, ftCreationTime.dwHighDateTime=0x1d3a0ea, ftLastAccessTime.dwLowDateTime=0x9344b250, ftLastAccessTime.dwHighDateTime=0x1d3a2cb, ftLastWriteTime.dwLowDateTime=0x1a6c560, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xbf80)) returned 1
[0085.247] GetLastError () returned 0xb7
[0085.247] SetErrorMode (uMode=0x0) returned 0x1
[0085.247] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\byp3mohke.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\byp3mohke.odt.lanran2.0.5")) returned 1
[0085.247] GetLastError () returned 0xb7
[0085.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf", lpFilePart=0x0) returned 0x5d
[0085.248] GetLastError () returned 0xb7
[0085.248] SetErrorMode (uMode=0x1) returned 0x0
[0085.248] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\izz4jc1gbs.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.248] GetLastError () returned 0x0
[0085.248] GetFileType (hFile=0x214) returned 0x1
[0085.248] GetFileType (hFile=0x214) returned 0x1
[0085.248] ReadFile (in: hFile=0x214, lpBuffer=0x26364c4, nNumberOfBytesToRead=0x494e, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x26364c4*, lpNumberOfBytesRead=0x39eaf8*=0x494e, lpOverlapped=0x0) returned 1
[0085.249] GetLastError () returned 0x0
[0085.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf", lpFilePart=0x0) returned 0x5d
[0085.274] GetLastError () returned 0x0
[0085.274] SetErrorMode (uMode=0x1) returned 0x0
[0085.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\izz4jc1gbs.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.275] GetLastError () returned 0xb7
[0085.275] GetFileType (hFile=0x214) returned 0x1
[0085.275] GetFileType (hFile=0x214) returned 0x1
[0085.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf", lpFilePart=0x0) returned 0x5d
[0085.276] GetLastError () returned 0xb7
[0085.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf.LanRan2.0.5", lpFilePart=0x0) returned 0x69
[0085.276] GetLastError () returned 0xb7
[0085.276] SetErrorMode (uMode=0x1) returned 0x0
[0085.276] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\izz4jc1gbs.rtf"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b578980, ftCreationTime.dwHighDateTime=0x1d3a8a3, ftLastAccessTime.dwLowDateTime=0x2aba2a70, ftLastAccessTime.dwHighDateTime=0x1d3a1e6, ftLastWriteTime.dwLowDateTime=0x1a926c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x4950)) returned 1
[0085.276] GetLastError () returned 0xb7
[0085.276] SetErrorMode (uMode=0x0) returned 0x1
[0085.276] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\izz4jc1gbs.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\izz4jc1gbs.rtf.lanran2.0.5")) returned 1
[0085.277] GetLastError () returned 0xb7
[0085.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx", lpFilePart=0x0) returned 0x64
[0085.277] GetLastError () returned 0xb7
[0085.277] SetErrorMode (uMode=0x1) returned 0x0
[0085.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\nrgpxtgl5eovktsc.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.277] GetLastError () returned 0x0
[0085.277] GetFileType (hFile=0x214) returned 0x1
[0085.277] GetFileType (hFile=0x214) returned 0x1
[0085.277] ReadFile (in: hFile=0x214, lpBuffer=0x26d9e7c, nNumberOfBytesToRead=0xf719, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x26d9e7c*, lpNumberOfBytesRead=0x39eaf8*=0xf719, lpOverlapped=0x0) returned 1
[0085.278] GetLastError () returned 0x0
[0085.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx", lpFilePart=0x0) returned 0x64
[0085.307] GetLastError () returned 0x0
[0085.307] SetErrorMode (uMode=0x1) returned 0x0
[0085.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\nrgpxtgl5eovktsc.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.308] GetLastError () returned 0xb7
[0085.309] GetFileType (hFile=0x214) returned 0x1
[0085.309] SetErrorMode (uMode=0x0) returned 0x1
[0085.309] GetFileType (hFile=0x214) returned 0x1
[0085.309] WriteFile (in: hFile=0x214, lpBuffer=0x259264c*, nNumberOfBytesToWrite=0xf720, lpNumberOfBytesWritten=0x39eb04, lpOverlapped=0x0 | out: lpBuffer=0x259264c*, lpNumberOfBytesWritten=0x39eb04*=0xf720, lpOverlapped=0x0) returned 1
[0085.310] GetLastError () returned 0xb7
[0085.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx", lpFilePart=0x0) returned 0x64
[0085.310] GetLastError () returned 0xb7
[0085.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x70
[0085.310] GetLastError () returned 0xb7
[0085.310] SetErrorMode (uMode=0x1) returned 0x0
[0085.310] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\nrgpxtgl5eovktsc.docx"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x298d66f0, ftCreationTime.dwHighDateTime=0x1d3a5db, ftLastAccessTime.dwLowDateTime=0xf51c1910, ftLastAccessTime.dwHighDateTime=0x1d3a473, ftLastWriteTime.dwLowDateTime=0x1b04ae0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xf720)) returned 1
[0085.310] GetLastError () returned 0xb7
[0085.310] SetErrorMode (uMode=0x0) returned 0x1
[0085.311] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\nrgpxtgl5eovktsc.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\nrgpxtgl5eovktsc.docx.lanran2.0.5")) returned 1
[0085.312] GetLastError () returned 0xb7
[0085.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf", lpFilePart=0x0) returned 0x66
[0085.312] GetLastError () returned 0xb7
[0085.312] SetErrorMode (uMode=0x1) returned 0x0
[0085.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\q ovyk_kvwgwh45lu86.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.312] GetLastError () returned 0x0
[0085.312] GetFileType (hFile=0x214) returned 0x1
[0085.312] SetErrorMode (uMode=0x0) returned 0x1
[0085.313] GetFileType (hFile=0x214) returned 0x1
[0085.313] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39eb50 | out: lpFileSizeHigh=0x39eb50*=0x0) returned 0xb152
[0085.313] GetLastError () returned 0x0
[0085.313] ReadFile (in: hFile=0x214, lpBuffer=0x25a27a0, nNumberOfBytesToRead=0xb152, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x25a27a0*, lpNumberOfBytesRead=0x39eaf8*=0xb152, lpOverlapped=0x0) returned 1
[0085.313] GetLastError () returned 0x0
[0085.314] CloseHandle (hObject=0x214) returned 1
[0085.314] GetLastError () returned 0x0
[0085.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf", lpFilePart=0x0) returned 0x66
[0085.381] GetLastError () returned 0x0
[0085.381] SetErrorMode (uMode=0x1) returned 0x0
[0085.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\q ovyk_kvwgwh45lu86.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.382] GetLastError () returned 0xb7
[0085.382] GetFileType (hFile=0x214) returned 0x1
[0085.382] GetFileType (hFile=0x214) returned 0x1
[0085.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf", lpFilePart=0x0) returned 0x66
[0085.384] GetLastError () returned 0xb7
[0085.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf.LanRan2.0.5", lpFilePart=0x0) returned 0x72
[0085.384] GetLastError () returned 0xb7
[0085.384] SetErrorMode (uMode=0x1) returned 0x0
[0085.384] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\q ovyk_kvwgwh45lu86.rtf"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70935600, ftCreationTime.dwHighDateTime=0x1d3a161, ftLastAccessTime.dwLowDateTime=0x508dd5b0, ftLastAccessTime.dwHighDateTime=0x1d3abb1, ftLastWriteTime.dwLowDateTime=0x1b9d060, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xb160)) returned 1
[0085.384] GetLastError () returned 0xb7
[0085.384] SetErrorMode (uMode=0x0) returned 0x1
[0085.384] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\q ovyk_kvwgwh45lu86.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\q ovyk_kvwgwh45lu86.rtf.lanran2.0.5")) returned 1
[0085.384] GetLastError () returned 0xb7
[0085.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30
[0085.384] GetLastError () returned 0xb7
[0085.385] SetErrorMode (uMode=0x1) returned 0x0
[0085.385] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0xffffffff
[0085.385] GetLastError () returned 0x5
[0085.698] SetErrorMode (uMode=0x0) returned 0x1
[0085.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30
[0085.698] GetLastError () returned 0x5
[0085.698] SetErrorMode (uMode=0x1) returned 0x0
[0085.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0xffffffff
[0085.699] GetLastError () returned 0x5
[0085.701] SetErrorMode (uMode=0x0) returned 0x1
[0085.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33
[0085.817] GetLastError () returned 0x5
[0085.817] SetErrorMode (uMode=0x1) returned 0x0
[0085.817] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0xffffffff
[0085.817] GetLastError () returned 0x5
[0085.819] SetErrorMode (uMode=0x0) returned 0x1
[0085.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33
[0085.819] GetLastError () returned 0x5
[0085.819] SetErrorMode (uMode=0x1) returned 0x0
[0085.819] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0xffffffff
[0085.819] GetLastError () returned 0x5
[0085.821] SetErrorMode (uMode=0x0) returned 0x1
[0085.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31
[0085.828] GetLastError () returned 0x5
[0085.828] SetErrorMode (uMode=0x1) returned 0x0
[0085.829] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270
[0085.829] GetLastError () returned 0x5
[0085.829] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.830] GetLastError () returned 0x5
[0085.830] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.830] GetLastError () returned 0x5
[0085.830] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.830] GetLastError () returned 0x5
[0085.830] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.830] GetLastError () returned 0x5
[0085.830] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0085.830] GetLastError () returned 0x12
[0085.831] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1
[0085.831] SetErrorMode (uMode=0x0) returned 0x1
[0085.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31
[0085.831] GetLastError () returned 0x12
[0085.831] SetErrorMode (uMode=0x1) returned 0x0
[0085.831] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270
[0085.831] GetLastError () returned 0x12
[0085.831] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.831] GetLastError () returned 0x12
[0085.832] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.832] GetLastError () returned 0x12
[0085.832] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.832] GetLastError () returned 0x12
[0085.832] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.832] GetLastError () returned 0x12
[0085.832] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0085.832] GetLastError () returned 0x12
[0085.832] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1
[0085.832] SetErrorMode (uMode=0x0) returned 0x1
[0085.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a
[0085.833] GetLastError () returned 0x12
[0085.833] SetErrorMode (uMode=0x1) returned 0x0
[0085.833] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270
[0085.896] GetLastError () returned 0x12
[0085.897] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.897] GetLastError () returned 0x12
[0085.897] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.897] GetLastError () returned 0x12
[0085.897] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0085.897] GetLastError () returned 0x12
[0085.897] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1
[0085.897] SetErrorMode (uMode=0x0) returned 0x1
[0085.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a
[0085.923] GetLastError () returned 0x12
[0085.923] SetErrorMode (uMode=0x1) returned 0x0
[0085.923] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270
[0085.924] GetLastError () returned 0x12
[0085.924] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.924] GetLastError () returned 0x12
[0085.924] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0085.924] GetLastError () returned 0x12
[0085.924] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0085.924] GetLastError () returned 0x12
[0085.924] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1
[0085.924] SetErrorMode (uMode=0x0) returned 0x1
[0085.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x45
[0085.924] GetLastError () returned 0x12
[0085.924] SetErrorMode (uMode=0x1) returned 0x0
[0085.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0085.925] GetLastError () returned 0x0
[0085.925] GetFileType (hFile=0x214) returned 0x1
[0085.926] SetErrorMode (uMode=0x0) returned 0x1
[0085.926] GetFileType (hFile=0x214) returned 0x1
[0085.926] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0x74e6
[0085.926] GetLastError () returned 0x0
[0085.926] ReadFile (in: hFile=0x214, lpBuffer=0x24e797c, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x24e797c*, lpNumberOfBytesRead=0x39eb58*=0x74e6, lpOverlapped=0x0) returned 1
[0085.970] GetLastError () returned 0x0
[0085.970] CloseHandle (hObject=0x214) returned 1
[0085.970] GetLastError () returned 0x0
[0086.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x45
[0086.030] GetLastError () returned 0x0
[0086.030] SetErrorMode (uMode=0x1) returned 0x0
[0086.030] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
[0086.030] GetLastError () returned 0x5
[0086.055] SetErrorMode (uMode=0x0) returned 0x1
[0086.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31
[0086.056] GetLastError () returned 0x5
[0086.056] SetErrorMode (uMode=0x1) returned 0x0
[0086.056] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0xffffffff
[0086.056] GetLastError () returned 0x5
[0086.058] SetErrorMode (uMode=0x0) returned 0x1
[0086.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31
[0086.058] GetLastError () returned 0x5
[0086.058] SetErrorMode (uMode=0x1) returned 0x0
[0086.059] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0xffffffff
[0086.059] GetLastError () returned 0x5
[0086.061] SetErrorMode (uMode=0x0) returned 0x1
[0086.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35
[0086.071] GetLastError () returned 0x5
[0086.071] SetErrorMode (uMode=0x1) returned 0x0
[0086.071] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570
[0086.071] GetLastError () returned 0x5
[0086.071] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.072] GetLastError () returned 0x5
[0086.072] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.072] GetLastError () returned 0x5
[0086.072] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0086.072] GetLastError () returned 0x12
[0086.072] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1
[0086.072] SetErrorMode (uMode=0x0) returned 0x1
[0086.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35
[0086.073] GetLastError () returned 0x12
[0086.073] SetErrorMode (uMode=0x1) returned 0x0
[0086.073] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570
[0086.073] GetLastError () returned 0x12
[0086.073] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.073] GetLastError () returned 0x12
[0086.073] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.073] GetLastError () returned 0x12
[0086.074] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0086.074] GetLastError () returned 0x12
[0086.074] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1
[0086.074] SetErrorMode (uMode=0x0) returned 0x1
[0086.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9", lpFilePart=0x0) returned 0x38
[0086.074] GetLastError () returned 0x12
[0086.074] SetErrorMode (uMode=0x1) returned 0x0
[0086.074] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570
[0086.074] GetLastError () returned 0x12
[0086.075] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.075] GetLastError () returned 0x12
[0086.075] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.075] GetLastError () returned 0x12
[0086.075] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.075] GetLastError () returned 0x12
[0086.075] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.075] GetLastError () returned 0x12
[0086.076] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.076] GetLastError () returned 0x12
[0086.076] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0086.076] GetLastError () returned 0x12
[0086.076] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1
[0086.077] SetErrorMode (uMode=0x0) returned 0x1
[0086.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9", lpFilePart=0x0) returned 0x38
[0086.077] GetLastError () returned 0x12
[0086.077] SetErrorMode (uMode=0x1) returned 0x0
[0086.077] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570
[0086.078] GetLastError () returned 0x12
[0086.078] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.078] GetLastError () returned 0x12
[0086.078] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.078] GetLastError () returned 0x12
[0086.079] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.079] GetLastError () returned 0x12
[0086.079] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.079] GetLastError () returned 0x12
[0086.080] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.080] GetLastError () returned 0x12
[0086.080] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0086.080] GetLastError () returned 0x12
[0086.081] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1
[0086.081] SetErrorMode (uMode=0x0) returned 0x1
[0086.081] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx", lpFilePart=0x0) returned 0x46
[0086.081] GetLastError () returned 0x12
[0086.081] SetErrorMode (uMode=0x1) returned 0x0
[0086.081] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\jsk 9b9p.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0086.081] GetLastError () returned 0x0
[0086.081] GetFileType (hFile=0x214) returned 0x1
[0086.081] SetErrorMode (uMode=0x0) returned 0x1
[0086.081] GetFileType (hFile=0x214) returned 0x1
[0086.081] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ec10 | out: lpFileSizeHigh=0x39ec10*=0x0) returned 0x12590
[0086.081] GetLastError () returned 0x0
[0086.082] ReadFile (in: hFile=0x214, lpBuffer=0x259f758, nNumberOfBytesToRead=0x12590, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x259f758*, lpNumberOfBytesRead=0x39ebb8*=0x12590, lpOverlapped=0x0) returned 1
[0086.083] GetLastError () returned 0x0
[0086.083] CloseHandle (hObject=0x214) returned 1
[0086.083] GetLastError () returned 0x0
[0086.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx", lpFilePart=0x0) returned 0x46
[0086.164] GetLastError () returned 0x0
[0086.164] SetErrorMode (uMode=0x1) returned 0x0
[0086.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\jsk 9b9p.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0086.165] GetLastError () returned 0xb7
[0086.165] GetFileType (hFile=0x214) returned 0x1
[0086.165] GetFileType (hFile=0x214) returned 0x1
[0086.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx", lpFilePart=0x0) returned 0x46
[0086.173] GetLastError () returned 0xb7
[0086.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x52
[0086.173] GetLastError () returned 0xb7
[0086.173] SetErrorMode (uMode=0x1) returned 0x0
[0086.173] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\jsk 9b9p.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e04cca0, ftCreationTime.dwHighDateTime=0x1d3ad2c, ftLastAccessTime.dwLowDateTime=0x225131f0, ftLastAccessTime.dwHighDateTime=0x1d3a699, ftLastWriteTime.dwLowDateTime=0x2333680, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x125a0)) returned 1
[0086.173] GetLastError () returned 0xb7
[0086.173] SetErrorMode (uMode=0x0) returned 0x1
[0086.174] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\jsk 9b9p.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\jsk 9b9p.docx.lanran2.0.5")) returned 1
[0086.175] GetLastError () returned 0xb7
[0086.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt", lpFilePart=0x0) returned 0x4d
[0086.176] GetLastError () returned 0xb7
[0086.176] SetErrorMode (uMode=0x1) returned 0x0
[0086.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\kplxgjplfarmrz5m.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0086.176] GetLastError () returned 0x0
[0086.176] GetFileType (hFile=0x214) returned 0x1
[0086.176] GetFileType (hFile=0x214) returned 0x1
[0086.176] ReadFile (in: hFile=0x214, lpBuffer=0x2670edc, nNumberOfBytesToRead=0xdf80, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x2670edc*, lpNumberOfBytesRead=0x39ebb8*=0xdf80, lpOverlapped=0x0) returned 1
[0086.177] GetLastError () returned 0x0
[0086.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt", lpFilePart=0x0) returned 0x4d
[0086.254] GetLastError () returned 0x0
[0086.254] SetErrorMode (uMode=0x1) returned 0x0
[0086.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\kplxgjplfarmrz5m.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0086.255] GetLastError () returned 0xb7
[0086.255] GetFileType (hFile=0x214) returned 0x1
[0086.255] GetFileType (hFile=0x214) returned 0x1
[0086.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt", lpFilePart=0x0) returned 0x4d
[0086.256] GetLastError () returned 0xb7
[0086.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt.LanRan2.0.5", lpFilePart=0x0) returned 0x59
[0086.256] GetLastError () returned 0xb7
[0086.256] SetErrorMode (uMode=0x1) returned 0x0
[0086.256] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\kplxgjplfarmrz5m.ppt"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6f65190, ftCreationTime.dwHighDateTime=0x1d3a3ef, ftLastAccessTime.dwLowDateTime=0x5adc0ef0, ftLastAccessTime.dwHighDateTime=0x1d3a44b, ftLastWriteTime.dwLowDateTime=0x23f1d60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xdf90)) returned 1
[0086.256] GetLastError () returned 0xb7
[0086.256] SetErrorMode (uMode=0x0) returned 0x1
[0086.256] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\kplxgjplfarmrz5m.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\kplxgjplfarmrz5m.ppt.lanran2.0.5")) returned 1
[0086.257] GetLastError () returned 0xb7
[0086.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt", lpFilePart=0x0) returned 0x43
[0086.257] GetLastError () returned 0xb7
[0086.257] SetErrorMode (uMode=0x1) returned 0x0
[0086.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\qc2b7i.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0086.257] GetLastError () returned 0x0
[0086.257] GetFileType (hFile=0x214) returned 0x1
[0086.257] GetFileType (hFile=0x214) returned 0x1
[0086.257] ReadFile (in: hFile=0x214, lpBuffer=0x253fe24, nNumberOfBytesToRead=0x10e8e, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x253fe24*, lpNumberOfBytesRead=0x39ebb8*=0x10e8e, lpOverlapped=0x0) returned 1
[0086.258] GetLastError () returned 0x0
[0086.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt", lpFilePart=0x0) returned 0x43
[0086.285] GetLastError () returned 0x0
[0086.285] SetErrorMode (uMode=0x1) returned 0x0
[0086.286] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\qc2b7i.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214
[0086.286] GetLastError () returned 0xb7
[0086.287] GetFileType (hFile=0x214) returned 0x1
[0086.287] GetFileType (hFile=0x214) returned 0x1
[0086.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt", lpFilePart=0x0) returned 0x43
[0086.288] GetLastError () returned 0xb7
[0086.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt.LanRan2.0.5", lpFilePart=0x0) returned 0x4f
[0086.288] GetLastError () returned 0xb7
[0086.288] SetErrorMode (uMode=0x1) returned 0x0
[0086.288] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\qc2b7i.odt"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f777740, ftCreationTime.dwHighDateTime=0x1d3a0ef, ftLastAccessTime.dwLowDateTime=0xba6bc110, ftLastAccessTime.dwHighDateTime=0x1d3a13c, ftLastWriteTime.dwLowDateTime=0x243e020, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x10e90)) returned 1
[0086.288] GetLastError () returned 0xb7
[0086.288] SetErrorMode (uMode=0x0) returned 0x1
[0086.288] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\qc2b7i.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\qc2b7i.odt.lanran2.0.5")) returned 1
[0086.289] GetLastError () returned 0xb7
[0086.289] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 0x0
[0086.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26
[0086.290] GetLastError () returned 0x3f0
[0086.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27
[0086.291] GetLastError () returned 0x3f0
[0086.291] SetErrorMode (uMode=0x1) returned 0x0
[0086.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0086.291] GetLastError () returned 0x3f0
[0086.291] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.291] GetLastError () returned 0x3f0
[0086.291] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.291] GetLastError () returned 0x3f0
[0086.291] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.291] GetLastError () returned 0x3f0
[0086.291] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.291] GetLastError () returned 0x3f0
[0086.292] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.292] GetLastError () returned 0x3f0
[0086.292] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.292] GetLastError () returned 0x3f0
[0086.292] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.292] GetLastError () returned 0x3f0
[0086.292] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0086.292] GetLastError () returned 0x12
[0086.292] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0086.292] SetErrorMode (uMode=0x0) returned 0x1
[0086.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27
[0086.293] GetLastError () returned 0x12
[0086.293] SetErrorMode (uMode=0x1) returned 0x0
[0086.293] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0086.293] GetLastError () returned 0x12
[0086.293] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.293] GetLastError () returned 0x12
[0086.293] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.293] GetLastError () returned 0x12
[0086.293] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.293] GetLastError () returned 0x12
[0086.293] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.293] GetLastError () returned 0x12
[0086.294] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.294] GetLastError () returned 0x12
[0086.294] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.294] GetLastError () returned 0x12
[0086.294] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.294] GetLastError () returned 0x12
[0086.294] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0086.294] GetLastError () returned 0x12
[0086.294] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0086.294] SetErrorMode (uMode=0x0) returned 0x1
[0086.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif", lpFilePart=0x0) returned 0x31
[0086.294] GetLastError () returned 0x12
[0086.294] SetErrorMode (uMode=0x1) returned 0x0
[0086.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\humj9n.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.294] GetLastError () returned 0x0
[0086.294] GetFileType (hFile=0x210) returned 0x1
[0086.295] SetErrorMode (uMode=0x0) returned 0x1
[0086.295] GetFileType (hFile=0x210) returned 0x1
[0086.295] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0xed7e
[0086.295] GetLastError () returned 0x0
[0086.295] ReadFile (in: hFile=0x210, lpBuffer=0x260d3cc, nNumberOfBytesToRead=0xed7e, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x260d3cc*, lpNumberOfBytesRead=0x39ec18*=0xed7e, lpOverlapped=0x0) returned 1
[0086.295] GetLastError () returned 0x0
[0086.295] CloseHandle (hObject=0x210) returned 1
[0086.295] GetLastError () returned 0x0
[0086.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif", lpFilePart=0x0) returned 0x31
[0086.353] GetLastError () returned 0x0
[0086.353] SetErrorMode (uMode=0x1) returned 0x0
[0086.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\humj9n.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.354] GetLastError () returned 0xb7
[0086.354] GetFileType (hFile=0x210) returned 0x1
[0086.355] GetFileType (hFile=0x210) returned 0x1
[0086.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif", lpFilePart=0x0) returned 0x31
[0086.356] GetLastError () returned 0xb7
[0086.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x3d
[0086.356] GetLastError () returned 0xb7
[0086.356] SetErrorMode (uMode=0x1) returned 0x0
[0086.356] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\humj9n.gif"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x841e7390, ftCreationTime.dwHighDateTime=0x1d3a1bf, ftLastAccessTime.dwLowDateTime=0x36b93700, ftLastAccessTime.dwHighDateTime=0x1d3ac52, ftLastWriteTime.dwLowDateTime=0x24fc700, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xed80)) returned 1
[0086.356] GetLastError () returned 0xb7
[0086.356] SetErrorMode (uMode=0x0) returned 0x1
[0086.356] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\humj9n.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\humj9n.gif.lanran2.0.5")) returned 1
[0086.357] GetLastError () returned 0xb7
[0086.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png", lpFilePart=0x0) returned 0x33
[0086.357] GetLastError () returned 0xb7
[0086.357] SetErrorMode (uMode=0x1) returned 0x0
[0086.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rusj4 m1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.357] GetLastError () returned 0x0
[0086.357] GetFileType (hFile=0x210) returned 0x1
[0086.357] GetFileType (hFile=0x210) returned 0x1
[0086.357] ReadFile (in: hFile=0x210, lpBuffer=0x26d09dc, nNumberOfBytesToRead=0x3a4a, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26d09dc*, lpNumberOfBytesRead=0x39ec18*=0x3a4a, lpOverlapped=0x0) returned 1
[0086.358] GetLastError () returned 0x0
[0086.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png", lpFilePart=0x0) returned 0x33
[0086.417] GetLastError () returned 0x0
[0086.417] SetErrorMode (uMode=0x1) returned 0x0
[0086.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rusj4 m1.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.418] GetLastError () returned 0xb7
[0086.418] GetFileType (hFile=0x210) returned 0x1
[0086.418] GetFileType (hFile=0x210) returned 0x1
[0086.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png", lpFilePart=0x0) returned 0x33
[0086.419] GetLastError () returned 0xb7
[0086.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png.LanRan2.0.5", lpFilePart=0x0) returned 0x3f
[0086.419] GetLastError () returned 0xb7
[0086.419] SetErrorMode (uMode=0x1) returned 0x0
[0086.419] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rusj4 m1.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aadf6b0, ftCreationTime.dwHighDateTime=0x1d3a5f7, ftLastAccessTime.dwLowDateTime=0xfcc55f70, ftLastAccessTime.dwHighDateTime=0x1d3a08e, ftLastWriteTime.dwLowDateTime=0x2594c80, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x3a50)) returned 1
[0086.419] GetLastError () returned 0xb7
[0086.419] SetErrorMode (uMode=0x0) returned 0x1
[0086.419] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rusj4 m1.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rusj4 m1.png.lanran2.0.5")) returned 1
[0086.420] GetLastError () returned 0xb7
[0086.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif", lpFilePart=0x0) returned 0x3a
[0086.420] GetLastError () returned 0xb7
[0086.420] SetErrorMode (uMode=0x1) returned 0x0
[0086.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sqh i6mbe59ed2t.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.420] GetLastError () returned 0x0
[0086.420] GetFileType (hFile=0x210) returned 0x1
[0086.420] GetFileType (hFile=0x210) returned 0x1
[0086.420] ReadFile (in: hFile=0x210, lpBuffer=0x2571fa8, nNumberOfBytesToRead=0xb823, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2571fa8*, lpNumberOfBytesRead=0x39ec18*=0xb823, lpOverlapped=0x0) returned 1
[0086.421] GetLastError () returned 0x0
[0086.447] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif", lpFilePart=0x0) returned 0x3a
[0086.447] GetLastError () returned 0x0
[0086.447] SetErrorMode (uMode=0x1) returned 0x0
[0086.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sqh i6mbe59ed2t.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.448] GetLastError () returned 0xb7
[0086.449] GetFileType (hFile=0x210) returned 0x1
[0086.449] GetFileType (hFile=0x210) returned 0x1
[0086.450] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif", lpFilePart=0x0) returned 0x3a
[0086.450] GetLastError () returned 0xb7
[0086.450] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x46
[0086.450] GetLastError () returned 0xb7
[0086.450] SetErrorMode (uMode=0x1) returned 0x0
[0086.450] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sqh i6mbe59ed2t.gif"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c4f980, ftCreationTime.dwHighDateTime=0x1d3ad85, ftLastAccessTime.dwLowDateTime=0xaa4f7d30, ftLastAccessTime.dwHighDateTime=0x1d3a7bd, ftLastWriteTime.dwLowDateTime=0x25e0f40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xb830)) returned 1
[0086.450] GetLastError () returned 0xb7
[0086.450] SetErrorMode (uMode=0x0) returned 0x1
[0086.450] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sqh i6mbe59ed2t.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sqh i6mbe59ed2t.gif.lanran2.0.5")) returned 1
[0086.450] GetLastError () returned 0xb7
[0086.451] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif", lpFilePart=0x0) returned 0x3e
[0086.451] GetLastError () returned 0xb7
[0086.451] SetErrorMode (uMode=0x1) returned 0x0
[0086.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\svhxap79kwj1dxgdwqi.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.451] GetLastError () returned 0x0
[0086.451] GetFileType (hFile=0x210) returned 0x1
[0086.451] GetFileType (hFile=0x210) returned 0x1
[0086.451] ReadFile (in: hFile=0x210, lpBuffer=0x26282a8, nNumberOfBytesToRead=0xe25b, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26282a8*, lpNumberOfBytesRead=0x39ec18*=0xe25b, lpOverlapped=0x0) returned 1
[0086.452] GetLastError () returned 0x0
[0086.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif", lpFilePart=0x0) returned 0x3e
[0086.480] GetLastError () returned 0x0
[0086.480] SetErrorMode (uMode=0x1) returned 0x0
[0086.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\svhxap79kwj1dxgdwqi.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.481] GetLastError () returned 0xb7
[0086.481] GetFileType (hFile=0x210) returned 0x1
[0086.481] SetErrorMode (uMode=0x0) returned 0x1
[0086.481] GetFileType (hFile=0x210) returned 0x1
[0086.481] WriteFile (in: hFile=0x210, lpBuffer=0x24e065c*, nNumberOfBytesToWrite=0xe260, lpNumberOfBytesWritten=0x39ec24, lpOverlapped=0x0 | out: lpBuffer=0x24e065c*, lpNumberOfBytesWritten=0x39ec24*=0xe260, lpOverlapped=0x0) returned 1
[0086.483] GetLastError () returned 0xb7
[0086.483] CloseHandle (hObject=0x210) returned 1
[0086.484] GetLastError () returned 0xb7
[0086.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif", lpFilePart=0x0) returned 0x3e
[0086.484] GetLastError () returned 0xb7
[0086.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x4a
[0086.484] GetLastError () returned 0xb7
[0086.484] SetErrorMode (uMode=0x1) returned 0x0
[0086.484] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\svhxap79kwj1dxgdwqi.gif"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7193d140, ftCreationTime.dwHighDateTime=0x1d3a910, ftLastAccessTime.dwLowDateTime=0xee8a5c60, ftLastAccessTime.dwHighDateTime=0x1d3a3a6, ftLastWriteTime.dwLowDateTime=0x262d200, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xe260)) returned 1
[0086.484] GetLastError () returned 0xb7
[0086.484] SetErrorMode (uMode=0x0) returned 0x1
[0086.485] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\svhxap79kwj1dxgdwqi.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\svhxap79kwj1dxgdwqi.gif.lanran2.0.5")) returned 1
[0086.485] GetLastError () returned 0xb7
[0086.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ", lpFilePart=0x0) returned 0x3a
[0086.485] GetLastError () returned 0xb7
[0086.485] SetErrorMode (uMode=0x1) returned 0x0
[0086.485] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570
[0086.485] GetLastError () returned 0xb7
[0086.485] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.486] GetLastError () returned 0xb7
[0086.486] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.486] GetLastError () returned 0xb7
[0086.486] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.486] GetLastError () returned 0xb7
[0086.486] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.486] GetLastError () returned 0xb7
[0086.486] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.486] GetLastError () returned 0xb7
[0086.486] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.486] GetLastError () returned 0xb7
[0086.487] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.487] GetLastError () returned 0xb7
[0086.487] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0086.487] GetLastError () returned 0x12
[0086.487] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1
[0086.487] SetErrorMode (uMode=0x0) returned 0x1
[0086.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ", lpFilePart=0x0) returned 0x3a
[0086.487] GetLastError () returned 0x12
[0086.487] SetErrorMode (uMode=0x1) returned 0x0
[0086.487] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570
[0086.487] GetLastError () returned 0x12
[0086.487] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.488] GetLastError () returned 0x12
[0086.488] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.488] GetLastError () returned 0x12
[0086.488] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.488] GetLastError () returned 0x12
[0086.488] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.488] GetLastError () returned 0x12
[0086.488] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.488] GetLastError () returned 0x12
[0086.488] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.488] GetLastError () returned 0x12
[0086.489] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.489] GetLastError () returned 0x12
[0086.489] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0086.489] GetLastError () returned 0x12
[0086.489] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1
[0086.489] SetErrorMode (uMode=0x0) returned 0x1
[0086.489] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif", lpFilePart=0x0) returned 0x4d
[0086.489] GetLastError () returned 0x12
[0086.489] SetErrorMode (uMode=0x1) returned 0x0
[0086.489] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\4qwn3lf10ala6b.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.489] GetLastError () returned 0x0
[0086.489] GetFileType (hFile=0x210) returned 0x1
[0086.489] SetErrorMode (uMode=0x0) returned 0x1
[0086.489] GetFileType (hFile=0x210) returned 0x1
[0086.489] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39ec10 | out: lpFileSizeHigh=0x39ec10*=0x0) returned 0x115a0
[0086.490] GetLastError () returned 0x0
[0086.490] ReadFile (in: hFile=0x210, lpBuffer=0x24f0b38, nNumberOfBytesToRead=0x115a0, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x24f0b38*, lpNumberOfBytesRead=0x39ebb8*=0x115a0, lpOverlapped=0x0) returned 1
[0086.490] GetLastError () returned 0x0
[0086.490] CloseHandle (hObject=0x210) returned 1
[0086.490] GetLastError () returned 0x0
[0086.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif", lpFilePart=0x0) returned 0x4d
[0086.535] GetLastError () returned 0x0
[0086.535] SetErrorMode (uMode=0x1) returned 0x0
[0086.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\4qwn3lf10ala6b.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.536] GetLastError () returned 0xb7
[0086.536] GetFileType (hFile=0x210) returned 0x1
[0086.536] GetFileType (hFile=0x210) returned 0x1
[0086.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif", lpFilePart=0x0) returned 0x4d
[0086.537] GetLastError () returned 0xb7
[0086.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x59
[0086.537] GetLastError () returned 0xb7
[0086.537] SetErrorMode (uMode=0x1) returned 0x0
[0086.537] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\4qwn3lf10ala6b.gif"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46df23f0, ftCreationTime.dwHighDateTime=0x1d3affa, ftLastAccessTime.dwLowDateTime=0x5f5e8bc0, ftLastAccessTime.dwHighDateTime=0x1d3a4f9, ftLastWriteTime.dwLowDateTime=0x269f620, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x115b0)) returned 1
[0086.537] GetLastError () returned 0xb7
[0086.537] SetErrorMode (uMode=0x0) returned 0x1
[0086.537] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\4qwn3lf10ala6b.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\4qwn3lf10ala6b.gif.lanran2.0.5")) returned 1
[0086.538] GetLastError () returned 0xb7
[0086.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png", lpFilePart=0x0) returned 0x4e
[0086.538] GetLastError () returned 0xb7
[0086.538] SetErrorMode (uMode=0x1) returned 0x0
[0086.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\d9oryucu13enryj.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.538] GetLastError () returned 0x0
[0086.538] GetFileType (hFile=0x210) returned 0x1
[0086.538] GetFileType (hFile=0x210) returned 0x1
[0086.538] ReadFile (in: hFile=0x210, lpBuffer=0x25be4dc, nNumberOfBytesToRead=0x6099, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x25be4dc*, lpNumberOfBytesRead=0x39ebb8*=0x6099, lpOverlapped=0x0) returned 1
[0086.539] GetLastError () returned 0x0
[0086.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png", lpFilePart=0x0) returned 0x4e
[0086.555] GetLastError () returned 0x0
[0086.555] SetErrorMode (uMode=0x1) returned 0x0
[0086.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\d9oryucu13enryj.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.556] GetLastError () returned 0xb7
[0086.556] GetFileType (hFile=0x210) returned 0x1
[0086.556] GetFileType (hFile=0x210) returned 0x1
[0086.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png", lpFilePart=0x0) returned 0x4e
[0086.557] GetLastError () returned 0xb7
[0086.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png.LanRan2.0.5", lpFilePart=0x0) returned 0x5a
[0086.557] GetLastError () returned 0xb7
[0086.557] SetErrorMode (uMode=0x1) returned 0x0
[0086.557] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\d9oryucu13enryj.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde6e0640, ftCreationTime.dwHighDateTime=0x1d3a6aa, ftLastAccessTime.dwLowDateTime=0xe601b130, ftLastAccessTime.dwHighDateTime=0x1d3b04c, ftLastWriteTime.dwLowDateTime=0x26c5780, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x60a0)) returned 1
[0086.557] GetLastError () returned 0xb7
[0086.557] SetErrorMode (uMode=0x0) returned 0x1
[0086.557] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\d9oryucu13enryj.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\d9oryucu13enryj.png.lanran2.0.5")) returned 1
[0086.557] GetLastError () returned 0xb7
[0086.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png", lpFilePart=0x0) returned 0x49
[0086.557] GetLastError () returned 0xb7
[0086.557] SetErrorMode (uMode=0x1) returned 0x0
[0086.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\lptpzz0usr.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.557] GetLastError () returned 0x0
[0086.557] GetFileType (hFile=0x210) returned 0x1
[0086.558] GetFileType (hFile=0x210) returned 0x1
[0086.558] ReadFile (in: hFile=0x210, lpBuffer=0x266a9c8, nNumberOfBytesToRead=0x2e45, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x266a9c8*, lpNumberOfBytesRead=0x39ebb8*=0x2e45, lpOverlapped=0x0) returned 1
[0086.558] GetLastError () returned 0x0
[0086.620] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png", lpFilePart=0x0) returned 0x49
[0086.620] GetLastError () returned 0x0
[0086.620] SetErrorMode (uMode=0x1) returned 0x0
[0086.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\lptpzz0usr.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.621] GetLastError () returned 0xb7
[0086.621] GetFileType (hFile=0x210) returned 0x1
[0086.621] GetFileType (hFile=0x210) returned 0x1
[0086.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png", lpFilePart=0x0) returned 0x49
[0086.622] GetLastError () returned 0xb7
[0086.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png.LanRan2.0.5", lpFilePart=0x0) returned 0x55
[0086.622] GetLastError () returned 0xb7
[0086.622] SetErrorMode (uMode=0x1) returned 0x0
[0086.622] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\lptpzz0usr.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b95350, ftCreationTime.dwHighDateTime=0x1d3aa85, ftLastAccessTime.dwLowDateTime=0xf3851520, ftLastAccessTime.dwHighDateTime=0x1d3a5c2, ftLastWriteTime.dwLowDateTime=0x2783e60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x2e50)) returned 1
[0086.623] GetLastError () returned 0xb7
[0086.623] SetErrorMode (uMode=0x0) returned 0x1
[0086.623] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\lptpzz0usr.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\lptpzz0usr.png.lanran2.0.5")) returned 1
[0086.623] GetLastError () returned 0xb7
[0086.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif", lpFilePart=0x0) returned 0x52
[0086.623] GetLastError () returned 0xb7
[0086.623] SetErrorMode (uMode=0x1) returned 0x0
[0086.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\ofsqsvy_9-o5srbuc-f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.623] GetLastError () returned 0x0
[0086.623] GetFileType (hFile=0x210) returned 0x1
[0086.623] GetFileType (hFile=0x210) returned 0x1
[0086.623] ReadFile (in: hFile=0x210, lpBuffer=0x2507594, nNumberOfBytesToRead=0x2449, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x2507594*, lpNumberOfBytesRead=0x39ebb8*=0x2449, lpOverlapped=0x0) returned 1
[0086.624] GetLastError () returned 0x0
[0086.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif", lpFilePart=0x0) returned 0x52
[0086.648] GetLastError () returned 0x0
[0086.648] SetErrorMode (uMode=0x1) returned 0x0
[0086.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\ofsqsvy_9-o5srbuc-f.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.650] GetLastError () returned 0xb7
[0086.650] GetFileType (hFile=0x210) returned 0x1
[0086.650] GetFileType (hFile=0x210) returned 0x1
[0086.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif", lpFilePart=0x0) returned 0x52
[0086.651] GetLastError () returned 0xb7
[0086.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x5e
[0086.651] GetLastError () returned 0xb7
[0086.651] SetErrorMode (uMode=0x1) returned 0x0
[0086.651] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\ofsqsvy_9-o5srbuc-f.gif"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37dc9320, ftCreationTime.dwHighDateTime=0x1d3a414, ftLastAccessTime.dwLowDateTime=0x74bcad0, ftLastAccessTime.dwHighDateTime=0x1d3a0ec, ftLastWriteTime.dwLowDateTime=0x27d0120, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x2450)) returned 1
[0086.651] GetLastError () returned 0xb7
[0086.651] SetErrorMode (uMode=0x0) returned 0x1
[0086.651] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\ofsqsvy_9-o5srbuc-f.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\ofsqsvy_9-o5srbuc-f.gif.lanran2.0.5")) returned 1
[0086.651] GetLastError () returned 0xb7
[0086.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp", lpFilePart=0x0) returned 0x48
[0086.651] GetLastError () returned 0xb7
[0086.651] SetErrorMode (uMode=0x1) returned 0x0
[0086.651] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270
[0086.652] GetLastError () returned 0xb7
[0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.652] GetLastError () returned 0xb7
[0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.652] GetLastError () returned 0xb7
[0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.652] GetLastError () returned 0xb7
[0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.652] GetLastError () returned 0xb7
[0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.652] GetLastError () returned 0xb7
[0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.652] GetLastError () returned 0xb7
[0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.652] GetLastError () returned 0xb7
[0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.652] GetLastError () returned 0xb7
[0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.652] GetLastError () returned 0xb7
[0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.652] GetLastError () returned 0xb7
[0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0086.652] GetLastError () returned 0x12
[0086.652] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1
[0086.652] SetErrorMode (uMode=0x0) returned 0x1
[0086.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp", lpFilePart=0x0) returned 0x48
[0086.652] GetLastError () returned 0x12
[0086.652] SetErrorMode (uMode=0x1) returned 0x0
[0086.653] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270
[0086.653] GetLastError () returned 0x12
[0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.653] GetLastError () returned 0x12
[0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.653] GetLastError () returned 0x12
[0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.653] GetLastError () returned 0x12
[0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.653] GetLastError () returned 0x12
[0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.653] GetLastError () returned 0x12
[0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.653] GetLastError () returned 0x12
[0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.653] GetLastError () returned 0x12
[0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.653] GetLastError () returned 0x12
[0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.653] GetLastError () returned 0x12
[0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0086.653] GetLastError () returned 0x12
[0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0086.653] GetLastError () returned 0x12
[0086.653] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1
[0086.653] SetErrorMode (uMode=0x0) returned 0x1
[0086.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif", lpFilePart=0x0) returned 0x61
[0086.654] GetLastError () returned 0x12
[0086.654] SetErrorMode (uMode=0x1) returned 0x0
[0086.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\4vk4jynzml2h7s1binw6.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.654] GetLastError () returned 0x0
[0086.654] GetFileType (hFile=0x210) returned 0x1
[0086.654] SetErrorMode (uMode=0x0) returned 0x1
[0086.654] GetFileType (hFile=0x210) returned 0x1
[0086.654] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0xdecc
[0086.654] GetLastError () returned 0x0
[0086.654] ReadFile (in: hFile=0x210, lpBuffer=0x259f3b8, nNumberOfBytesToRead=0xdecc, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x259f3b8*, lpNumberOfBytesRead=0x39eb58*=0xdecc, lpOverlapped=0x0) returned 1
[0086.655] GetLastError () returned 0x0
[0086.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif", lpFilePart=0x0) returned 0x61
[0086.681] GetLastError () returned 0x0
[0086.681] SetErrorMode (uMode=0x1) returned 0x0
[0086.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\4vk4jynzml2h7s1binw6.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.682] GetLastError () returned 0xb7
[0086.682] GetFileType (hFile=0x210) returned 0x1
[0086.682] SetErrorMode (uMode=0x0) returned 0x1
[0086.682] GetFileType (hFile=0x210) returned 0x1
[0086.683] WriteFile (in: hFile=0x210, lpBuffer=0x2650830*, nNumberOfBytesToWrite=0xded0, lpNumberOfBytesWritten=0x39eb64, lpOverlapped=0x0 | out: lpBuffer=0x2650830*, lpNumberOfBytesWritten=0x39eb64*=0xded0, lpOverlapped=0x0) returned 1
[0086.684] GetLastError () returned 0xb7
[0086.684] CloseHandle (hObject=0x210) returned 1
[0086.688] GetLastError () returned 0xb7
[0086.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif", lpFilePart=0x0) returned 0x61
[0086.688] GetLastError () returned 0xb7
[0086.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x6d
[0086.689] GetLastError () returned 0xb7
[0086.689] SetErrorMode (uMode=0x1) returned 0x0
[0086.689] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\4vk4jynzml2h7s1binw6.gif"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb70b8a0, ftCreationTime.dwHighDateTime=0x1d3a2c2, ftLastAccessTime.dwLowDateTime=0xe533dda0, ftLastAccessTime.dwHighDateTime=0x1d3a219, ftLastWriteTime.dwLowDateTime=0x281c3e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xded0)) returned 1
[0086.689] GetLastError () returned 0xb7
[0086.689] SetErrorMode (uMode=0x0) returned 0x1
[0086.689] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\4vk4jynzml2h7s1binw6.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\4vk4jynzml2h7s1binw6.gif.lanran2.0.5")) returned 1
[0086.689] GetLastError () returned 0xb7
[0086.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif", lpFilePart=0x0) returned 0x5f
[0086.689] GetLastError () returned 0xb7
[0086.689] SetErrorMode (uMode=0x1) returned 0x0
[0086.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\5rmwu4x8kfj8tv13oi.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.690] GetLastError () returned 0x0
[0086.690] GetFileType (hFile=0x210) returned 0x1
[0086.690] SetErrorMode (uMode=0x0) returned 0x1
[0086.690] GetFileType (hFile=0x210) returned 0x1
[0086.690] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0x7372
[0086.690] GetLastError () returned 0x0
[0086.690] ReadFile (in: hFile=0x210, lpBuffer=0x265f10c, nNumberOfBytesToRead=0x7372, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x265f10c*, lpNumberOfBytesRead=0x39eb58*=0x7372, lpOverlapped=0x0) returned 1
[0086.691] GetLastError () returned 0x0
[0086.691] CloseHandle (hObject=0x210) returned 1
[0086.691] GetLastError () returned 0x0
[0086.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif", lpFilePart=0x0) returned 0x5f
[0086.756] GetLastError () returned 0x0
[0086.756] SetErrorMode (uMode=0x1) returned 0x0
[0086.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\5rmwu4x8kfj8tv13oi.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.757] GetLastError () returned 0xb7
[0086.757] GetFileType (hFile=0x210) returned 0x1
[0086.757] GetFileType (hFile=0x210) returned 0x1
[0086.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif", lpFilePart=0x0) returned 0x5f
[0086.759] GetLastError () returned 0xb7
[0086.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x6b
[0086.759] GetLastError () returned 0xb7
[0086.759] SetErrorMode (uMode=0x1) returned 0x0
[0086.759] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\5rmwu4x8kfj8tv13oi.gif"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a89dd0, ftCreationTime.dwHighDateTime=0x1d3a337, ftLastAccessTime.dwLowDateTime=0x41f7fb00, ftLastAccessTime.dwHighDateTime=0x1d3afd2, ftLastWriteTime.dwLowDateTime=0x28daac0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x7380)) returned 1
[0086.759] GetLastError () returned 0xb7
[0086.759] SetErrorMode (uMode=0x0) returned 0x1
[0086.759] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\5rmwu4x8kfj8tv13oi.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\5rmwu4x8kfj8tv13oi.gif.lanran2.0.5")) returned 1
[0086.759] GetLastError () returned 0xb7
[0086.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg", lpFilePart=0x0) returned 0x5d
[0086.759] GetLastError () returned 0xb7
[0086.759] SetErrorMode (uMode=0x1) returned 0x0
[0086.760] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\7eyqrwddtufwea78.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.760] GetLastError () returned 0x0
[0086.760] GetFileType (hFile=0x210) returned 0x1
[0086.760] SetErrorMode (uMode=0x0) returned 0x1
[0086.760] GetFileType (hFile=0x210) returned 0x1
[0086.760] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0x7278
[0086.760] GetLastError () returned 0x0
[0086.760] ReadFile (in: hFile=0x210, lpBuffer=0x25174a0, nNumberOfBytesToRead=0x7278, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25174a0*, lpNumberOfBytesRead=0x39eb58*=0x7278, lpOverlapped=0x0) returned 1
[0086.761] GetLastError () returned 0x0
[0086.761] CloseHandle (hObject=0x210) returned 1
[0086.761] GetLastError () returned 0x0
[0086.835] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg", lpFilePart=0x0) returned 0x5d
[0086.835] GetLastError () returned 0x0
[0086.835] SetErrorMode (uMode=0x1) returned 0x0
[0086.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\7eyqrwddtufwea78.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.836] GetLastError () returned 0xb7
[0086.836] GetFileType (hFile=0x210) returned 0x1
[0086.836] GetFileType (hFile=0x210) returned 0x1
[0086.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg", lpFilePart=0x0) returned 0x5d
[0086.837] GetLastError () returned 0xb7
[0086.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x69
[0086.837] GetLastError () returned 0xb7
[0086.837] SetErrorMode (uMode=0x1) returned 0x0
[0086.837] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\7eyqrwddtufwea78.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa2fff30, ftCreationTime.dwHighDateTime=0x1d3aecc, ftLastAccessTime.dwLowDateTime=0xa6bece40, ftLastAccessTime.dwHighDateTime=0x1d3a9df, ftLastWriteTime.dwLowDateTime=0x29991a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x7280)) returned 1
[0086.837] GetLastError () returned 0xb7
[0086.837] SetErrorMode (uMode=0x0) returned 0x1
[0086.837] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\7eyqrwddtufwea78.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\7eyqrwddtufwea78.jpg.lanran2.0.5")) returned 1
[0086.838] GetLastError () returned 0xb7
[0086.838] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp", lpFilePart=0x0) returned 0x5c
[0086.838] GetLastError () returned 0xb7
[0086.838] SetErrorMode (uMode=0x1) returned 0x0
[0086.838] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\bqvsun3uhxnr4kr.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.838] GetLastError () returned 0x0
[0086.838] GetFileType (hFile=0x210) returned 0x1
[0086.838] GetFileType (hFile=0x210) returned 0x1
[0086.838] ReadFile (in: hFile=0x210, lpBuffer=0x25ca710, nNumberOfBytesToRead=0xf3d0, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25ca710*, lpNumberOfBytesRead=0x39eb58*=0xf3d0, lpOverlapped=0x0) returned 1
[0086.839] GetLastError () returned 0x0
[0086.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp", lpFilePart=0x0) returned 0x5c
[0086.867] GetLastError () returned 0x0
[0086.867] SetErrorMode (uMode=0x1) returned 0x0
[0086.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\bqvsun3uhxnr4kr.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.868] GetLastError () returned 0xb7
[0086.868] GetFileType (hFile=0x210) returned 0x1
[0086.868] GetFileType (hFile=0x210) returned 0x1
[0086.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp", lpFilePart=0x0) returned 0x5c
[0086.869] GetLastError () returned 0xb7
[0086.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp.LanRan2.0.5", lpFilePart=0x0) returned 0x68
[0086.869] GetLastError () returned 0xb7
[0086.869] SetErrorMode (uMode=0x1) returned 0x0
[0086.869] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\bqvsun3uhxnr4kr.bmp"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eb90080, ftCreationTime.dwHighDateTime=0x1d3a372, ftLastAccessTime.dwLowDateTime=0xb58cf5e0, ftLastAccessTime.dwHighDateTime=0x1d39ffe, ftLastWriteTime.dwLowDateTime=0x29e5460, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xf3e0)) returned 1
[0086.870] GetLastError () returned 0xb7
[0086.870] SetErrorMode (uMode=0x0) returned 0x1
[0086.870] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\bqvsun3uhxnr4kr.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\bqvsun3uhxnr4kr.bmp.lanran2.0.5")) returned 1
[0086.870] GetLastError () returned 0xb7
[0086.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg", lpFilePart=0x0) returned 0x55
[0086.870] GetLastError () returned 0xb7
[0086.870] SetErrorMode (uMode=0x1) returned 0x0
[0086.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\cyzijwpk.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.870] GetLastError () returned 0x0
[0086.870] GetFileType (hFile=0x210) returned 0x1
[0086.870] GetFileType (hFile=0x210) returned 0x1
[0086.871] ReadFile (in: hFile=0x210, lpBuffer=0x35bd900, nNumberOfBytesToRead=0x18274, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x35bd900*, lpNumberOfBytesRead=0x39eb58*=0x18274, lpOverlapped=0x0) returned 1
[0086.872] GetLastError () returned 0x0
[0086.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg", lpFilePart=0x0) returned 0x55
[0086.906] GetLastError () returned 0x0
[0086.906] SetErrorMode (uMode=0x1) returned 0x0
[0086.906] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\cyzijwpk.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.907] GetLastError () returned 0xb7
[0086.907] GetFileType (hFile=0x210) returned 0x1
[0086.908] SetErrorMode (uMode=0x0) returned 0x1
[0086.908] GetFileType (hFile=0x210) returned 0x1
[0086.908] WriteFile (in: hFile=0x210, lpBuffer=0x36365b0*, nNumberOfBytesToWrite=0x18280, lpNumberOfBytesWritten=0x39eb64, lpOverlapped=0x0 | out: lpBuffer=0x36365b0*, lpNumberOfBytesWritten=0x39eb64*=0x18280, lpOverlapped=0x0) returned 1
[0086.909] GetLastError () returned 0xb7
[0086.909] CloseHandle (hObject=0x210) returned 1
[0086.911] GetLastError () returned 0xb7
[0086.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg", lpFilePart=0x0) returned 0x55
[0086.911] GetLastError () returned 0xb7
[0086.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x61
[0086.911] GetLastError () returned 0xb7
[0086.911] SetErrorMode (uMode=0x1) returned 0x0
[0086.911] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\cyzijwpk.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ddc4350, ftCreationTime.dwHighDateTime=0x1d3a93e, ftLastAccessTime.dwLowDateTime=0xc3292340, ftLastAccessTime.dwHighDateTime=0x1d3a94f, ftLastWriteTime.dwLowDateTime=0x2a31720, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x18280)) returned 1
[0086.911] GetLastError () returned 0xb7
[0086.911] SetErrorMode (uMode=0x0) returned 0x1
[0086.911] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\cyzijwpk.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\cyzijwpk.jpg.lanran2.0.5")) returned 1
[0086.912] GetLastError () returned 0xb7
[0086.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg", lpFilePart=0x0) returned 0x56
[0086.912] GetLastError () returned 0xb7
[0086.912] SetErrorMode (uMode=0x1) returned 0x0
[0086.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\muyhktmdm.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.912] GetLastError () returned 0x0
[0086.912] GetFileType (hFile=0x210) returned 0x1
[0086.912] SetErrorMode (uMode=0x0) returned 0x1
[0086.912] GetFileType (hFile=0x210) returned 0x1
[0086.912] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0xdcfa
[0086.912] GetLastError () returned 0x0
[0086.912] ReadFile (in: hFile=0x210, lpBuffer=0x2510614, nNumberOfBytesToRead=0xdcfa, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x2510614*, lpNumberOfBytesRead=0x39eb58*=0xdcfa, lpOverlapped=0x0) returned 1
[0086.913] GetLastError () returned 0x0
[0086.913] CloseHandle (hObject=0x210) returned 1
[0086.913] GetLastError () returned 0x0
[0086.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg", lpFilePart=0x0) returned 0x56
[0086.971] GetLastError () returned 0x0
[0086.971] SetErrorMode (uMode=0x1) returned 0x0
[0086.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\muyhktmdm.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.972] GetLastError () returned 0xb7
[0086.972] GetFileType (hFile=0x210) returned 0x1
[0086.972] GetFileType (hFile=0x210) returned 0x1
[0086.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg", lpFilePart=0x0) returned 0x56
[0086.974] GetLastError () returned 0xb7
[0086.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x62
[0086.974] GetLastError () returned 0xb7
[0086.974] SetErrorMode (uMode=0x1) returned 0x0
[0086.974] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\muyhktmdm.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752fa250, ftCreationTime.dwHighDateTime=0x1d3aec6, ftLastAccessTime.dwLowDateTime=0xec0ddbe0, ftLastAccessTime.dwHighDateTime=0x1d3abc3, ftLastWriteTime.dwLowDateTime=0x2ac9ca0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xdd00)) returned 1
[0086.974] GetLastError () returned 0xb7
[0086.974] SetErrorMode (uMode=0x0) returned 0x1
[0086.974] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\muyhktmdm.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\muyhktmdm.jpg.lanran2.0.5")) returned 1
[0086.974] GetLastError () returned 0xb7
[0086.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp", lpFilePart=0x0) returned 0x5d
[0086.974] GetLastError () returned 0xb7
[0086.974] SetErrorMode (uMode=0x1) returned 0x0
[0086.974] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\nydnoe6adjhzrnny.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0086.975] GetLastError () returned 0x0
[0086.975] GetFileType (hFile=0x210) returned 0x1
[0086.975] GetFileType (hFile=0x210) returned 0x1
[0086.975] ReadFile (in: hFile=0x210, lpBuffer=0x25cfd60, nNumberOfBytesToRead=0xe086, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25cfd60*, lpNumberOfBytesRead=0x39eb58*=0xe086, lpOverlapped=0x0) returned 1
[0086.975] GetLastError () returned 0x0
[0087.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp", lpFilePart=0x0) returned 0x5d
[0087.002] GetLastError () returned 0x0
[0087.002] SetErrorMode (uMode=0x1) returned 0x0
[0087.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\nydnoe6adjhzrnny.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.003] GetLastError () returned 0xb7
[0087.003] GetFileType (hFile=0x210) returned 0x1
[0087.003] GetFileType (hFile=0x210) returned 0x1
[0087.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp", lpFilePart=0x0) returned 0x5d
[0087.005] GetLastError () returned 0xb7
[0087.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp.LanRan2.0.5", lpFilePart=0x0) returned 0x69
[0087.005] GetLastError () returned 0xb7
[0087.005] SetErrorMode (uMode=0x1) returned 0x0
[0087.005] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\nydnoe6adjhzrnny.bmp"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e6716f0, ftCreationTime.dwHighDateTime=0x1d39ff1, ftLastAccessTime.dwLowDateTime=0xa07280e0, ftLastAccessTime.dwHighDateTime=0x1d3a0c0, ftLastWriteTime.dwLowDateTime=0x2b15f60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xe090)) returned 1
[0087.005] GetLastError () returned 0xb7
[0087.005] SetErrorMode (uMode=0x0) returned 0x1
[0087.005] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\nydnoe6adjhzrnny.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\nydnoe6adjhzrnny.bmp.lanran2.0.5")) returned 1
[0087.005] GetLastError () returned 0xb7
[0087.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png", lpFilePart=0x0) returned 0x5c
[0087.005] GetLastError () returned 0xb7
[0087.005] SetErrorMode (uMode=0x1) returned 0x0
[0087.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\yr4nfivedvx896w.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.006] GetLastError () returned 0x0
[0087.006] GetFileType (hFile=0x210) returned 0x1
[0087.006] GetFileType (hFile=0x210) returned 0x1
[0087.006] ReadFile (in: hFile=0x210, lpBuffer=0x3686370, nNumberOfBytesToRead=0x155b6, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x3686370*, lpNumberOfBytesRead=0x39eb58*=0x155b6, lpOverlapped=0x0) returned 1
[0087.007] GetLastError () returned 0x0
[0087.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png", lpFilePart=0x0) returned 0x5c
[0087.070] GetLastError () returned 0x0
[0087.070] SetErrorMode (uMode=0x1) returned 0x0
[0087.071] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\yr4nfivedvx896w.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.072] GetLastError () returned 0xb7
[0087.072] GetFileType (hFile=0x210) returned 0x1
[0087.072] GetFileType (hFile=0x210) returned 0x1
[0087.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png", lpFilePart=0x0) returned 0x5c
[0087.073] GetLastError () returned 0xb7
[0087.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png.LanRan2.0.5", lpFilePart=0x0) returned 0x68
[0087.073] GetLastError () returned 0xb7
[0087.073] SetErrorMode (uMode=0x1) returned 0x0
[0087.073] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\yr4nfivedvx896w.png"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e0a60b0, ftCreationTime.dwHighDateTime=0x1d3a474, ftLastAccessTime.dwLowDateTime=0x706185a0, ftLastAccessTime.dwHighDateTime=0x1d3ae5c, ftLastWriteTime.dwLowDateTime=0x2bd4640, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x155c0)) returned 1
[0087.074] GetLastError () returned 0xb7
[0087.074] SetErrorMode (uMode=0x0) returned 0x1
[0087.074] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\yr4nfivedvx896w.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\yr4nfivedvx896w.png.lanran2.0.5")) returned 1
[0087.074] GetLastError () returned 0xb7
[0087.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF", lpFilePart=0x0) returned 0x55
[0087.074] GetLastError () returned 0xb7
[0087.074] SetErrorMode (uMode=0x1) returned 0x0
[0087.074] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0087.074] GetLastError () returned 0xb7
[0087.074] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.074] GetLastError () returned 0xb7
[0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.075] GetLastError () returned 0xb7
[0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.075] GetLastError () returned 0xb7
[0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.075] GetLastError () returned 0xb7
[0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.075] GetLastError () returned 0xb7
[0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0087.075] GetLastError () returned 0x12
[0087.075] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0087.075] SetErrorMode (uMode=0x0) returned 0x1
[0087.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF", lpFilePart=0x0) returned 0x55
[0087.075] GetLastError () returned 0x12
[0087.075] SetErrorMode (uMode=0x1) returned 0x0
[0087.075] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0087.075] GetLastError () returned 0x12
[0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.075] GetLastError () returned 0x12
[0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.075] GetLastError () returned 0x12
[0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.075] GetLastError () returned 0x12
[0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.075] GetLastError () returned 0x12
[0087.076] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.076] GetLastError () returned 0x12
[0087.076] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0087.076] GetLastError () returned 0x12
[0087.076] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0087.076] SetErrorMode (uMode=0x0) returned 0x1
[0087.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg", lpFilePart=0x0) returned 0x60
[0087.076] GetLastError () returned 0x12
[0087.076] SetErrorMode (uMode=0x1) returned 0x0
[0087.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\5e6mnj.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.076] GetLastError () returned 0x0
[0087.076] GetFileType (hFile=0x210) returned 0x1
[0087.076] GetFileType (hFile=0x210) returned 0x1
[0087.076] ReadFile (in: hFile=0x210, lpBuffer=0x2519a2c, nNumberOfBytesToRead=0x14209, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x2519a2c*, lpNumberOfBytesRead=0x39eaf8*=0x14209, lpOverlapped=0x0) returned 1
[0087.077] GetLastError () returned 0x0
[0087.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg", lpFilePart=0x0) returned 0x60
[0087.106] GetLastError () returned 0x0
[0087.106] SetErrorMode (uMode=0x1) returned 0x0
[0087.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\5e6mnj.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.107] GetLastError () returned 0xb7
[0087.107] GetFileType (hFile=0x210) returned 0x1
[0087.107] SetErrorMode (uMode=0x0) returned 0x1
[0087.107] GetFileType (hFile=0x210) returned 0x1
[0087.107] WriteFile (in: hFile=0x210, lpBuffer=0x25dda0c*, nNumberOfBytesToWrite=0x14210, lpNumberOfBytesWritten=0x39eb04, lpOverlapped=0x0 | out: lpBuffer=0x25dda0c*, lpNumberOfBytesWritten=0x39eb04*=0x14210, lpOverlapped=0x0) returned 1
[0087.109] GetLastError () returned 0xb7
[0087.109] CloseHandle (hObject=0x210) returned 1
[0087.110] GetLastError () returned 0xb7
[0087.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg", lpFilePart=0x0) returned 0x60
[0087.110] GetLastError () returned 0xb7
[0087.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x6c
[0087.110] GetLastError () returned 0xb7
[0087.110] SetErrorMode (uMode=0x1) returned 0x0
[0087.110] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\5e6mnj.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa485c0d0, ftCreationTime.dwHighDateTime=0x1d3a2d1, ftLastAccessTime.dwLowDateTime=0x263bafc0, ftLastAccessTime.dwHighDateTime=0x1d3a6df, ftLastWriteTime.dwLowDateTime=0x2c20900, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x14210)) returned 1
[0087.110] GetLastError () returned 0xb7
[0087.110] SetErrorMode (uMode=0x0) returned 0x1
[0087.110] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\5e6mnj.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\5e6mnj.jpg.lanran2.0.5")) returned 1
[0087.111] GetLastError () returned 0xb7
[0087.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp", lpFilePart=0x0) returned 0x6d
[0087.111] GetLastError () returned 0xb7
[0087.111] SetErrorMode (uMode=0x1) returned 0x0
[0087.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\cte330fqj4o3f9xhhv3.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.111] GetLastError () returned 0x0
[0087.111] GetFileType (hFile=0x210) returned 0x1
[0087.111] SetErrorMode (uMode=0x0) returned 0x1
[0087.111] GetFileType (hFile=0x210) returned 0x1
[0087.112] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39eb50 | out: lpFileSizeHigh=0x39eb50*=0x0) returned 0x7f21
[0087.112] GetLastError () returned 0x0
[0087.112] ReadFile (in: hFile=0x210, lpBuffer=0x25f2628, nNumberOfBytesToRead=0x7f21, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x25f2628*, lpNumberOfBytesRead=0x39eaf8*=0x7f21, lpOverlapped=0x0) returned 1
[0087.112] GetLastError () returned 0x0
[0087.112] CloseHandle (hObject=0x210) returned 1
[0087.112] GetLastError () returned 0x0
[0087.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp", lpFilePart=0x0) returned 0x6d
[0087.172] GetLastError () returned 0x0
[0087.172] SetErrorMode (uMode=0x1) returned 0x0
[0087.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\cte330fqj4o3f9xhhv3.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.173] GetLastError () returned 0xb7
[0087.173] GetFileType (hFile=0x210) returned 0x1
[0087.174] GetFileType (hFile=0x210) returned 0x1
[0087.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp", lpFilePart=0x0) returned 0x6d
[0087.175] GetLastError () returned 0xb7
[0087.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp.LanRan2.0.5", lpFilePart=0x0) returned 0x79
[0087.175] GetLastError () returned 0xb7
[0087.175] SetErrorMode (uMode=0x1) returned 0x0
[0087.175] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\cte330fqj4o3f9xhhv3.bmp"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91d8af00, ftCreationTime.dwHighDateTime=0x1d3ae2b, ftLastAccessTime.dwLowDateTime=0x67076480, ftLastAccessTime.dwHighDateTime=0x1d3afdc, ftLastWriteTime.dwLowDateTime=0x2cb8e80, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x7f30)) returned 1
[0087.175] GetLastError () returned 0xb7
[0087.175] SetErrorMode (uMode=0x0) returned 0x1
[0087.175] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\cte330fqj4o3f9xhhv3.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\cte330fqj4o3f9xhhv3.bmp.lanran2.0.5")) returned 1
[0087.177] GetLastError () returned 0xb7
[0087.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif", lpFilePart=0x0) returned 0x62
[0087.177] GetLastError () returned 0xb7
[0087.177] SetErrorMode (uMode=0x1) returned 0x0
[0087.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\f4gh7x9-.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.177] GetLastError () returned 0x0
[0087.177] GetFileType (hFile=0x210) returned 0x1
[0087.178] GetFileType (hFile=0x210) returned 0x1
[0087.178] ReadFile (in: hFile=0x210, lpBuffer=0x26aa39c, nNumberOfBytesToRead=0x133c1, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x26aa39c*, lpNumberOfBytesRead=0x39eaf8*=0x133c1, lpOverlapped=0x0) returned 1
[0087.178] GetLastError () returned 0x0
[0087.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif", lpFilePart=0x0) returned 0x62
[0087.239] GetLastError () returned 0x0
[0087.239] SetErrorMode (uMode=0x1) returned 0x0
[0087.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\f4gh7x9-.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.240] GetLastError () returned 0xb7
[0087.240] GetFileType (hFile=0x210) returned 0x1
[0087.240] GetFileType (hFile=0x210) returned 0x1
[0087.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif", lpFilePart=0x0) returned 0x62
[0087.242] GetLastError () returned 0xb7
[0087.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x6e
[0087.242] GetLastError () returned 0xb7
[0087.242] SetErrorMode (uMode=0x1) returned 0x0
[0087.242] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\f4gh7x9-.gif"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d0f82e0, ftCreationTime.dwHighDateTime=0x1d3a161, ftLastAccessTime.dwLowDateTime=0x920213f0, ftLastAccessTime.dwHighDateTime=0x1d3a65f, ftLastWriteTime.dwLowDateTime=0x2d51400, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x133d0)) returned 1
[0087.242] GetLastError () returned 0xb7
[0087.242] SetErrorMode (uMode=0x0) returned 0x1
[0087.242] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\f4gh7x9-.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\f4gh7x9-.gif.lanran2.0.5")) returned 1
[0087.243] GetLastError () returned 0xb7
[0087.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp", lpFilePart=0x0) returned 0x61
[0087.243] GetLastError () returned 0xb7
[0087.243] SetErrorMode (uMode=0x1) returned 0x0
[0087.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\rr1ee6x.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.243] GetLastError () returned 0x0
[0087.243] GetFileType (hFile=0x210) returned 0x1
[0087.243] GetFileType (hFile=0x210) returned 0x1
[0087.243] ReadFile (in: hFile=0x210, lpBuffer=0x3755208, nNumberOfBytesToRead=0x185d0, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x3755208*, lpNumberOfBytesRead=0x39eaf8*=0x185d0, lpOverlapped=0x0) returned 1
[0087.245] GetLastError () returned 0x0
[0087.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp", lpFilePart=0x0) returned 0x61
[0087.282] GetLastError () returned 0x0
[0087.283] SetErrorMode (uMode=0x1) returned 0x0
[0087.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\rr1ee6x.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.284] GetLastError () returned 0xb7
[0087.284] GetFileType (hFile=0x210) returned 0x1
[0087.284] SetErrorMode (uMode=0x0) returned 0x1
[0087.284] GetFileType (hFile=0x210) returned 0x1
[0087.284] WriteFile (in: hFile=0x210, lpBuffer=0x34c79a0*, nNumberOfBytesToWrite=0x185e0, lpNumberOfBytesWritten=0x39eb04, lpOverlapped=0x0 | out: lpBuffer=0x34c79a0*, lpNumberOfBytesWritten=0x39eb04*=0x185e0, lpOverlapped=0x0) returned 1
[0087.286] GetLastError () returned 0xb7
[0087.286] CloseHandle (hObject=0x210) returned 1
[0087.287] GetLastError () returned 0xb7
[0087.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp", lpFilePart=0x0) returned 0x61
[0087.287] GetLastError () returned 0xb7
[0087.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp.LanRan2.0.5", lpFilePart=0x0) returned 0x6d
[0087.287] GetLastError () returned 0xb7
[0087.288] SetErrorMode (uMode=0x1) returned 0x0
[0087.288] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\rr1ee6x.bmp"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9ccc6e0, ftCreationTime.dwHighDateTime=0x1d3ab66, ftLastAccessTime.dwLowDateTime=0x48b7b20, ftLastAccessTime.dwHighDateTime=0x1d3a7b7, ftLastWriteTime.dwLowDateTime=0x2dc3820, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x185e0)) returned 1
[0087.288] GetLastError () returned 0xb7
[0087.288] SetErrorMode (uMode=0x0) returned 0x1
[0087.288] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\rr1ee6x.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\rr1ee6x.bmp.lanran2.0.5")) returned 1
[0087.288] GetLastError () returned 0xb7
[0087.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM", lpFilePart=0x0) returned 0x48
[0087.288] GetLastError () returned 0xb7
[0087.288] SetErrorMode (uMode=0x1) returned 0x0
[0087.289] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570
[0087.289] GetLastError () returned 0xb7
[0087.289] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.289] GetLastError () returned 0xb7
[0087.289] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.289] GetLastError () returned 0xb7
[0087.289] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.289] GetLastError () returned 0xb7
[0087.290] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.290] GetLastError () returned 0xb7
[0087.290] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.290] GetLastError () returned 0xb7
[0087.290] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.290] GetLastError () returned 0xb7
[0087.290] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.290] GetLastError () returned 0xb7
[0087.290] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.290] GetLastError () returned 0xb7
[0087.290] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.290] GetLastError () returned 0xb7
[0087.291] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.291] GetLastError () returned 0xb7
[0087.291] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0087.291] GetLastError () returned 0x12
[0087.291] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1
[0087.291] SetErrorMode (uMode=0x0) returned 0x1
[0087.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM", lpFilePart=0x0) returned 0x48
[0087.291] GetLastError () returned 0x12
[0087.291] SetErrorMode (uMode=0x1) returned 0x0
[0087.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570
[0087.291] GetLastError () returned 0x12
[0087.292] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.292] GetLastError () returned 0x12
[0087.292] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.292] GetLastError () returned 0x12
[0087.292] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.292] GetLastError () returned 0x12
[0087.292] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.292] GetLastError () returned 0x12
[0087.292] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.292] GetLastError () returned 0x12
[0087.292] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.293] GetLastError () returned 0x12
[0087.293] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.293] GetLastError () returned 0x12
[0087.293] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.293] GetLastError () returned 0x12
[0087.293] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.293] GetLastError () returned 0x12
[0087.293] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.293] GetLastError () returned 0x12
[0087.293] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0087.293] GetLastError () returned 0x12
[0087.294] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1
[0087.294] SetErrorMode (uMode=0x0) returned 0x1
[0087.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg", lpFilePart=0x0) returned 0x61
[0087.294] GetLastError () returned 0x12
[0087.294] SetErrorMode (uMode=0x1) returned 0x0
[0087.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\5 xsesqkjee fd4wdiel.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.294] GetLastError () returned 0x0
[0087.294] GetFileType (hFile=0x210) returned 0x1
[0087.294] SetErrorMode (uMode=0x0) returned 0x1
[0087.294] GetFileType (hFile=0x210) returned 0x1
[0087.294] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0xf7a5
[0087.294] GetLastError () returned 0x0
[0087.294] ReadFile (in: hFile=0x210, lpBuffer=0x24bd3d8, nNumberOfBytesToRead=0xf7a5, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x24bd3d8*, lpNumberOfBytesRead=0x39eb58*=0xf7a5, lpOverlapped=0x0) returned 1
[0087.295] GetLastError () returned 0x0
[0087.295] CloseHandle (hObject=0x210) returned 1
[0087.295] GetLastError () returned 0x0
[0087.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg", lpFilePart=0x0) returned 0x61
[0087.352] GetLastError () returned 0x0
[0087.352] SetErrorMode (uMode=0x1) returned 0x0
[0087.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\5 xsesqkjee fd4wdiel.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.354] GetLastError () returned 0xb7
[0087.354] GetFileType (hFile=0x210) returned 0x1
[0087.354] GetFileType (hFile=0x210) returned 0x1
[0087.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg", lpFilePart=0x0) returned 0x61
[0087.355] GetLastError () returned 0xb7
[0087.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x6d
[0087.356] GetLastError () returned 0xb7
[0087.356] SetErrorMode (uMode=0x1) returned 0x0
[0087.356] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\5 xsesqkjee fd4wdiel.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7a91c10, ftCreationTime.dwHighDateTime=0x1d3aace, ftLastAccessTime.dwLowDateTime=0xfea14180, ftLastAccessTime.dwHighDateTime=0x1d3aba9, ftLastWriteTime.dwLowDateTime=0x2e81f00, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xf7b0)) returned 1
[0087.356] GetLastError () returned 0xb7
[0087.356] SetErrorMode (uMode=0x0) returned 0x1
[0087.356] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\5 xsesqkjee fd4wdiel.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\5 xsesqkjee fd4wdiel.jpg.lanran2.0.5")) returned 1
[0087.356] GetLastError () returned 0xb7
[0087.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png", lpFilePart=0x0) returned 0x57
[0087.357] GetLastError () returned 0xb7
[0087.357] SetErrorMode (uMode=0x1) returned 0x0
[0087.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\azsni -ulr.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.357] GetLastError () returned 0x0
[0087.357] GetFileType (hFile=0x210) returned 0x1
[0087.357] GetFileType (hFile=0x210) returned 0x1
[0087.357] ReadFile (in: hFile=0x210, lpBuffer=0x2583634, nNumberOfBytesToRead=0xfe9e, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x2583634*, lpNumberOfBytesRead=0x39eb58*=0xfe9e, lpOverlapped=0x0) returned 1
[0087.358] GetLastError () returned 0x0
[0087.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png", lpFilePart=0x0) returned 0x57
[0087.384] GetLastError () returned 0x0
[0087.384] SetErrorMode (uMode=0x1) returned 0x0
[0087.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\azsni -ulr.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.385] GetLastError () returned 0xb7
[0087.385] GetFileType (hFile=0x210) returned 0x1
[0087.385] GetFileType (hFile=0x210) returned 0x1
[0087.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png", lpFilePart=0x0) returned 0x57
[0087.387] GetLastError () returned 0xb7
[0087.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png.LanRan2.0.5", lpFilePart=0x0) returned 0x63
[0087.387] GetLastError () returned 0xb7
[0087.387] SetErrorMode (uMode=0x1) returned 0x0
[0087.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\azsni -ulr.png"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75d04cf0, ftCreationTime.dwHighDateTime=0x1d3a9d5, ftLastAccessTime.dwLowDateTime=0x957a4450, ftLastAccessTime.dwHighDateTime=0x1d3a71b, ftLastWriteTime.dwLowDateTime=0x2ece1c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xfea0)) returned 1
[0087.387] GetLastError () returned 0xb7
[0087.387] SetErrorMode (uMode=0x0) returned 0x1
[0087.387] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\azsni -ulr.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\azsni -ulr.png.lanran2.0.5")) returned 1
[0087.388] GetLastError () returned 0xb7
[0087.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png", lpFilePart=0x0) returned 0x59
[0087.388] GetLastError () returned 0xb7
[0087.388] SetErrorMode (uMode=0x1) returned 0x0
[0087.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\eve0agd3kpqy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.388] GetLastError () returned 0x0
[0087.388] GetFileType (hFile=0x210) returned 0x1
[0087.388] GetFileType (hFile=0x210) returned 0x1
[0087.388] ReadFile (in: hFile=0x210, lpBuffer=0x264b250, nNumberOfBytesToRead=0xab9d, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x264b250*, lpNumberOfBytesRead=0x39eb58*=0xab9d, lpOverlapped=0x0) returned 1
[0087.389] GetLastError () returned 0x0
[0087.441] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png", lpFilePart=0x0) returned 0x59
[0087.441] GetLastError () returned 0x0
[0087.441] SetErrorMode (uMode=0x1) returned 0x0
[0087.441] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\eve0agd3kpqy.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.442] GetLastError () returned 0xb7
[0087.442] GetFileType (hFile=0x210) returned 0x1
[0087.442] GetFileType (hFile=0x210) returned 0x1
[0087.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png", lpFilePart=0x0) returned 0x59
[0087.444] GetLastError () returned 0xb7
[0087.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png.LanRan2.0.5", lpFilePart=0x0) returned 0x65
[0087.444] GetLastError () returned 0xb7
[0087.444] SetErrorMode (uMode=0x1) returned 0x0
[0087.444] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\eve0agd3kpqy.png"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bd3670, ftCreationTime.dwHighDateTime=0x1d3ad0d, ftLastAccessTime.dwLowDateTime=0xc2389d60, ftLastAccessTime.dwHighDateTime=0x1d3a22b, ftLastWriteTime.dwLowDateTime=0x2f405e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xaba0)) returned 1
[0087.444] GetLastError () returned 0xb7
[0087.444] SetErrorMode (uMode=0x0) returned 0x1
[0087.444] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\eve0agd3kpqy.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\eve0agd3kpqy.png.lanran2.0.5")) returned 1
[0087.444] GetLastError () returned 0xb7
[0087.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif", lpFilePart=0x0) returned 0x52
[0087.444] GetLastError () returned 0xb7
[0087.444] SetErrorMode (uMode=0x1) returned 0x0
[0087.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\hhev8.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.445] GetLastError () returned 0x0
[0087.445] GetFileType (hFile=0x210) returned 0x1
[0087.445] GetFileType (hFile=0x210) returned 0x1
[0087.445] ReadFile (in: hFile=0x210, lpBuffer=0x25098a8, nNumberOfBytesToRead=0x55db, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25098a8*, lpNumberOfBytesRead=0x39eb58*=0x55db, lpOverlapped=0x0) returned 1
[0087.445] GetLastError () returned 0x0
[0087.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif", lpFilePart=0x0) returned 0x52
[0087.470] GetLastError () returned 0x0
[0087.470] SetErrorMode (uMode=0x1) returned 0x0
[0087.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\hhev8.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.471] GetLastError () returned 0xb7
[0087.471] GetFileType (hFile=0x210) returned 0x1
[0087.471] GetFileType (hFile=0x210) returned 0x1
[0087.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif", lpFilePart=0x0) returned 0x52
[0087.471] GetLastError () returned 0xb7
[0087.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x5e
[0087.471] GetLastError () returned 0xb7
[0087.471] SetErrorMode (uMode=0x1) returned 0x0
[0087.472] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\hhev8.gif"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424ddcf0, ftCreationTime.dwHighDateTime=0x1d3a47e, ftLastAccessTime.dwLowDateTime=0x22eed840, ftLastAccessTime.dwHighDateTime=0x1d3ae3e, ftLastWriteTime.dwLowDateTime=0x2f8c8a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x55e0)) returned 1
[0087.472] GetLastError () returned 0xb7
[0087.472] SetErrorMode (uMode=0x0) returned 0x1
[0087.472] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\hhev8.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\hhev8.gif.lanran2.0.5")) returned 1
[0087.472] GetLastError () returned 0xb7
[0087.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg", lpFilePart=0x0) returned 0x55
[0087.472] GetLastError () returned 0xb7
[0087.472] SetErrorMode (uMode=0x1) returned 0x0
[0087.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\kco0kx-t.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.472] GetLastError () returned 0x0
[0087.472] GetFileType (hFile=0x210) returned 0x1
[0087.472] GetFileType (hFile=0x210) returned 0x1
[0087.473] ReadFile (in: hFile=0x210, lpBuffer=0x3534380, nNumberOfBytesToRead=0x15fc2, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x3534380*, lpNumberOfBytesRead=0x39eb58*=0x15fc2, lpOverlapped=0x0) returned 1
[0087.473] GetLastError () returned 0x0
[0087.501] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg", lpFilePart=0x0) returned 0x55
[0087.501] GetLastError () returned 0x0
[0087.501] SetErrorMode (uMode=0x1) returned 0x0
[0087.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\kco0kx-t.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.503] GetLastError () returned 0xb7
[0087.503] GetFileType (hFile=0x210) returned 0x1
[0087.503] GetFileType (hFile=0x210) returned 0x1
[0087.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg", lpFilePart=0x0) returned 0x55
[0087.504] GetLastError () returned 0xb7
[0087.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x61
[0087.504] GetLastError () returned 0xb7
[0087.504] SetErrorMode (uMode=0x1) returned 0x0
[0087.504] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\kco0kx-t.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf41b5790, ftCreationTime.dwHighDateTime=0x1d3a065, ftLastAccessTime.dwLowDateTime=0x30149290, ftLastAccessTime.dwHighDateTime=0x1d3ab59, ftLastWriteTime.dwLowDateTime=0x2fd8b60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x15fd0)) returned 1
[0087.504] GetLastError () returned 0xb7
[0087.504] SetErrorMode (uMode=0x0) returned 0x1
[0087.504] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\kco0kx-t.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\kco0kx-t.jpg.lanran2.0.5")) returned 1
[0087.505] GetLastError () returned 0xb7
[0087.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif", lpFilePart=0x0) returned 0x5e
[0087.505] GetLastError () returned 0xb7
[0087.505] SetErrorMode (uMode=0x1) returned 0x0
[0087.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\ml-82gxwyfnqyhlon.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.505] GetLastError () returned 0x0
[0087.505] GetFileType (hFile=0x210) returned 0x1
[0087.505] GetFileType (hFile=0x210) returned 0x1
[0087.505] ReadFile (in: hFile=0x210, lpBuffer=0x263a070, nNumberOfBytesToRead=0x71f2, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x263a070*, lpNumberOfBytesRead=0x39eb58*=0x71f2, lpOverlapped=0x0) returned 1
[0087.506] GetLastError () returned 0x0
[0087.532] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif", lpFilePart=0x0) returned 0x5e
[0087.532] GetLastError () returned 0x0
[0087.532] SetErrorMode (uMode=0x1) returned 0x0
[0087.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\ml-82gxwyfnqyhlon.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.533] GetLastError () returned 0xb7
[0087.535] GetFileType (hFile=0x210) returned 0x1
[0087.535] SetErrorMode (uMode=0x0) returned 0x1
[0087.535] GetFileType (hFile=0x210) returned 0x1
[0087.535] WriteFile (in: hFile=0x210, lpBuffer=0x24ec824*, nNumberOfBytesToWrite=0x7200, lpNumberOfBytesWritten=0x39eb64, lpOverlapped=0x0 | out: lpBuffer=0x24ec824*, lpNumberOfBytesWritten=0x39eb64*=0x7200, lpOverlapped=0x0) returned 1
[0087.536] GetLastError () returned 0xb7
[0087.536] CloseHandle (hObject=0x210) returned 1
[0087.536] GetLastError () returned 0xb7
[0087.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif", lpFilePart=0x0) returned 0x5e
[0087.537] GetLastError () returned 0xb7
[0087.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x6a
[0087.537] GetLastError () returned 0xb7
[0087.537] SetErrorMode (uMode=0x1) returned 0x0
[0087.537] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\ml-82gxwyfnqyhlon.gif"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb88d0480, ftCreationTime.dwHighDateTime=0x1d3a5a6, ftLastAccessTime.dwLowDateTime=0x8f75e560, ftLastAccessTime.dwHighDateTime=0x1d3a49f, ftLastWriteTime.dwLowDateTime=0x3024e20, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x7200)) returned 1
[0087.537] GetLastError () returned 0xb7
[0087.537] SetErrorMode (uMode=0x0) returned 0x1
[0087.537] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\ml-82gxwyfnqyhlon.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\ml-82gxwyfnqyhlon.gif.lanran2.0.5")) returned 1
[0087.537] GetLastError () returned 0xb7
[0087.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg", lpFilePart=0x0) returned 0x54
[0087.537] GetLastError () returned 0xb7
[0087.537] SetErrorMode (uMode=0x1) returned 0x0
[0087.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\u1fjsyz.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.537] GetLastError () returned 0x0
[0087.537] GetFileType (hFile=0x210) returned 0x1
[0087.537] SetErrorMode (uMode=0x0) returned 0x1
[0087.537] GetFileType (hFile=0x210) returned 0x1
[0087.538] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0x98e4
[0087.538] GetLastError () returned 0x0
[0087.538] ReadFile (in: hFile=0x210, lpBuffer=0x24f43ec, nNumberOfBytesToRead=0x98e4, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x24f43ec*, lpNumberOfBytesRead=0x39eb58*=0x98e4, lpOverlapped=0x0) returned 1
[0087.538] GetLastError () returned 0x0
[0087.538] CloseHandle (hObject=0x210) returned 1
[0087.538] GetLastError () returned 0x0
[0087.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg", lpFilePart=0x0) returned 0x54
[0087.592] GetLastError () returned 0x0
[0087.592] SetErrorMode (uMode=0x1) returned 0x0
[0087.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\u1fjsyz.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.599] GetLastError () returned 0xb7
[0087.599] GetFileType (hFile=0x210) returned 0x1
[0087.600] GetFileType (hFile=0x210) returned 0x1
[0087.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg", lpFilePart=0x0) returned 0x54
[0087.601] GetLastError () returned 0xb7
[0087.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x60
[0087.601] GetLastError () returned 0xb7
[0087.601] SetErrorMode (uMode=0x1) returned 0x0
[0087.601] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\u1fjsyz.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5be5dda0, ftCreationTime.dwHighDateTime=0x1d3b05b, ftLastAccessTime.dwLowDateTime=0x410e3520, ftLastAccessTime.dwHighDateTime=0x1d3a2ca, ftLastWriteTime.dwLowDateTime=0x30e3500, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x98f0)) returned 1
[0087.601] GetLastError () returned 0xb7
[0087.601] SetErrorMode (uMode=0x0) returned 0x1
[0087.601] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\u1fjsyz.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\u1fjsyz.jpg.lanran2.0.5")) returned 1
[0087.602] GetLastError () returned 0xb7
[0087.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp", lpFilePart=0x0) returned 0x5c
[0087.602] GetLastError () returned 0xb7
[0087.602] SetErrorMode (uMode=0x1) returned 0x0
[0087.602] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\vr-kwpndecd-l4m.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.602] GetLastError () returned 0x0
[0087.602] GetFileType (hFile=0x210) returned 0x1
[0087.602] GetFileType (hFile=0x210) returned 0x1
[0087.602] ReadFile (in: hFile=0x210, lpBuffer=0x25b5ca8, nNumberOfBytesToRead=0x933a, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25b5ca8*, lpNumberOfBytesRead=0x39eb58*=0x933a, lpOverlapped=0x0) returned 1
[0087.603] GetLastError () returned 0x0
[0087.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp", lpFilePart=0x0) returned 0x5c
[0087.628] GetLastError () returned 0x0
[0087.628] SetErrorMode (uMode=0x1) returned 0x0
[0087.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\vr-kwpndecd-l4m.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.629] GetLastError () returned 0xb7
[0087.629] GetFileType (hFile=0x210) returned 0x1
[0087.629] GetFileType (hFile=0x210) returned 0x1
[0087.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp", lpFilePart=0x0) returned 0x5c
[0087.631] GetLastError () returned 0xb7
[0087.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp.LanRan2.0.5", lpFilePart=0x0) returned 0x68
[0087.631] GetLastError () returned 0xb7
[0087.631] SetErrorMode (uMode=0x1) returned 0x0
[0087.631] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\vr-kwpndecd-l4m.bmp"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fff220, ftCreationTime.dwHighDateTime=0x1d3aa5f, ftLastAccessTime.dwLowDateTime=0x1d943f50, ftLastAccessTime.dwHighDateTime=0x1d3a97c, ftLastWriteTime.dwLowDateTime=0x3109660, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x9340)) returned 1
[0087.631] GetLastError () returned 0xb7
[0087.631] SetErrorMode (uMode=0x0) returned 0x1
[0087.631] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\vr-kwpndecd-l4m.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\vr-kwpndecd-l4m.bmp.lanran2.0.5")) returned 1
[0087.631] GetLastError () returned 0xb7
[0087.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp", lpFilePart=0x0) returned 0x60
[0087.631] GetLastError () returned 0xb7
[0087.631] SetErrorMode (uMode=0x1) returned 0x0
[0087.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\wknzeogznere45_5yin.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.632] GetLastError () returned 0x0
[0087.632] GetFileType (hFile=0x210) returned 0x1
[0087.632] GetFileType (hFile=0x210) returned 0x1
[0087.632] ReadFile (in: hFile=0x210, lpBuffer=0x2675204, nNumberOfBytesToRead=0x13f3e, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x2675204*, lpNumberOfBytesRead=0x39eb58*=0x13f3e, lpOverlapped=0x0) returned 1
[0087.632] GetLastError () returned 0x0
[0087.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp", lpFilePart=0x0) returned 0x60
[0087.694] GetLastError () returned 0x0
[0087.694] SetErrorMode (uMode=0x1) returned 0x0
[0087.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\wknzeogznere45_5yin.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210
[0087.695] GetLastError () returned 0xb7
[0087.696] GetFileType (hFile=0x210) returned 0x1
[0087.696] GetFileType (hFile=0x210) returned 0x1
[0087.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp", lpFilePart=0x0) returned 0x60
[0087.697] GetLastError () returned 0xb7
[0087.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp.LanRan2.0.5", lpFilePart=0x0) returned 0x6c
[0087.697] GetLastError () returned 0xb7
[0087.697] SetErrorMode (uMode=0x1) returned 0x0
[0087.697] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\wknzeogznere45_5yin.bmp"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9556cec0, ftCreationTime.dwHighDateTime=0x1d3a613, ftLastAccessTime.dwLowDateTime=0xf54da270, ftLastAccessTime.dwHighDateTime=0x1d3ae0d, ftLastWriteTime.dwLowDateTime=0x31c7d40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x13f40)) returned 1
[0087.697] GetLastError () returned 0xb7
[0087.697] SetErrorMode (uMode=0x0) returned 0x1
[0087.698] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\wknzeogznere45_5yin.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\wknzeogznere45_5yin.bmp.lanran2.0.5")) returned 1
[0087.698] GetLastError () returned 0xb7
[0087.698] SHGetFolderPathW (in: hwnd=0x0, csidl=0, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x0
[0087.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
[0087.699] GetLastError () returned 0x3f0
[0087.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26
[0087.699] GetLastError () returned 0x3f0
[0087.699] SetErrorMode (uMode=0x1) returned 0x0
[0087.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c330
[0087.699] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.700] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.701] GetLastError () returned 0x3f0
[0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.702] GetLastError () returned 0x3f0
[0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.702] GetLastError () returned 0x3f0
[0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0087.702] GetLastError () returned 0x12
[0087.702] FindClose (in: hFindFile=0x42c330 | out: hFindFile=0x42c330) returned 1
[0087.702] SetErrorMode (uMode=0x0) returned 0x1
[0087.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26
[0087.702] GetLastError () returned 0x12
[0087.702] SetErrorMode (uMode=0x1) returned 0x0
[0087.702] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c330
[0087.702] GetLastError () returned 0x12
[0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.702] GetLastError () returned 0x12
[0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.702] GetLastError () returned 0x12
[0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.702] GetLastError () returned 0x12
[0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.702] GetLastError () returned 0x12
[0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.702] GetLastError () returned 0x12
[0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.703] GetLastError () returned 0x12
[0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.704] GetLastError () returned 0x12
[0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.704] GetLastError () returned 0x12
[0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.704] GetLastError () returned 0x12
[0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.704] GetLastError () returned 0x12
[0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.704] GetLastError () returned 0x12
[0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.704] GetLastError () returned 0x12
[0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.704] GetLastError () returned 0x12
[0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.704] GetLastError () returned 0x12
[0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.704] GetLastError () returned 0x12
[0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.704] GetLastError () returned 0x12
[0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.704] GetLastError () returned 0x12
[0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.704] GetLastError () returned 0x12
[0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0087.704] GetLastError () returned 0x12
[0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0087.704] GetLastError () returned 0x12
[0087.704] FindClose (in: hFindFile=0x42c330 | out: hFindFile=0x42c330) returned 1
[0087.704] SetErrorMode (uMode=0x0) returned 0x1
[0087.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt", lpFilePart=0x0) returned 0x31
[0087.705] GetLastError () returned 0x12
[0087.705] SetErrorMode (uMode=0x1) returned 0x0
[0087.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01zwrvx.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0087.705] GetLastError () returned 0x0
[0087.705] GetFileType (hFile=0x21c) returned 0x1
[0087.705] SetErrorMode (uMode=0x0) returned 0x1
[0087.705] GetFileType (hFile=0x21c) returned 0x1
[0087.705] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0x5a60
[0087.705] GetLastError () returned 0x0
[0087.705] ReadFile (in: hFile=0x21c, lpBuffer=0x2573230, nNumberOfBytesToRead=0x5a60, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2573230*, lpNumberOfBytesRead=0x39ec18*=0x5a60, lpOverlapped=0x0) returned 1
[0087.706] GetLastError () returned 0x0
[0087.706] CloseHandle (hObject=0x21c) returned 1
[0087.706] GetLastError () returned 0x0
[0087.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt", lpFilePart=0x0) returned 0x31
[0087.758] GetLastError () returned 0x0
[0087.758] SetErrorMode (uMode=0x1) returned 0x0
[0087.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01zwrvx.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0087.760] GetLastError () returned 0xb7
[0087.760] GetFileType (hFile=0x21c) returned 0x1
[0087.760] GetFileType (hFile=0x21c) returned 0x1
[0087.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt", lpFilePart=0x0) returned 0x31
[0087.761] GetLastError () returned 0xb7
[0087.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt.LanRan2.0.5", lpFilePart=0x0) returned 0x3d
[0087.761] GetLastError () returned 0xb7
[0087.761] SetErrorMode (uMode=0x1) returned 0x0
[0087.761] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01zwrvx.ppt"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2def79d0, ftCreationTime.dwHighDateTime=0x1d3a852, ftLastAccessTime.dwLowDateTime=0x6be64ab0, ftLastAccessTime.dwHighDateTime=0x1d3a14b, ftLastWriteTime.dwLowDateTime=0x32602c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x5a70)) returned 1
[0087.761] GetLastError () returned 0xb7
[0087.761] SetErrorMode (uMode=0x0) returned 0x1
[0087.761] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01zwrvx.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01zwrvx.ppt.lanran2.0.5")) returned 1
[0087.762] GetLastError () returned 0xb7
[0087.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4", lpFilePart=0x0) returned 0x3c
[0087.762] GetLastError () returned 0xb7
[0087.762] SetErrorMode (uMode=0x1) returned 0x0
[0087.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1g7fsw9r5ibyucv1g3.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0087.762] GetLastError () returned 0x0
[0087.762] GetFileType (hFile=0x21c) returned 0x1
[0087.763] GetFileType (hFile=0x21c) returned 0x1
[0087.763] ReadFile (in: hFile=0x21c, lpBuffer=0x261d294, nNumberOfBytesToRead=0xa4da, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x261d294*, lpNumberOfBytesRead=0x39ec18*=0xa4da, lpOverlapped=0x0) returned 1
[0087.763] GetLastError () returned 0x0
[0087.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4", lpFilePart=0x0) returned 0x3c
[0087.796] GetLastError () returned 0x0
[0087.796] SetErrorMode (uMode=0x1) returned 0x0
[0087.797] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1g7fsw9r5ibyucv1g3.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0087.798] GetLastError () returned 0xb7
[0087.798] GetFileType (hFile=0x21c) returned 0x1
[0087.798] GetFileType (hFile=0x21c) returned 0x1
[0087.799] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4", lpFilePart=0x0) returned 0x3c
[0087.799] GetLastError () returned 0xb7
[0087.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4.LanRan2.0.5", lpFilePart=0x0) returned 0x48
[0087.800] GetLastError () returned 0xb7
[0087.800] SetErrorMode (uMode=0x1) returned 0x0
[0087.800] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1g7fsw9r5ibyucv1g3.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565bee40, ftCreationTime.dwHighDateTime=0x1d3af31, ftLastAccessTime.dwLowDateTime=0xbe6d0200, ftLastAccessTime.dwHighDateTime=0x1d3a863, ftLastWriteTime.dwLowDateTime=0x32ac580, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xa4e0)) returned 1
[0087.800] GetLastError () returned 0xb7
[0087.800] SetErrorMode (uMode=0x0) returned 0x1
[0087.800] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1g7fsw9r5ibyucv1g3.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1g7fsw9r5ibyucv1g3.mp4.lanran2.0.5")) returned 1
[0087.801] GetLastError () returned 0xb7
[0087.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg", lpFilePart=0x0) returned 0x35
[0087.801] GetLastError () returned 0xb7
[0087.801] SetErrorMode (uMode=0x1) returned 0x0
[0087.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7sctepfgj-s.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0087.801] GetLastError () returned 0x0
[0087.801] GetFileType (hFile=0x21c) returned 0x1
[0087.801] GetFileType (hFile=0x21c) returned 0x1
[0087.801] ReadFile (in: hFile=0x21c, lpBuffer=0x26e306c, nNumberOfBytesToRead=0x7b21, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26e306c*, lpNumberOfBytesRead=0x39ec18*=0x7b21, lpOverlapped=0x0) returned 1
[0087.802] GetLastError () returned 0x0
[0087.832] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg", lpFilePart=0x0) returned 0x35
[0087.832] GetLastError () returned 0x0
[0087.832] SetErrorMode (uMode=0x1) returned 0x0
[0087.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7sctepfgj-s.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0087.833] GetLastError () returned 0xb7
[0087.833] GetFileType (hFile=0x21c) returned 0x1
[0087.833] GetFileType (hFile=0x21c) returned 0x1
[0087.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg", lpFilePart=0x0) returned 0x35
[0087.834] GetLastError () returned 0xb7
[0087.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x41
[0087.834] GetLastError () returned 0xb7
[0087.834] SetErrorMode (uMode=0x1) returned 0x0
[0087.834] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7sctepfgj-s.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd6b4a0, ftCreationTime.dwHighDateTime=0x1d3a279, ftLastAccessTime.dwLowDateTime=0x3edf37d0, ftLastAccessTime.dwHighDateTime=0x1d3af5a, ftLastWriteTime.dwLowDateTime=0x32f8840, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x7b30)) returned 1
[0087.835] GetLastError () returned 0xb7
[0087.835] SetErrorMode (uMode=0x0) returned 0x1
[0087.835] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7sctepfgj-s.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7sctepfgj-s.jpg.lanran2.0.5")) returned 1
[0087.836] GetLastError () returned 0xb7
[0087.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", lpFilePart=0x0) returned 0x38
[0087.836] GetLastError () returned 0xb7
[0087.836] SetErrorMode (uMode=0x1) returned 0x0
[0087.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\@___readme___@.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0087.836] GetLastError () returned 0x0
[0087.836] GetFileType (hFile=0x21c) returned 0x1
[0087.836] GetFileType (hFile=0x21c) returned 0x1
[0087.836] ReadFile (in: hFile=0x21c, lpBuffer=0x2799a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2799a88*, lpNumberOfBytesRead=0x39ec18*=0x696, lpOverlapped=0x0) returned 1
[0087.836] GetLastError () returned 0x0
[0087.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", lpFilePart=0x0) returned 0x38
[0087.895] GetLastError () returned 0x0
[0087.895] SetErrorMode (uMode=0x1) returned 0x0
[0087.896] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\@___readme___@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0087.896] GetLastError () returned 0xb7
[0087.897] GetFileType (hFile=0x21c) returned 0x1
[0087.897] GetFileType (hFile=0x21c) returned 0x1
[0087.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", lpFilePart=0x0) returned 0x38
[0087.898] GetLastError () returned 0xb7
[0087.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt.LanRan2.0.5", lpFilePart=0x0) returned 0x44
[0087.898] GetLastError () returned 0xb7
[0087.898] SetErrorMode (uMode=0x1) returned 0x0
[0087.898] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\@___readme___@.txt"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9a082c0, ftCreationTime.dwHighDateTime=0x1d41168, ftLastAccessTime.dwLowDateTime=0xf9a082c0, ftLastAccessTime.dwHighDateTime=0x1d41168, ftLastWriteTime.dwLowDateTime=0x33b6f20, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x6a0)) returned 1
[0087.898] GetLastError () returned 0xb7
[0087.898] SetErrorMode (uMode=0x0) returned 0x1
[0087.898] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\@___readme___@.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\@___readme___@.txt.lanran2.0.5")) returned 1
[0087.899] GetLastError () returned 0xb7
[0087.899] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv", lpFilePart=0x0) returned 0x31
[0087.899] GetLastError () returned 0xb7
[0087.899] SetErrorMode (uMode=0x1) returned 0x0
[0087.899] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dmiwofz.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0087.899] GetLastError () returned 0x0
[0087.899] GetFileType (hFile=0x21c) returned 0x1
[0087.899] GetFileType (hFile=0x21c) returned 0x1
[0087.899] ReadFile (in: hFile=0x21c, lpBuffer=0x2577330, nNumberOfBytesToRead=0xbec1, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2577330*, lpNumberOfBytesRead=0x39ec18*=0xbec1, lpOverlapped=0x0) returned 1
[0087.900] GetLastError () returned 0x0
[0087.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv", lpFilePart=0x0) returned 0x31
[0087.925] GetLastError () returned 0x0
[0087.925] SetErrorMode (uMode=0x1) returned 0x0
[0087.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dmiwofz.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0087.927] GetLastError () returned 0xb7
[0087.927] GetFileType (hFile=0x21c) returned 0x1
[0087.927] GetFileType (hFile=0x21c) returned 0x1
[0087.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv", lpFilePart=0x0) returned 0x31
[0087.928] GetLastError () returned 0xb7
[0087.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv.LanRan2.0.5", lpFilePart=0x0) returned 0x3d
[0087.928] GetLastError () returned 0xb7
[0087.928] SetErrorMode (uMode=0x1) returned 0x0
[0087.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dmiwofz.csv"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56305c0, ftCreationTime.dwHighDateTime=0x1d3a22d, ftLastAccessTime.dwLowDateTime=0x574f0280, ftLastAccessTime.dwHighDateTime=0x1d3a6ba, ftLastWriteTime.dwLowDateTime=0x33dd080, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xbed0)) returned 1
[0087.928] GetLastError () returned 0xb7
[0087.928] SetErrorMode (uMode=0x0) returned 0x1
[0087.928] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dmiwofz.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dmiwofz.csv.lanran2.0.5")) returned 1
[0087.929] GetLastError () returned 0xb7
[0087.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp", lpFilePart=0x0) returned 0x34
[0087.929] GetLastError () returned 0xb7
[0087.929] SetErrorMode (uMode=0x1) returned 0x0
[0087.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e wxc788va.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0087.929] GetLastError () returned 0x0
[0087.929] GetFileType (hFile=0x21c) returned 0x1
[0087.930] GetFileType (hFile=0x21c) returned 0x1
[0087.930] ReadFile (in: hFile=0x21c, lpBuffer=0x262f02c, nNumberOfBytesToRead=0x4a18, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x262f02c*, lpNumberOfBytesRead=0x39ec18*=0x4a18, lpOverlapped=0x0) returned 1
[0087.930] GetLastError () returned 0x0
[0087.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp", lpFilePart=0x0) returned 0x34
[0087.955] GetLastError () returned 0x0
[0087.955] SetErrorMode (uMode=0x1) returned 0x0
[0087.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e wxc788va.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0087.956] GetLastError () returned 0xb7
[0087.956] GetFileType (hFile=0x21c) returned 0x1
[0087.956] GetFileType (hFile=0x21c) returned 0x1
[0087.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp", lpFilePart=0x0) returned 0x34
[0087.957] GetLastError () returned 0xb7
[0087.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp.LanRan2.0.5", lpFilePart=0x0) returned 0x40
[0087.957] GetLastError () returned 0xb7
[0087.957] SetErrorMode (uMode=0x1) returned 0x0
[0087.957] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e wxc788va.bmp"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88835eb0, ftCreationTime.dwHighDateTime=0x1d3add0, ftLastAccessTime.dwLowDateTime=0x64997df0, ftLastAccessTime.dwHighDateTime=0x1d3a348, ftLastWriteTime.dwLowDateTime=0x3429340, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x4a20)) returned 1
[0087.957] GetLastError () returned 0xb7
[0087.957] SetErrorMode (uMode=0x0) returned 0x1
[0087.957] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e wxc788va.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e wxc788va.bmp.lanran2.0.5")) returned 1
[0087.958] GetLastError () returned 0xb7
[0087.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png", lpFilePart=0x0) returned 0x3d
[0087.958] GetLastError () returned 0xb7
[0087.958] SetErrorMode (uMode=0x1) returned 0x0
[0087.958] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ecsqc_ysqethy4sfp q.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0087.959] GetLastError () returned 0x0
[0087.959] GetFileType (hFile=0x21c) returned 0x1
[0087.959] GetFileType (hFile=0x21c) returned 0x1
[0087.959] ReadFile (in: hFile=0x21c, lpBuffer=0x26d2d34, nNumberOfBytesToRead=0x2889, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26d2d34*, lpNumberOfBytesRead=0x39ec18*=0x2889, lpOverlapped=0x0) returned 1
[0087.959] GetLastError () returned 0x0
[0088.018] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png", lpFilePart=0x0) returned 0x3d
[0088.018] GetLastError () returned 0x0
[0088.018] SetErrorMode (uMode=0x1) returned 0x0
[0088.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ecsqc_ysqethy4sfp q.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.019] GetLastError () returned 0xb7
[0088.019] GetFileType (hFile=0x21c) returned 0x1
[0088.019] GetFileType (hFile=0x21c) returned 0x1
[0088.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png", lpFilePart=0x0) returned 0x3d
[0088.020] GetLastError () returned 0xb7
[0088.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png.LanRan2.0.5", lpFilePart=0x0) returned 0x49
[0088.020] GetLastError () returned 0xb7
[0088.020] SetErrorMode (uMode=0x1) returned 0x0
[0088.020] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ecsqc_ysqethy4sfp q.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9f7740, ftCreationTime.dwHighDateTime=0x1d3a080, ftLastAccessTime.dwLowDateTime=0xc177deb0, ftLastAccessTime.dwHighDateTime=0x1d3a44a, ftLastWriteTime.dwLowDateTime=0x34c18c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x2890)) returned 1
[0088.020] GetLastError () returned 0xb7
[0088.020] SetErrorMode (uMode=0x0) returned 0x1
[0088.021] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ecsqc_ysqethy4sfp q.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ecsqc_ysqethy4sfp q.png.lanran2.0.5")) returned 1
[0088.021] GetLastError () returned 0xb7
[0088.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3", lpFilePart=0x0) returned 0x32
[0088.022] GetLastError () returned 0xb7
[0088.022] SetErrorMode (uMode=0x1) returned 0x0
[0088.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdernccw.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.022] GetLastError () returned 0x0
[0088.022] GetFileType (hFile=0x21c) returned 0x1
[0088.022] GetFileType (hFile=0x21c) returned 0x1
[0088.022] ReadFile (in: hFile=0x21c, lpBuffer=0x256c2d8, nNumberOfBytesToRead=0x2efa, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x256c2d8*, lpNumberOfBytesRead=0x39ec18*=0x2efa, lpOverlapped=0x0) returned 1
[0088.023] GetLastError () returned 0x0
[0088.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3", lpFilePart=0x0) returned 0x32
[0088.047] GetLastError () returned 0x0
[0088.047] SetErrorMode (uMode=0x1) returned 0x0
[0088.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdernccw.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.049] GetLastError () returned 0xb7
[0088.049] GetFileType (hFile=0x21c) returned 0x1
[0088.049] GetFileType (hFile=0x21c) returned 0x1
[0088.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3", lpFilePart=0x0) returned 0x32
[0088.050] GetLastError () returned 0xb7
[0088.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x3e
[0088.050] GetLastError () returned 0xb7
[0088.050] SetErrorMode (uMode=0x1) returned 0x0
[0088.050] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdernccw.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x570b4ba0, ftCreationTime.dwHighDateTime=0x1d3af32, ftLastAccessTime.dwLowDateTime=0xbc856080, ftLastAccessTime.dwHighDateTime=0x1d3aea9, ftLastWriteTime.dwLowDateTime=0x350db80, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x2f00)) returned 1
[0088.050] GetLastError () returned 0xb7
[0088.050] SetErrorMode (uMode=0x0) returned 0x1
[0088.050] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdernccw.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdernccw.mp3.lanran2.0.5")) returned 1
[0088.051] GetLastError () returned 0xb7
[0088.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt", lpFilePart=0x0) returned 0x2e
[0088.051] GetLastError () returned 0xb7
[0088.051] SetErrorMode (uMode=0x1) returned 0x0
[0088.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fukr.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.051] GetLastError () returned 0x0
[0088.051] GetFileType (hFile=0x21c) returned 0x1
[0088.051] GetFileType (hFile=0x21c) returned 0x1
[0088.051] ReadFile (in: hFile=0x21c, lpBuffer=0x2605e7c, nNumberOfBytesToRead=0x1e72, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2605e7c*, lpNumberOfBytesRead=0x39ec18*=0x1e72, lpOverlapped=0x0) returned 1
[0088.052] GetLastError () returned 0x0
[0088.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt", lpFilePart=0x0) returned 0x2e
[0088.088] GetLastError () returned 0x0
[0088.088] SetErrorMode (uMode=0x1) returned 0x0
[0088.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fukr.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.089] GetLastError () returned 0xb7
[0088.089] GetFileType (hFile=0x21c) returned 0x1
[0088.089] GetFileType (hFile=0x21c) returned 0x1
[0088.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt", lpFilePart=0x0) returned 0x2e
[0088.090] GetLastError () returned 0xb7
[0088.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt.LanRan2.0.5", lpFilePart=0x0) returned 0x3a
[0088.090] GetLastError () returned 0xb7
[0088.090] SetErrorMode (uMode=0x1) returned 0x0
[0088.090] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fukr.odt"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f34da40, ftCreationTime.dwHighDateTime=0x1d3a190, ftLastAccessTime.dwLowDateTime=0xbabbc900, ftLastAccessTime.dwHighDateTime=0x1d3a090, ftLastWriteTime.dwLowDateTime=0x357ffa0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x1e80)) returned 1
[0088.091] GetLastError () returned 0xb7
[0088.091] SetErrorMode (uMode=0x0) returned 0x1
[0088.091] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fukr.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fukr.odt.lanran2.0.5")) returned 1
[0088.092] GetLastError () returned 0xb7
[0088.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx", lpFilePart=0x0) returned 0x35
[0088.092] GetLastError () returned 0xb7
[0088.092] SetErrorMode (uMode=0x1) returned 0x0
[0088.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jww ehsrfj.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.092] GetLastError () returned 0x0
[0088.092] GetFileType (hFile=0x21c) returned 0x1
[0088.092] GetFileType (hFile=0x21c) returned 0x1
[0088.092] ReadFile (in: hFile=0x21c, lpBuffer=0x2699588, nNumberOfBytesToRead=0xe58c, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2699588*, lpNumberOfBytesRead=0x39ec18*=0xe58c, lpOverlapped=0x0) returned 1
[0088.093] GetLastError () returned 0x0
[0088.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx", lpFilePart=0x0) returned 0x35
[0088.131] GetLastError () returned 0x0
[0088.131] SetErrorMode (uMode=0x1) returned 0x0
[0088.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jww ehsrfj.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.133] GetLastError () returned 0xb7
[0088.133] GetFileType (hFile=0x21c) returned 0x1
[0088.133] SetErrorMode (uMode=0x0) returned 0x1
[0088.133] GetFileType (hFile=0x21c) returned 0x1
[0088.133] WriteFile (in: hFile=0x21c, lpBuffer=0x2557b30*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x39ec24, lpOverlapped=0x0 | out: lpBuffer=0x2557b30*, lpNumberOfBytesWritten=0x39ec24*=0xe590, lpOverlapped=0x0) returned 1
[0088.134] GetLastError () returned 0xb7
[0088.134] CloseHandle (hObject=0x21c) returned 1
[0088.136] GetLastError () returned 0xb7
[0088.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx", lpFilePart=0x0) returned 0x35
[0088.136] GetLastError () returned 0xb7
[0088.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x41
[0088.136] GetLastError () returned 0xb7
[0088.136] SetErrorMode (uMode=0x1) returned 0x0
[0088.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jww ehsrfj.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1a5010, ftCreationTime.dwHighDateTime=0x1d3a5d3, ftLastAccessTime.dwLowDateTime=0xd0a1c360, ftLastAccessTime.dwHighDateTime=0x1d3a026, ftLastWriteTime.dwLowDateTime=0x35f23c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xe590)) returned 1
[0088.136] GetLastError () returned 0xb7
[0088.136] SetErrorMode (uMode=0x0) returned 0x1
[0088.137] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jww ehsrfj.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jww ehsrfj.pptx.lanran2.0.5")) returned 1
[0088.138] GetLastError () returned 0xb7
[0088.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38
[0088.138] GetLastError () returned 0xb7
[0088.138] SetErrorMode (uMode=0x1) returned 0x0
[0088.138] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.138] GetLastError () returned 0x0
[0088.138] GetFileType (hFile=0x21c) returned 0x1
[0088.138] SetErrorMode (uMode=0x0) returned 0x1
[0088.138] GetFileType (hFile=0x21c) returned 0x1
[0088.138] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0x34400
[0088.138] GetLastError () returned 0x0
[0088.140] ReadFile (in: hFile=0x21c, lpBuffer=0x36149f0, nNumberOfBytesToRead=0x34400, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x36149f0*, lpNumberOfBytesRead=0x39ec18*=0x34400, lpOverlapped=0x0) returned 1
[0088.141] GetLastError () returned 0x0
[0088.141] CloseHandle (hObject=0x21c) returned 1
[0088.141] GetLastError () returned 0x0
[0088.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38
[0088.229] GetLastError () returned 0x0
[0088.229] SetErrorMode (uMode=0x1) returned 0x0
[0088.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
[0088.230] GetLastError () returned 0x20
[0088.232] SetErrorMode (uMode=0x0) returned 0x1
[0088.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif", lpFilePart=0x0) returned 0x3e
[0088.232] GetLastError () returned 0x20
[0088.232] SetErrorMode (uMode=0x1) returned 0x0
[0088.232] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o1dnin_torm0c32phrbo.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.232] GetLastError () returned 0x0
[0088.232] GetFileType (hFile=0x21c) returned 0x1
[0088.232] SetErrorMode (uMode=0x0) returned 0x1
[0088.232] GetFileType (hFile=0x21c) returned 0x1
[0088.232] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0x9126
[0088.232] GetLastError () returned 0x0
[0088.232] ReadFile (in: hFile=0x21c, lpBuffer=0x25ef064, nNumberOfBytesToRead=0x9126, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25ef064*, lpNumberOfBytesRead=0x39ec18*=0x9126, lpOverlapped=0x0) returned 1
[0088.233] GetLastError () returned 0x0
[0088.233] CloseHandle (hObject=0x21c) returned 1
[0088.233] GetLastError () returned 0x0
[0088.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif", lpFilePart=0x0) returned 0x3e
[0088.277] GetLastError () returned 0x0
[0088.277] SetErrorMode (uMode=0x1) returned 0x0
[0088.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o1dnin_torm0c32phrbo.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.278] GetLastError () returned 0xb7
[0088.279] GetFileType (hFile=0x21c) returned 0x1
[0088.279] GetFileType (hFile=0x21c) returned 0x1
[0088.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif", lpFilePart=0x0) returned 0x3e
[0088.280] GetLastError () returned 0xb7
[0088.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x4a
[0088.280] GetLastError () returned 0xb7
[0088.280] SetErrorMode (uMode=0x1) returned 0x0
[0088.280] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o1dnin_torm0c32phrbo.gif"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec4ca1b0, ftCreationTime.dwHighDateTime=0x1d3a243, ftLastAccessTime.dwLowDateTime=0x544dee20, ftLastAccessTime.dwHighDateTime=0x1d3a944, ftLastWriteTime.dwLowDateTime=0x3749020, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x9130)) returned 1
[0088.280] GetLastError () returned 0xb7
[0088.280] SetErrorMode (uMode=0x0) returned 0x1
[0088.280] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o1dnin_torm0c32phrbo.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o1dnin_torm0c32phrbo.gif.lanran2.0.5")) returned 1
[0088.281] GetLastError () returned 0xb7
[0088.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf", lpFilePart=0x0) returned 0x39
[0088.281] GetLastError () returned 0xb7
[0088.281] SetErrorMode (uMode=0x1) returned 0x0
[0088.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\os5w-yo1b1y1zoj.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.281] GetLastError () returned 0x0
[0088.281] GetFileType (hFile=0x21c) returned 0x1
[0088.281] GetFileType (hFile=0x21c) returned 0x1
[0088.281] ReadFile (in: hFile=0x21c, lpBuffer=0x26ad824, nNumberOfBytesToRead=0xfc19, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26ad824*, lpNumberOfBytesRead=0x39ec18*=0xfc19, lpOverlapped=0x0) returned 1
[0088.282] GetLastError () returned 0x0
[0088.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf", lpFilePart=0x0) returned 0x39
[0088.301] GetLastError () returned 0x0
[0088.301] SetErrorMode (uMode=0x1) returned 0x0
[0088.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\os5w-yo1b1y1zoj.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.302] GetLastError () returned 0xb7
[0088.302] GetFileType (hFile=0x21c) returned 0x1
[0088.302] SetErrorMode (uMode=0x0) returned 0x1
[0088.302] GetFileType (hFile=0x21c) returned 0x1
[0088.302] WriteFile (in: hFile=0x21c, lpBuffer=0x2566060*, nNumberOfBytesToWrite=0xfc20, lpNumberOfBytesWritten=0x39ec24, lpOverlapped=0x0 | out: lpBuffer=0x2566060*, lpNumberOfBytesWritten=0x39ec24*=0xfc20, lpOverlapped=0x0) returned 1
[0088.303] GetLastError () returned 0xb7
[0088.303] CloseHandle (hObject=0x21c) returned 1
[0088.307] GetLastError () returned 0xb7
[0088.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf", lpFilePart=0x0) returned 0x39
[0088.307] GetLastError () returned 0xb7
[0088.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf.LanRan2.0.5", lpFilePart=0x0) returned 0x45
[0088.307] GetLastError () returned 0xb7
[0088.307] SetErrorMode (uMode=0x1) returned 0x0
[0088.308] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\os5w-yo1b1y1zoj.rtf"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d4fa2e0, ftCreationTime.dwHighDateTime=0x1d3a5b1, ftLastAccessTime.dwLowDateTime=0xc742c990, ftLastAccessTime.dwHighDateTime=0x1d39fe0, ftLastWriteTime.dwLowDateTime=0x37952e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xfc20)) returned 1
[0088.308] GetLastError () returned 0xb7
[0088.308] SetErrorMode (uMode=0x0) returned 0x1
[0088.308] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\os5w-yo1b1y1zoj.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\os5w-yo1b1y1zoj.rtf.lanran2.0.5")) returned 1
[0088.308] GetLastError () returned 0xb7
[0088.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg", lpFilePart=0x0) returned 0x32
[0088.308] GetLastError () returned 0xb7
[0088.308] SetErrorMode (uMode=0x1) returned 0x0
[0088.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pfd82kmu.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.309] GetLastError () returned 0x0
[0088.309] GetFileType (hFile=0x21c) returned 0x1
[0088.309] SetErrorMode (uMode=0x0) returned 0x1
[0088.309] GetFileType (hFile=0x21c) returned 0x1
[0088.309] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0x1317b
[0088.309] GetLastError () returned 0x0
[0088.309] ReadFile (in: hFile=0x21c, lpBuffer=0x25764f0, nNumberOfBytesToRead=0x1317b, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25764f0*, lpNumberOfBytesRead=0x39ec18*=0x1317b, lpOverlapped=0x0) returned 1
[0088.310] GetLastError () returned 0x0
[0088.310] CloseHandle (hObject=0x21c) returned 1
[0088.310] GetLastError () returned 0x0
[0088.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg", lpFilePart=0x0) returned 0x32
[0088.360] GetLastError () returned 0x0
[0088.360] SetErrorMode (uMode=0x1) returned 0x0
[0088.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pfd82kmu.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.362] GetLastError () returned 0xb7
[0088.362] GetFileType (hFile=0x21c) returned 0x1
[0088.362] GetFileType (hFile=0x21c) returned 0x1
[0088.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg", lpFilePart=0x0) returned 0x32
[0088.364] GetLastError () returned 0xb7
[0088.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x3e
[0088.364] GetLastError () returned 0xb7
[0088.364] SetErrorMode (uMode=0x1) returned 0x0
[0088.364] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pfd82kmu.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d280c50, ftCreationTime.dwHighDateTime=0x1d3abee, ftLastAccessTime.dwLowDateTime=0x20db6620, ftLastAccessTime.dwHighDateTime=0x1d3a72e, ftLastWriteTime.dwLowDateTime=0x3807700, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x13180)) returned 1
[0088.364] GetLastError () returned 0xb7
[0088.364] SetErrorMode (uMode=0x0) returned 0x1
[0088.364] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pfd82kmu.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pfd82kmu.jpg.lanran2.0.5")) returned 1
[0088.366] GetLastError () returned 0xb7
[0088.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx", lpFilePart=0x0) returned 0x3d
[0088.366] GetLastError () returned 0xb7
[0088.366] SetErrorMode (uMode=0x1) returned 0x0
[0088.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\satcx9nutaaxstwmxb.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.366] GetLastError () returned 0x0
[0088.366] GetFileType (hFile=0x21c) returned 0x1
[0088.366] GetFileType (hFile=0x21c) returned 0x1
[0088.366] ReadFile (in: hFile=0x21c, lpBuffer=0x264ace0, nNumberOfBytesToRead=0x8499, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x264ace0*, lpNumberOfBytesRead=0x39ec18*=0x8499, lpOverlapped=0x0) returned 1
[0088.367] GetLastError () returned 0x0
[0088.393] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx", lpFilePart=0x0) returned 0x3d
[0088.393] GetLastError () returned 0x0
[0088.393] SetErrorMode (uMode=0x1) returned 0x0
[0088.393] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\satcx9nutaaxstwmxb.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.395] GetLastError () returned 0xb7
[0088.395] GetFileType (hFile=0x21c) returned 0x1
[0088.395] GetFileType (hFile=0x21c) returned 0x1
[0088.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx", lpFilePart=0x0) returned 0x3d
[0088.396] GetLastError () returned 0xb7
[0088.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x49
[0088.396] GetLastError () returned 0xb7
[0088.396] SetErrorMode (uMode=0x1) returned 0x0
[0088.396] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\satcx9nutaaxstwmxb.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f36b9a0, ftCreationTime.dwHighDateTime=0x1d3a7ab, ftLastAccessTime.dwLowDateTime=0xa16d20e0, ftLastAccessTime.dwHighDateTime=0x1d3a9fd, ftLastWriteTime.dwLowDateTime=0x38539c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x84a0)) returned 1
[0088.396] GetLastError () returned 0xb7
[0088.396] SetErrorMode (uMode=0x0) returned 0x1
[0088.396] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\satcx9nutaaxstwmxb.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\satcx9nutaaxstwmxb.pptx.lanran2.0.5")) returned 1
[0088.397] GetLastError () returned 0xb7
[0088.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt", lpFilePart=0x0) returned 0x36
[0088.397] GetLastError () returned 0xb7
[0088.397] SetErrorMode (uMode=0x1) returned 0x0
[0088.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vjxpznfyv9dc.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.398] GetLastError () returned 0x0
[0088.398] GetFileType (hFile=0x21c) returned 0x1
[0088.398] GetFileType (hFile=0x21c) returned 0x1
[0088.400] ReadFile (in: hFile=0x21c, lpBuffer=0x24f1804, nNumberOfBytesToRead=0x99db, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x24f1804*, lpNumberOfBytesRead=0x39ec18*=0x99db, lpOverlapped=0x0) returned 1
[0088.401] GetLastError () returned 0x0
[0088.401] CloseHandle (hObject=0x21c) returned 1
[0088.401] GetLastError () returned 0x0
[0088.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt", lpFilePart=0x0) returned 0x36
[0088.454] GetLastError () returned 0x0
[0088.454] SetErrorMode (uMode=0x1) returned 0x0
[0088.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vjxpznfyv9dc.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.456] GetLastError () returned 0xb7
[0088.456] GetFileType (hFile=0x21c) returned 0x1
[0088.456] GetFileType (hFile=0x21c) returned 0x1
[0088.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt", lpFilePart=0x0) returned 0x36
[0088.457] GetLastError () returned 0xb7
[0088.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt.LanRan2.0.5", lpFilePart=0x0) returned 0x42
[0088.457] GetLastError () returned 0xb7
[0088.457] SetErrorMode (uMode=0x1) returned 0x0
[0088.457] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vjxpznfyv9dc.odt"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7702490, ftCreationTime.dwHighDateTime=0x1d3a1c2, ftLastAccessTime.dwLowDateTime=0x6c221d30, ftLastAccessTime.dwHighDateTime=0x1d3a617, ftLastWriteTime.dwLowDateTime=0x38ebf40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x99e0)) returned 1
[0088.457] GetLastError () returned 0xb7
[0088.457] SetErrorMode (uMode=0x0) returned 0x1
[0088.457] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vjxpznfyv9dc.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vjxpznfyv9dc.odt.lanran2.0.5")) returned 1
[0088.458] GetLastError () returned 0xb7
[0088.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png", lpFilePart=0x0) returned 0x3c
[0088.458] GetLastError () returned 0xb7
[0088.458] SetErrorMode (uMode=0x1) returned 0x0
[0088.458] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xp5sknoafuzblkthwf.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.458] GetLastError () returned 0x0
[0088.458] GetFileType (hFile=0x21c) returned 0x1
[0088.458] GetFileType (hFile=0x21c) returned 0x1
[0088.458] ReadFile (in: hFile=0x21c, lpBuffer=0x25b3580, nNumberOfBytesToRead=0x14dd, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25b3580*, lpNumberOfBytesRead=0x39ec18*=0x14dd, lpOverlapped=0x0) returned 1
[0088.459] GetLastError () returned 0x0
[0088.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png", lpFilePart=0x0) returned 0x3c
[0088.478] GetLastError () returned 0x0
[0088.478] SetErrorMode (uMode=0x1) returned 0x0
[0088.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xp5sknoafuzblkthwf.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.479] GetLastError () returned 0xb7
[0088.479] GetFileType (hFile=0x21c) returned 0x1
[0088.479] GetFileType (hFile=0x21c) returned 0x1
[0088.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png", lpFilePart=0x0) returned 0x3c
[0088.480] GetLastError () returned 0xb7
[0088.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png.LanRan2.0.5", lpFilePart=0x0) returned 0x48
[0088.480] GetLastError () returned 0xb7
[0088.480] SetErrorMode (uMode=0x1) returned 0x0
[0088.480] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xp5sknoafuzblkthwf.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdcc6250, ftCreationTime.dwHighDateTime=0x1d3a206, ftLastAccessTime.dwLowDateTime=0xe3d5ef00, ftLastAccessTime.dwHighDateTime=0x1d3a400, ftLastWriteTime.dwLowDateTime=0x3938200, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x14e0)) returned 1
[0088.480] GetLastError () returned 0xb7
[0088.480] SetErrorMode (uMode=0x0) returned 0x1
[0088.480] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xp5sknoafuzblkthwf.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xp5sknoafuzblkthwf.png.lanran2.0.5")) returned 1
[0088.481] GetLastError () returned 0xb7
[0088.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX", lpFilePart=0x0) returned 0x32
[0088.481] GetLastError () returned 0xb7
[0088.481] SetErrorMode (uMode=0x1) returned 0x0
[0088.481] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0088.481] GetLastError () returned 0xb7
[0088.481] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.481] GetLastError () returned 0xb7
[0088.481] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.481] GetLastError () returned 0xb7
[0088.481] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.481] GetLastError () returned 0xb7
[0088.481] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.481] GetLastError () returned 0xb7
[0088.481] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.482] GetLastError () returned 0xb7
[0088.482] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.482] GetLastError () returned 0xb7
[0088.482] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0088.482] GetLastError () returned 0x12
[0088.482] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0088.482] SetErrorMode (uMode=0x0) returned 0x1
[0088.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX", lpFilePart=0x0) returned 0x32
[0088.482] GetLastError () returned 0x12
[0088.482] SetErrorMode (uMode=0x1) returned 0x0
[0088.482] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0088.482] GetLastError () returned 0x12
[0088.482] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.482] GetLastError () returned 0x12
[0088.482] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.482] GetLastError () returned 0x12
[0088.482] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.482] GetLastError () returned 0x12
[0088.482] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.482] GetLastError () returned 0x12
[0088.482] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.482] GetLastError () returned 0x12
[0088.483] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.483] GetLastError () returned 0x12
[0088.483] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0088.483] GetLastError () returned 0x12
[0088.483] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0088.483] SetErrorMode (uMode=0x0) returned 0x1
[0088.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg", lpFilePart=0x0) returned 0x3d
[0088.483] GetLastError () returned 0x12
[0088.483] SetErrorMode (uMode=0x1) returned 0x0
[0088.483] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\qb61ws.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.483] GetLastError () returned 0x0
[0088.483] GetFileType (hFile=0x21c) returned 0x1
[0088.483] SetErrorMode (uMode=0x0) returned 0x1
[0088.483] GetFileType (hFile=0x21c) returned 0x1
[0088.483] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x39ec10 | out: lpFileSizeHigh=0x39ec10*=0x0) returned 0x2b38
[0088.483] GetLastError () returned 0x0
[0088.483] ReadFile (in: hFile=0x21c, lpBuffer=0x2644918, nNumberOfBytesToRead=0x2b38, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x2644918*, lpNumberOfBytesRead=0x39ebb8*=0x2b38, lpOverlapped=0x0) returned 1
[0088.484] GetLastError () returned 0x0
[0088.484] CloseHandle (hObject=0x21c) returned 1
[0088.484] GetLastError () returned 0x0
[0088.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg", lpFilePart=0x0) returned 0x3d
[0088.536] GetLastError () returned 0x0
[0088.536] SetErrorMode (uMode=0x1) returned 0x0
[0088.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\qb61ws.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.536] GetLastError () returned 0xb7
[0088.536] GetFileType (hFile=0x21c) returned 0x1
[0088.537] GetFileType (hFile=0x21c) returned 0x1
[0088.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg", lpFilePart=0x0) returned 0x3d
[0088.537] GetLastError () returned 0xb7
[0088.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x49
[0088.537] GetLastError () returned 0xb7
[0088.537] SetErrorMode (uMode=0x1) returned 0x0
[0088.538] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\qb61ws.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x296a2830, ftCreationTime.dwHighDateTime=0x1d3ae86, ftLastAccessTime.dwLowDateTime=0x5fe57f60, ftLastAccessTime.dwHighDateTime=0x1d3a975, ftLastWriteTime.dwLowDateTime=0x39d0780, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x2b40)) returned 1
[0088.538] GetLastError () returned 0xb7
[0088.538] SetErrorMode (uMode=0x0) returned 0x1
[0088.538] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\qb61ws.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\qb61ws.jpg.lanran2.0.5")) returned 1
[0088.538] GetLastError () returned 0xb7
[0088.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx", lpFilePart=0x0) returned 0x3f
[0088.538] GetLastError () returned 0xb7
[0088.538] SetErrorMode (uMode=0x1) returned 0x0
[0088.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\zksm86k.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.538] GetLastError () returned 0x0
[0088.539] GetFileType (hFile=0x21c) returned 0x1
[0088.539] GetFileType (hFile=0x21c) returned 0x1
[0088.539] ReadFile (in: hFile=0x21c, lpBuffer=0x26dcd08, nNumberOfBytesToRead=0x13ddc, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x26dcd08*, lpNumberOfBytesRead=0x39ebb8*=0x13ddc, lpOverlapped=0x0) returned 1
[0088.539] GetLastError () returned 0x0
[0088.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx", lpFilePart=0x0) returned 0x3f
[0088.569] GetLastError () returned 0x0
[0088.569] SetErrorMode (uMode=0x1) returned 0x0
[0088.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\zksm86k.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.570] GetLastError () returned 0xb7
[0088.570] GetFileType (hFile=0x21c) returned 0x1
[0088.570] SetErrorMode (uMode=0x0) returned 0x1
[0088.570] GetFileType (hFile=0x21c) returned 0x1
[0088.570] WriteFile (in: hFile=0x21c, lpBuffer=0x25b37cc*, nNumberOfBytesToWrite=0x13de0, lpNumberOfBytesWritten=0x39ebc4, lpOverlapped=0x0 | out: lpBuffer=0x25b37cc*, lpNumberOfBytesWritten=0x39ebc4*=0x13de0, lpOverlapped=0x0) returned 1
[0088.572] GetLastError () returned 0xb7
[0088.572] CloseHandle (hObject=0x21c) returned 1
[0088.573] GetLastError () returned 0xb7
[0088.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx", lpFilePart=0x0) returned 0x3f
[0088.573] GetLastError () returned 0xb7
[0088.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x4b
[0088.573] GetLastError () returned 0xb7
[0088.573] SetErrorMode (uMode=0x1) returned 0x0
[0088.573] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\zksm86k.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356ac920, ftCreationTime.dwHighDateTime=0x1d3acc2, ftLastAccessTime.dwLowDateTime=0x2b302490, ftLastAccessTime.dwHighDateTime=0x1d3a174, ftLastWriteTime.dwLowDateTime=0x3a1ca40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x13de0)) returned 1
[0088.573] GetLastError () returned 0xb7
[0088.573] SetErrorMode (uMode=0x0) returned 0x1
[0088.573] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\zksm86k.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\zksm86k.docx.lanran2.0.5")) returned 1
[0088.574] GetLastError () returned 0xb7
[0088.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC", lpFilePart=0x0) returned 0x37
[0088.574] GetLastError () returned 0xb7
[0088.574] SetErrorMode (uMode=0x1) returned 0x0
[0088.574] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0088.574] GetLastError () returned 0xb7
[0088.574] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.574] GetLastError () returned 0xb7
[0088.574] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.574] GetLastError () returned 0xb7
[0088.575] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.575] GetLastError () returned 0xb7
[0088.575] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.575] GetLastError () returned 0xb7
[0088.575] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0088.575] GetLastError () returned 0x12
[0088.575] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0088.575] SetErrorMode (uMode=0x0) returned 0x1
[0088.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC", lpFilePart=0x0) returned 0x37
[0088.575] GetLastError () returned 0x12
[0088.575] SetErrorMode (uMode=0x1) returned 0x0
[0088.576] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0088.576] GetLastError () returned 0x12
[0088.576] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.576] GetLastError () returned 0x12
[0088.576] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.576] GetLastError () returned 0x12
[0088.576] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.576] GetLastError () returned 0x12
[0088.576] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.576] GetLastError () returned 0x12
[0088.576] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0088.576] GetLastError () returned 0x12
[0088.577] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0088.577] SetErrorMode (uMode=0x0) returned 0x1
[0088.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3", lpFilePart=0x0) returned 0x48
[0088.577] GetLastError () returned 0x12
[0088.577] SetErrorMode (uMode=0x1) returned 0x0
[0088.577] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\b8eedu5rs9qt.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.577] GetLastError () returned 0x0
[0088.577] GetFileType (hFile=0x21c) returned 0x1
[0088.577] SetErrorMode (uMode=0x0) returned 0x1
[0088.577] GetFileType (hFile=0x21c) returned 0x1
[0088.577] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0x8df2
[0088.577] GetLastError () returned 0x0
[0088.577] ReadFile (in: hFile=0x21c, lpBuffer=0x25c91d0, nNumberOfBytesToRead=0x8df2, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25c91d0*, lpNumberOfBytesRead=0x39eb58*=0x8df2, lpOverlapped=0x0) returned 1
[0088.578] GetLastError () returned 0x0
[0088.578] CloseHandle (hObject=0x21c) returned 1
[0088.578] GetLastError () returned 0x0
[0088.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3", lpFilePart=0x0) returned 0x48
[0088.634] GetLastError () returned 0x0
[0088.634] SetErrorMode (uMode=0x1) returned 0x0
[0088.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\b8eedu5rs9qt.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.635] GetLastError () returned 0xb7
[0088.635] GetFileType (hFile=0x21c) returned 0x1
[0088.635] GetFileType (hFile=0x21c) returned 0x1
[0088.636] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3", lpFilePart=0x0) returned 0x48
[0088.636] GetLastError () returned 0xb7
[0088.636] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x54
[0088.636] GetLastError () returned 0xb7
[0088.636] SetErrorMode (uMode=0x1) returned 0x0
[0088.636] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\b8eedu5rs9qt.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec2c0150, ftCreationTime.dwHighDateTime=0x1d3ae2b, ftLastAccessTime.dwLowDateTime=0x408cad40, ftLastAccessTime.dwHighDateTime=0x1d3a7a5, ftLastWriteTime.dwLowDateTime=0x3ab4fc0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x8e00)) returned 1
[0088.636] GetLastError () returned 0xb7
[0088.636] SetErrorMode (uMode=0x0) returned 0x1
[0088.636] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\b8eedu5rs9qt.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\b8eedu5rs9qt.mp3.lanran2.0.5")) returned 1
[0088.637] GetLastError () returned 0xb7
[0088.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png", lpFilePart=0x0) returned 0x4e
[0088.637] GetLastError () returned 0xb7
[0088.637] SetErrorMode (uMode=0x1) returned 0x0
[0088.637] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\kufkge8e_3tsephazw.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.637] GetLastError () returned 0x0
[0088.637] GetFileType (hFile=0x21c) returned 0x1
[0088.638] GetFileType (hFile=0x21c) returned 0x1
[0088.638] ReadFile (in: hFile=0x21c, lpBuffer=0x2686888, nNumberOfBytesToRead=0x5f72, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x2686888*, lpNumberOfBytesRead=0x39eb58*=0x5f72, lpOverlapped=0x0) returned 1
[0088.638] GetLastError () returned 0x0
[0088.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png", lpFilePart=0x0) returned 0x4e
[0088.710] GetLastError () returned 0x0
[0088.710] SetErrorMode (uMode=0x1) returned 0x0
[0088.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\kufkge8e_3tsephazw.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.710] GetLastError () returned 0xb7
[0088.710] GetFileType (hFile=0x21c) returned 0x1
[0088.711] GetFileType (hFile=0x21c) returned 0x1
[0088.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png", lpFilePart=0x0) returned 0x4e
[0088.712] GetLastError () returned 0xb7
[0088.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png.LanRan2.0.5", lpFilePart=0x0) returned 0x5a
[0088.712] GetLastError () returned 0xb7
[0088.712] SetErrorMode (uMode=0x1) returned 0x0
[0088.712] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\kufkge8e_3tsephazw.png"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d520710, ftCreationTime.dwHighDateTime=0x1d3aaf9, ftLastAccessTime.dwLowDateTime=0x32b71ec0, ftLastAccessTime.dwHighDateTime=0x1d3ad5a, ftLastWriteTime.dwLowDateTime=0x3b736a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x5f80)) returned 1
[0088.712] GetLastError () returned 0xb7
[0088.712] SetErrorMode (uMode=0x0) returned 0x1
[0088.712] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\kufkge8e_3tsephazw.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\kufkge8e_3tsephazw.png.lanran2.0.5")) returned 1
[0088.712] GetLastError () returned 0xb7
[0088.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4", lpFilePart=0x0) returned 0x39
[0088.712] GetLastError () returned 0xb7
[0088.712] SetErrorMode (uMode=0x1) returned 0x0
[0088.713] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c530
[0088.713] GetLastError () returned 0xb7
[0088.713] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.713] GetLastError () returned 0xb7
[0088.713] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.713] GetLastError () returned 0xb7
[0088.713] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.713] GetLastError () returned 0xb7
[0088.713] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.713] GetLastError () returned 0xb7
[0088.713] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.713] GetLastError () returned 0xb7
[0088.713] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.713] GetLastError () returned 0xb7
[0088.713] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0088.713] GetLastError () returned 0x12
[0088.713] FindClose (in: hFindFile=0x42c530 | out: hFindFile=0x42c530) returned 1
[0088.713] SetErrorMode (uMode=0x0) returned 0x1
[0088.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4", lpFilePart=0x0) returned 0x39
[0088.713] GetLastError () returned 0x12
[0088.713] SetErrorMode (uMode=0x1) returned 0x0
[0088.713] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c530
[0088.713] GetLastError () returned 0x12
[0088.714] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.714] GetLastError () returned 0x12
[0088.714] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.714] GetLastError () returned 0x12
[0088.714] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.714] GetLastError () returned 0x12
[0088.714] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.714] GetLastError () returned 0x12
[0088.714] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.714] GetLastError () returned 0x12
[0088.714] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.714] GetLastError () returned 0x12
[0088.714] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0088.714] GetLastError () returned 0x12
[0088.714] FindClose (in: hFindFile=0x42c530 | out: hFindFile=0x42c530) returned 1
[0088.714] SetErrorMode (uMode=0x0) returned 0x1
[0088.714] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx", lpFilePart=0x0) returned 0x46
[0088.714] GetLastError () returned 0x12
[0088.714] SetErrorMode (uMode=0x1) returned 0x0
[0088.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\dxxywug.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.714] GetLastError () returned 0x0
[0088.714] GetFileType (hFile=0x21c) returned 0x1
[0088.714] GetFileType (hFile=0x21c) returned 0x1
[0088.715] ReadFile (in: hFile=0x21c, lpBuffer=0x24ef5bc, nNumberOfBytesToRead=0x10bdd, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x24ef5bc*, lpNumberOfBytesRead=0x39ebb8*=0x10bdd, lpOverlapped=0x0) returned 1
[0088.715] GetLastError () returned 0x0
[0088.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx", lpFilePart=0x0) returned 0x46
[0088.741] GetLastError () returned 0x0
[0088.741] SetErrorMode (uMode=0x1) returned 0x0
[0088.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\dxxywug.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.743] GetLastError () returned 0xb7
[0088.743] GetFileType (hFile=0x21c) returned 0x1
[0088.743] SetErrorMode (uMode=0x0) returned 0x1
[0088.743] GetFileType (hFile=0x21c) returned 0x1
[0088.743] WriteFile (in: hFile=0x21c, lpBuffer=0x25a930c*, nNumberOfBytesToWrite=0x10be0, lpNumberOfBytesWritten=0x39ebc4, lpOverlapped=0x0 | out: lpBuffer=0x25a930c*, lpNumberOfBytesWritten=0x39ebc4*=0x10be0, lpOverlapped=0x0) returned 1
[0088.744] GetLastError () returned 0xb7
[0088.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx", lpFilePart=0x0) returned 0x46
[0088.744] GetLastError () returned 0xb7
[0088.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x52
[0088.744] GetLastError () returned 0xb7
[0088.744] SetErrorMode (uMode=0x1) returned 0x0
[0088.744] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\dxxywug.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c05060, ftCreationTime.dwHighDateTime=0x1d3affd, ftLastAccessTime.dwLowDateTime=0x2e2aa210, ftLastAccessTime.dwHighDateTime=0x1d3a3f4, ftLastWriteTime.dwLowDateTime=0x3bbf960, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x10be0)) returned 1
[0088.744] GetLastError () returned 0xb7
[0088.744] SetErrorMode (uMode=0x0) returned 0x1
[0088.744] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\dxxywug.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\dxxywug.pptx.lanran2.0.5")) returned 1
[0088.746] GetLastError () returned 0xb7
[0088.746] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi", lpFilePart=0x0) returned 0x47
[0088.746] GetLastError () returned 0xb7
[0088.746] SetErrorMode (uMode=0x1) returned 0x0
[0088.746] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\ovjda2whk.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.746] GetLastError () returned 0x0
[0088.747] GetFileType (hFile=0x21c) returned 0x1
[0088.747] SetErrorMode (uMode=0x0) returned 0x1
[0088.747] GetFileType (hFile=0x21c) returned 0x1
[0088.747] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x39ec10 | out: lpFileSizeHigh=0x39ec10*=0x0) returned 0x9d54
[0088.747] GetLastError () returned 0x0
[0088.747] ReadFile (in: hFile=0x21c, lpBuffer=0x25ba7cc, nNumberOfBytesToRead=0x9d54, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x25ba7cc*, lpNumberOfBytesRead=0x39ebb8*=0x9d54, lpOverlapped=0x0) returned 1
[0088.747] GetLastError () returned 0x0
[0088.748] CloseHandle (hObject=0x21c) returned 1
[0088.748] GetLastError () returned 0x0
[0088.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi", lpFilePart=0x0) returned 0x47
[0088.826] GetLastError () returned 0x0
[0088.827] SetErrorMode (uMode=0x1) returned 0x0
[0088.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\ovjda2whk.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.827] GetLastError () returned 0xb7
[0088.827] GetFileType (hFile=0x21c) returned 0x1
[0088.827] GetFileType (hFile=0x21c) returned 0x1
[0088.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi", lpFilePart=0x0) returned 0x47
[0088.828] GetLastError () returned 0xb7
[0088.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi.LanRan2.0.5", lpFilePart=0x0) returned 0x53
[0088.828] GetLastError () returned 0xb7
[0088.828] SetErrorMode (uMode=0x1) returned 0x0
[0088.828] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\ovjda2whk.avi"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a300b90, ftCreationTime.dwHighDateTime=0x1d3a607, ftLastAccessTime.dwLowDateTime=0x718021c0, ftLastAccessTime.dwHighDateTime=0x1d3abfb, ftLastWriteTime.dwLowDateTime=0x3c7e040, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x9d60)) returned 1
[0088.828] GetLastError () returned 0xb7
[0088.828] SetErrorMode (uMode=0x0) returned 0x1
[0088.829] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\ovjda2whk.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\ovjda2whk.avi.lanran2.0.5")) returned 1
[0088.829] GetLastError () returned 0xb7
[0088.830] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg", lpFilePart=0x0) returned 0x48
[0088.830] GetLastError () returned 0xb7
[0088.830] SetErrorMode (uMode=0x1) returned 0x0
[0088.830] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c330
[0088.830] GetLastError () returned 0xb7
[0088.830] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.830] GetLastError () returned 0xb7
[0088.830] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.830] GetLastError () returned 0xb7
[0088.830] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.830] GetLastError () returned 0xb7
[0088.830] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0088.831] GetLastError () returned 0x12
[0088.831] FindClose (in: hFindFile=0x42c330 | out: hFindFile=0x42c330) returned 1
[0088.831] SetErrorMode (uMode=0x0) returned 0x1
[0088.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg", lpFilePart=0x0) returned 0x48
[0088.831] GetLastError () returned 0x12
[0088.831] SetErrorMode (uMode=0x1) returned 0x0
[0088.831] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c330
[0088.831] GetLastError () returned 0x12
[0088.831] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.831] GetLastError () returned 0x12
[0088.831] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.831] GetLastError () returned 0x12
[0088.831] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.831] GetLastError () returned 0x12
[0088.831] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0088.831] GetLastError () returned 0x12
[0088.831] FindClose (in: hFindFile=0x42c330 | out: hFindFile=0x42c330) returned 1
[0088.831] SetErrorMode (uMode=0x0) returned 0x1
[0088.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx", lpFilePart=0x0) returned 0x5e
[0088.831] GetLastError () returned 0x12
[0088.831] SetErrorMode (uMode=0x1) returned 0x0
[0088.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\pbcsaw8barzkhg\\r4x-n5oyi mg288u.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.832] GetLastError () returned 0x0
[0088.832] GetFileType (hFile=0x21c) returned 0x1
[0088.832] GetFileType (hFile=0x21c) returned 0x1
[0088.832] ReadFile (in: hFile=0x21c, lpBuffer=0x267ebcc, nNumberOfBytesToRead=0x5464, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x267ebcc*, lpNumberOfBytesRead=0x39eb58*=0x5464, lpOverlapped=0x0) returned 1
[0088.832] GetLastError () returned 0x0
[0088.832] CloseHandle (hObject=0x21c) returned 1
[0088.832] GetLastError () returned 0x0
[0088.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx", lpFilePart=0x0) returned 0x5e
[0088.891] GetLastError () returned 0x0
[0088.891] SetErrorMode (uMode=0x1) returned 0x0
[0088.891] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\pbcsaw8barzkhg\\r4x-n5oyi mg288u.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.892] GetLastError () returned 0xb7
[0088.892] GetFileType (hFile=0x21c) returned 0x1
[0088.892] GetFileType (hFile=0x21c) returned 0x1
[0088.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx", lpFilePart=0x0) returned 0x5e
[0088.893] GetLastError () returned 0xb7
[0088.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx.LanRan2.0.5", lpFilePart=0x0) returned 0x6a
[0088.893] GetLastError () returned 0xb7
[0088.893] SetErrorMode (uMode=0x1) returned 0x0
[0088.893] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\pbcsaw8barzkhg\\r4x-n5oyi mg288u.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c6b2e40, ftCreationTime.dwHighDateTime=0x1d3a51f, ftLastAccessTime.dwLowDateTime=0xea723910, ftLastAccessTime.dwHighDateTime=0x1d3a156, ftLastWriteTime.dwLowDateTime=0x3d165c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x5470)) returned 1
[0088.893] GetLastError () returned 0xb7
[0088.893] SetErrorMode (uMode=0x0) returned 0x1
[0088.893] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\pbcsaw8barzkhg\\r4x-n5oyi mg288u.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\pbcsaw8barzkhg\\r4x-n5oyi mg288u.xlsx.lanran2.0.5")) returned 1
[0088.893] GetLastError () returned 0xb7
[0088.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z", lpFilePart=0x0) returned 0x42
[0088.894] GetLastError () returned 0xb7
[0088.894] SetErrorMode (uMode=0x1) returned 0x0
[0088.894] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0
[0088.894] GetLastError () returned 0xb7
[0088.894] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.894] GetLastError () returned 0xb7
[0088.894] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.894] GetLastError () returned 0xb7
[0088.894] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.894] GetLastError () returned 0xb7
[0088.894] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.894] GetLastError () returned 0xb7
[0088.895] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.895] GetLastError () returned 0xb7
[0088.895] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.895] GetLastError () returned 0xb7
[0088.895] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.895] GetLastError () returned 0xb7
[0088.895] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.895] GetLastError () returned 0xb7
[0088.895] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0088.895] GetLastError () returned 0x12
[0088.896] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1
[0088.896] SetErrorMode (uMode=0x0) returned 0x1
[0088.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z", lpFilePart=0x0) returned 0x42
[0088.896] GetLastError () returned 0x12
[0088.896] SetErrorMode (uMode=0x1) returned 0x0
[0088.896] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0
[0088.896] GetLastError () returned 0x12
[0088.896] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.896] GetLastError () returned 0x12
[0088.896] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.896] GetLastError () returned 0x12
[0088.897] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.897] GetLastError () returned 0x12
[0088.897] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.897] GetLastError () returned 0x12
[0088.897] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.897] GetLastError () returned 0x12
[0088.897] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.897] GetLastError () returned 0x12
[0088.897] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.897] GetLastError () returned 0x12
[0088.897] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.897] GetLastError () returned 0x12
[0088.898] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0088.898] GetLastError () returned 0x12
[0088.898] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1
[0088.898] SetErrorMode (uMode=0x0) returned 0x1
[0088.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3", lpFilePart=0x0) returned 0x5b
[0088.898] GetLastError () returned 0x12
[0088.898] SetErrorMode (uMode=0x1) returned 0x0
[0088.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\hn 1fhec4peyiskdkwck.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.898] GetLastError () returned 0x0
[0088.898] GetFileType (hFile=0x21c) returned 0x1
[0088.898] SetErrorMode (uMode=0x0) returned 0x1
[0088.898] GetFileType (hFile=0x21c) returned 0x1
[0088.898] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0x2dce
[0088.898] GetLastError () returned 0x0
[0088.898] ReadFile (in: hFile=0x21c, lpBuffer=0x2539e90, nNumberOfBytesToRead=0x2dce, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x2539e90*, lpNumberOfBytesRead=0x39eb58*=0x2dce, lpOverlapped=0x0) returned 1
[0088.899] GetLastError () returned 0x0
[0088.899] CloseHandle (hObject=0x21c) returned 1
[0088.899] GetLastError () returned 0x0
[0088.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3", lpFilePart=0x0) returned 0x5b
[0088.953] GetLastError () returned 0x0
[0088.953] SetErrorMode (uMode=0x1) returned 0x0
[0088.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\hn 1fhec4peyiskdkwck.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.954] GetLastError () returned 0xb7
[0088.954] GetFileType (hFile=0x21c) returned 0x1
[0088.954] GetFileType (hFile=0x21c) returned 0x1
[0088.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3", lpFilePart=0x0) returned 0x5b
[0088.955] GetLastError () returned 0xb7
[0088.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x67
[0088.955] GetLastError () returned 0xb7
[0088.955] SetErrorMode (uMode=0x1) returned 0x0
[0088.955] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\hn 1fhec4peyiskdkwck.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f44ccf0, ftCreationTime.dwHighDateTime=0x1d3a594, ftLastAccessTime.dwLowDateTime=0x24d3dff0, ftLastAccessTime.dwHighDateTime=0x1d3a28d, ftLastWriteTime.dwLowDateTime=0x3daeb40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x2dd0)) returned 1
[0088.955] GetLastError () returned 0xb7
[0088.955] SetErrorMode (uMode=0x0) returned 0x1
[0088.955] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\hn 1fhec4peyiskdkwck.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\hn 1fhec4peyiskdkwck.mp3.lanran2.0.5")) returned 1
[0088.956] GetLastError () returned 0xb7
[0088.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt", lpFilePart=0x0) returned 0x50
[0088.956] GetLastError () returned 0xb7
[0088.956] SetErrorMode (uMode=0x1) returned 0x0
[0088.956] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\yxeuthdak.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.956] GetLastError () returned 0x0
[0088.956] GetFileType (hFile=0x21c) returned 0x1
[0088.956] GetFileType (hFile=0x21c) returned 0x1
[0088.956] ReadFile (in: hFile=0x21c, lpBuffer=0x25d34f0, nNumberOfBytesToRead=0xb021, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25d34f0*, lpNumberOfBytesRead=0x39eb58*=0xb021, lpOverlapped=0x0) returned 1
[0088.957] GetLastError () returned 0x0
[0088.982] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt", lpFilePart=0x0) returned 0x50
[0088.982] GetLastError () returned 0x0
[0088.982] SetErrorMode (uMode=0x1) returned 0x0
[0088.982] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\yxeuthdak.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c
[0088.983] GetLastError () returned 0xb7
[0088.983] GetFileType (hFile=0x21c) returned 0x1
[0088.983] GetFileType (hFile=0x21c) returned 0x1
[0088.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt", lpFilePart=0x0) returned 0x50
[0088.984] GetLastError () returned 0xb7
[0088.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt.LanRan2.0.5", lpFilePart=0x0) returned 0x5c
[0088.984] GetLastError () returned 0xb7
[0088.984] SetErrorMode (uMode=0x1) returned 0x0
[0088.984] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\yxeuthdak.ppt"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x883301e0, ftCreationTime.dwHighDateTime=0x1d3a466, ftLastAccessTime.dwLowDateTime=0x48272060, ftLastAccessTime.dwHighDateTime=0x1d3a8bf, ftLastWriteTime.dwLowDateTime=0x3dfae00, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xb030)) returned 1
[0088.985] GetLastError () returned 0xb7
[0088.985] SetErrorMode (uMode=0x0) returned 0x1
[0088.985] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\yxeuthdak.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\yxeuthdak.ppt.lanran2.0.5")) returned 1
[0088.985] GetLastError () returned 0xb7
[0088.985] SHGetFolderPathW (in: hwnd=0x0, csidl=13, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned 0x0
[0088.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", lpFilePart=0x0) returned 0x23
[0088.986] GetLastError () returned 0x3f0
[0088.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpFilePart=0x0) returned 0x24
[0088.986] GetLastError () returned 0x3f0
[0088.986] SetErrorMode (uMode=0x1) returned 0x0
[0088.986] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0088.987] GetLastError () returned 0x3f0
[0088.987] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.987] GetLastError () returned 0x3f0
[0088.987] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.987] GetLastError () returned 0x3f0
[0088.987] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.987] GetLastError () returned 0x3f0
[0088.987] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.987] GetLastError () returned 0x3f0
[0088.987] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.987] GetLastError () returned 0x3f0
[0088.987] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.987] GetLastError () returned 0x3f0
[0088.987] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.987] GetLastError () returned 0x3f0
[0088.987] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0088.987] GetLastError () returned 0x12
[0088.987] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0088.987] SetErrorMode (uMode=0x0) returned 0x1
[0088.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpFilePart=0x0) returned 0x24
[0088.987] GetLastError () returned 0x12
[0088.987] SetErrorMode (uMode=0x1) returned 0x0
[0088.987] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0088.988] GetLastError () returned 0x12
[0088.988] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.988] GetLastError () returned 0x12
[0088.988] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.988] GetLastError () returned 0x12
[0088.988] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.988] GetLastError () returned 0x12
[0088.988] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.988] GetLastError () returned 0x12
[0088.988] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.988] GetLastError () returned 0x12
[0088.989] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.989] GetLastError () returned 0x12
[0088.989] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0088.989] GetLastError () returned 0x12
[0088.989] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0088.989] GetLastError () returned 0x12
[0088.989] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0088.989] SetErrorMode (uMode=0x0) returned 0x1
[0088.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3", lpFilePart=0x0) returned 0x34
[0088.990] GetLastError () returned 0x12
[0088.990] SetErrorMode (uMode=0x1) returned 0x0
[0088.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ekvtedi3hgit.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0088.990] GetLastError () returned 0x0
[0088.990] GetFileType (hFile=0x220) returned 0x1
[0088.990] SetErrorMode (uMode=0x0) returned 0x1
[0088.990] GetFileType (hFile=0x220) returned 0x1
[0088.990] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0x6c1a
[0088.990] GetLastError () returned 0x0
[0088.990] ReadFile (in: hFile=0x220, lpBuffer=0x2688ee4, nNumberOfBytesToRead=0x6c1a, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2688ee4*, lpNumberOfBytesRead=0x39ec18*=0x6c1a, lpOverlapped=0x0) returned 1
[0088.991] GetLastError () returned 0x0
[0088.991] CloseHandle (hObject=0x220) returned 1
[0088.991] GetLastError () returned 0x0
[0089.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3", lpFilePart=0x0) returned 0x34
[0089.048] GetLastError () returned 0x0
[0089.048] SetErrorMode (uMode=0x1) returned 0x0
[0089.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ekvtedi3hgit.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.049] GetLastError () returned 0xb7
[0089.049] GetFileType (hFile=0x220) returned 0x1
[0089.049] GetFileType (hFile=0x220) returned 0x1
[0089.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3", lpFilePart=0x0) returned 0x34
[0089.050] GetLastError () returned 0xb7
[0089.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x40
[0089.050] GetLastError () returned 0xb7
[0089.050] SetErrorMode (uMode=0x1) returned 0x0
[0089.050] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ekvtedi3hgit.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d250240, ftCreationTime.dwHighDateTime=0x1d3af9c, ftLastAccessTime.dwLowDateTime=0xdd83b600, ftLastAccessTime.dwHighDateTime=0x1d3ab7b, ftLastWriteTime.dwLowDateTime=0x3e93380, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x6c20)) returned 1
[0089.050] GetLastError () returned 0xb7
[0089.050] SetErrorMode (uMode=0x0) returned 0x1
[0089.050] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ekvtedi3hgit.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ekvtedi3hgit.mp3.lanran2.0.5")) returned 1
[0089.051] GetLastError () returned 0xb7
[0089.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-", lpFilePart=0x0) returned 0x34
[0089.051] GetLastError () returned 0xb7
[0089.051] SetErrorMode (uMode=0x1) returned 0x0
[0089.051] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0
[0089.051] GetLastError () returned 0xb7
[0089.051] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.051] GetLastError () returned 0xb7
[0089.051] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.051] GetLastError () returned 0xb7
[0089.051] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.051] GetLastError () returned 0xb7
[0089.052] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.052] GetLastError () returned 0xb7
[0089.052] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.052] GetLastError () returned 0xb7
[0089.052] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.052] GetLastError () returned 0xb7
[0089.052] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.052] GetLastError () returned 0x12
[0089.052] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1
[0089.052] SetErrorMode (uMode=0x0) returned 0x1
[0089.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-", lpFilePart=0x0) returned 0x34
[0089.052] GetLastError () returned 0x12
[0089.052] SetErrorMode (uMode=0x1) returned 0x0
[0089.053] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0
[0089.053] GetLastError () returned 0x12
[0089.053] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.053] GetLastError () returned 0x12
[0089.053] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.053] GetLastError () returned 0x12
[0089.053] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.053] GetLastError () returned 0x12
[0089.053] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.053] GetLastError () returned 0x12
[0089.054] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.054] GetLastError () returned 0x12
[0089.054] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.054] GetLastError () returned 0x12
[0089.054] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.054] GetLastError () returned 0x12
[0089.054] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1
[0089.054] SetErrorMode (uMode=0x0) returned 0x1
[0089.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3", lpFilePart=0x0) returned 0x4b
[0089.054] GetLastError () returned 0x12
[0089.054] SetErrorMode (uMode=0x1) returned 0x0
[0089.054] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\pellq xvtj8zfkuwee.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.054] GetLastError () returned 0x0
[0089.054] GetFileType (hFile=0x220) returned 0x1
[0089.054] SetErrorMode (uMode=0x0) returned 0x1
[0089.054] GetFileType (hFile=0x220) returned 0x1
[0089.055] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x39ec10 | out: lpFileSizeHigh=0x39ec10*=0x0) returned 0x174c3
[0089.055] GetLastError () returned 0x0
[0089.055] ReadFile (in: hFile=0x220, lpBuffer=0x34ce600, nNumberOfBytesToRead=0x174c3, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x34ce600*, lpNumberOfBytesRead=0x39ebb8*=0x174c3, lpOverlapped=0x0) returned 1
[0089.056] GetLastError () returned 0x0
[0089.057] CloseHandle (hObject=0x220) returned 1
[0089.057] GetLastError () returned 0x0
[0089.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3", lpFilePart=0x0) returned 0x4b
[0089.117] GetLastError () returned 0x0
[0089.117] SetErrorMode (uMode=0x1) returned 0x0
[0089.117] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\pellq xvtj8zfkuwee.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.118] GetLastError () returned 0xb7
[0089.118] GetFileType (hFile=0x220) returned 0x1
[0089.118] GetFileType (hFile=0x220) returned 0x1
[0089.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3", lpFilePart=0x0) returned 0x4b
[0089.119] GetLastError () returned 0xb7
[0089.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x57
[0089.120] GetLastError () returned 0xb7
[0089.120] SetErrorMode (uMode=0x1) returned 0x0
[0089.120] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\pellq xvtj8zfkuwee.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc13620, ftCreationTime.dwHighDateTime=0x1d3ae2d, ftLastAccessTime.dwLowDateTime=0xae150d60, ftLastAccessTime.dwHighDateTime=0x1d3a941, ftLastWriteTime.dwLowDateTime=0x3f51a60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x174d0)) returned 1
[0089.120] GetLastError () returned 0xb7
[0089.120] SetErrorMode (uMode=0x0) returned 0x1
[0089.120] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\pellq xvtj8zfkuwee.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\pellq xvtj8zfkuwee.mp3.lanran2.0.5")) returned 1
[0089.120] GetLastError () returned 0xb7
[0089.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_", lpFilePart=0x0) returned 0x42
[0089.120] GetLastError () returned 0xb7
[0089.120] SetErrorMode (uMode=0x1) returned 0x0
[0089.120] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c530
[0089.121] GetLastError () returned 0xb7
[0089.121] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.121] GetLastError () returned 0xb7
[0089.121] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.121] GetLastError () returned 0xb7
[0089.121] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.121] GetLastError () returned 0xb7
[0089.121] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.121] GetLastError () returned 0xb7
[0089.121] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.121] GetLastError () returned 0xb7
[0089.121] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.121] GetLastError () returned 0x12
[0089.121] FindClose (in: hFindFile=0x42c530 | out: hFindFile=0x42c530) returned 1
[0089.121] SetErrorMode (uMode=0x0) returned 0x1
[0089.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_", lpFilePart=0x0) returned 0x42
[0089.121] GetLastError () returned 0x12
[0089.121] SetErrorMode (uMode=0x1) returned 0x0
[0089.121] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c530
[0089.121] GetLastError () returned 0x12
[0089.121] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.121] GetLastError () returned 0x12
[0089.121] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.122] GetLastError () returned 0x12
[0089.122] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.122] GetLastError () returned 0x12
[0089.122] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.122] GetLastError () returned 0x12
[0089.122] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.122] GetLastError () returned 0x12
[0089.122] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.122] GetLastError () returned 0x12
[0089.122] FindClose (in: hFindFile=0x42c530 | out: hFindFile=0x42c530) returned 1
[0089.122] SetErrorMode (uMode=0x0) returned 0x1
[0089.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\pwgwLVNPL9 Eq9mDqm", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\pwgwLVNPL9 Eq9mDqm", lpFilePart=0x0) returned 0x55
[0089.122] GetLastError () returned 0x12
[0089.122] SetErrorMode (uMode=0x1) returned 0x0
[0089.122] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\pwgwLVNPL9 Eq9mDqm\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c530
[0089.122] GetLastError () returned 0x12
[0089.122] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.122] GetLastError () returned 0x12
[0089.122] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.122] GetLastError () returned 0x12
[0089.122] FindClose (in: hFindFile=0x42c530 | out: hFindFile=0x42c530) returned 1
[0089.123] SetErrorMode (uMode=0x0) returned 0x1
[0089.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\pwgwLVNPL9 Eq9mDqm", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\pwgwLVNPL9 Eq9mDqm", lpFilePart=0x0) returned 0x55
[0089.123] GetLastError () returned 0x12
[0089.123] SetErrorMode (uMode=0x1) returned 0x0
[0089.123] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\pwgwLVNPL9 Eq9mDqm\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c530
[0089.123] GetLastError () returned 0x12
[0089.123] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.123] GetLastError () returned 0x12
[0089.123] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.123] GetLastError () returned 0x12
[0089.123] FindClose (in: hFindFile=0x42c530 | out: hFindFile=0x42c530) returned 1
[0089.123] SetErrorMode (uMode=0x0) returned 0x1
[0089.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF", lpFilePart=0x0) returned 0x51
[0089.123] GetLastError () returned 0x12
[0089.123] SetErrorMode (uMode=0x1) returned 0x0
[0089.123] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c530
[0089.123] GetLastError () returned 0x12
[0089.123] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.123] GetLastError () returned 0x12
[0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.124] GetLastError () returned 0x12
[0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.124] GetLastError () returned 0x12
[0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.124] GetLastError () returned 0x12
[0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.124] GetLastError () returned 0x12
[0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.124] GetLastError () returned 0x12
[0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.124] GetLastError () returned 0x12
[0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.124] GetLastError () returned 0x12
[0089.124] FindClose (in: hFindFile=0x42c530 | out: hFindFile=0x42c530) returned 1
[0089.124] SetErrorMode (uMode=0x0) returned 0x1
[0089.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF", lpFilePart=0x0) returned 0x51
[0089.124] GetLastError () returned 0x12
[0089.124] SetErrorMode (uMode=0x1) returned 0x0
[0089.124] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c530
[0089.124] GetLastError () returned 0x12
[0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.124] GetLastError () returned 0x12
[0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.124] GetLastError () returned 0x12
[0089.125] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.125] GetLastError () returned 0x12
[0089.125] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.125] GetLastError () returned 0x12
[0089.125] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.125] GetLastError () returned 0x12
[0089.125] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.125] GetLastError () returned 0x12
[0089.125] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.125] GetLastError () returned 0x12
[0089.125] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.125] GetLastError () returned 0x12
[0089.125] FindClose (in: hFindFile=0x42c530 | out: hFindFile=0x42c530) returned 1
[0089.125] SetErrorMode (uMode=0x0) returned 0x1
[0089.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3", lpFilePart=0x0) returned 0x66
[0089.125] GetLastError () returned 0x12
[0089.125] SetErrorMode (uMode=0x1) returned 0x0
[0089.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\gncucpscfxtvc9ad.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.125] GetLastError () returned 0x0
[0089.125] GetFileType (hFile=0x220) returned 0x1
[0089.125] GetFileType (hFile=0x220) returned 0x1
[0089.125] ReadFile (in: hFile=0x220, lpBuffer=0x25d9264, nNumberOfBytesToRead=0xc410, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x25d9264*, lpNumberOfBytesRead=0x39eaf8*=0xc410, lpOverlapped=0x0) returned 1
[0089.126] GetLastError () returned 0x0
[0089.126] CloseHandle (hObject=0x220) returned 1
[0089.126] GetLastError () returned 0x0
[0089.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3", lpFilePart=0x0) returned 0x66
[0089.188] GetLastError () returned 0x0
[0089.188] SetErrorMode (uMode=0x1) returned 0x0
[0089.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\gncucpscfxtvc9ad.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.189] GetLastError () returned 0xb7
[0089.189] GetFileType (hFile=0x220) returned 0x1
[0089.190] GetFileType (hFile=0x220) returned 0x1
[0089.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3", lpFilePart=0x0) returned 0x66
[0089.193] GetLastError () returned 0xb7
[0089.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x72
[0089.193] GetLastError () returned 0xb7
[0089.193] SetErrorMode (uMode=0x1) returned 0x0
[0089.193] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\gncucpscfxtvc9ad.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x591c3030, ftCreationTime.dwHighDateTime=0x1d3a861, ftLastAccessTime.dwLowDateTime=0xd4024060, ftLastAccessTime.dwHighDateTime=0x1d3aeb4, ftLastWriteTime.dwLowDateTime=0x3fe9fe0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xc420)) returned 1
[0089.193] GetLastError () returned 0xb7
[0089.193] SetErrorMode (uMode=0x0) returned 0x1
[0089.193] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\gncucpscfxtvc9ad.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\gncucpscfxtvc9ad.mp3.lanran2.0.5")) returned 1
[0089.193] GetLastError () returned 0xb7
[0089.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3", lpFilePart=0x0) returned 0x5a
[0089.193] GetLastError () returned 0xb7
[0089.194] SetErrorMode (uMode=0x1) returned 0x0
[0089.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\l op.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.194] GetLastError () returned 0x0
[0089.194] GetFileType (hFile=0x220) returned 0x1
[0089.194] GetFileType (hFile=0x220) returned 0x1
[0089.194] ReadFile (in: hFile=0x220, lpBuffer=0x3572b70, nNumberOfBytesToRead=0x18705, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x3572b70*, lpNumberOfBytesRead=0x39eaf8*=0x18705, lpOverlapped=0x0) returned 1
[0089.196] GetLastError () returned 0x0
[0089.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3", lpFilePart=0x0) returned 0x5a
[0089.228] GetLastError () returned 0x0
[0089.228] SetErrorMode (uMode=0x1) returned 0x0
[0089.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\l op.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.229] GetLastError () returned 0xb7
[0089.229] GetFileType (hFile=0x220) returned 0x1
[0089.229] GetFileType (hFile=0x220) returned 0x1
[0089.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3", lpFilePart=0x0) returned 0x5a
[0089.231] GetLastError () returned 0xb7
[0089.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x66
[0089.231] GetLastError () returned 0xb7
[0089.231] SetErrorMode (uMode=0x1) returned 0x0
[0089.231] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\l op.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c264f0, ftCreationTime.dwHighDateTime=0x1d3a5ac, ftLastAccessTime.dwLowDateTime=0x88c2a540, ftLastAccessTime.dwHighDateTime=0x1d3ae0a, ftLastWriteTime.dwLowDateTime=0x405c400, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x18710)) returned 1
[0089.231] GetLastError () returned 0xb7
[0089.231] SetErrorMode (uMode=0x0) returned 0x1
[0089.231] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\l op.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\l op.mp3.lanran2.0.5")) returned 1
[0089.232] GetLastError () returned 0xb7
[0089.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_", lpFilePart=0x0) returned 0x59
[0089.232] GetLastError () returned 0xb7
[0089.232] SetErrorMode (uMode=0x1) returned 0x0
[0089.232] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0
[0089.232] GetLastError () returned 0xb7
[0089.232] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.232] GetLastError () returned 0xb7
[0089.232] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.232] GetLastError () returned 0xb7
[0089.232] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.232] GetLastError () returned 0xb7
[0089.232] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.232] GetLastError () returned 0xb7
[0089.232] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.232] GetLastError () returned 0x12
[0089.232] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1
[0089.232] SetErrorMode (uMode=0x0) returned 0x1
[0089.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_", lpFilePart=0x0) returned 0x59
[0089.233] GetLastError () returned 0x12
[0089.233] SetErrorMode (uMode=0x1) returned 0x0
[0089.233] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0
[0089.233] GetLastError () returned 0x12
[0089.233] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.233] GetLastError () returned 0x12
[0089.233] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.233] GetLastError () returned 0x12
[0089.233] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.233] GetLastError () returned 0x12
[0089.233] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.233] GetLastError () returned 0x12
[0089.233] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.233] GetLastError () returned 0x12
[0089.233] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1
[0089.233] SetErrorMode (uMode=0x0) returned 0x1
[0089.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3", lpFilePart=0x0) returned 0x70
[0089.233] GetLastError () returned 0x12
[0089.233] SetErrorMode (uMode=0x1) returned 0x0
[0089.233] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\uxgiqg_18rni5nq9lf.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.233] GetLastError () returned 0x0
[0089.234] GetFileType (hFile=0x220) returned 0x1
[0089.234] GetFileType (hFile=0x220) returned 0x1
[0089.234] ReadFile (in: hFile=0x220, lpBuffer=0x252a66c, nNumberOfBytesToRead=0x12eb0, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x252a66c*, lpNumberOfBytesRead=0x39ea98*=0x12eb0, lpOverlapped=0x0) returned 1
[0089.234] GetLastError () returned 0x0
[0089.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3", lpFilePart=0x0) returned 0x70
[0089.261] GetLastError () returned 0x0
[0089.261] SetErrorMode (uMode=0x1) returned 0x0
[0089.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\uxgiqg_18rni5nq9lf.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.262] GetLastError () returned 0xb7
[0089.262] GetFileType (hFile=0x220) returned 0x1
[0089.262] GetFileType (hFile=0x220) returned 0x1
[0089.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3", lpFilePart=0x0) returned 0x70
[0089.264] GetLastError () returned 0xb7
[0089.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x7c
[0089.264] GetLastError () returned 0xb7
[0089.264] SetErrorMode (uMode=0x1) returned 0x0
[0089.264] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\uxgiqg_18rni5nq9lf.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e570c0, ftCreationTime.dwHighDateTime=0x1d3a872, ftLastAccessTime.dwLowDateTime=0xa603f600, ftLastAccessTime.dwHighDateTime=0x1d3a53a, ftLastWriteTime.dwLowDateTime=0x40a86c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x12ec0)) returned 1
[0089.264] GetLastError () returned 0xb7
[0089.264] SetErrorMode (uMode=0x0) returned 0x1
[0089.264] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\uxgiqg_18rni5nq9lf.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\uxgiqg_18rni5nq9lf.mp3.lanran2.0.5")) returned 1
[0089.264] GetLastError () returned 0xb7
[0089.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3", lpFilePart=0x0) returned 0x6e
[0089.265] GetLastError () returned 0xb7
[0089.265] SetErrorMode (uMode=0x1) returned 0x0
[0089.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\ytctsumrwh1cpryn.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.265] GetLastError () returned 0x0
[0089.265] GetFileType (hFile=0x220) returned 0x1
[0089.265] GetFileType (hFile=0x220) returned 0x1
[0089.265] ReadFile (in: hFile=0x220, lpBuffer=0x25fe5bc, nNumberOfBytesToRead=0x676e, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x25fe5bc*, lpNumberOfBytesRead=0x39ea98*=0x676e, lpOverlapped=0x0) returned 1
[0089.266] GetLastError () returned 0x0
[0089.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3", lpFilePart=0x0) returned 0x6e
[0089.479] GetLastError () returned 0x0
[0089.479] SetErrorMode (uMode=0x1) returned 0x0
[0089.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\ytctsumrwh1cpryn.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.480] GetLastError () returned 0xb7
[0089.480] GetFileType (hFile=0x220) returned 0x1
[0089.480] GetFileType (hFile=0x220) returned 0x1
[0089.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3", lpFilePart=0x0) returned 0x6e
[0089.481] GetLastError () returned 0xb7
[0089.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x7a
[0089.481] GetLastError () returned 0xb7
[0089.481] SetErrorMode (uMode=0x1) returned 0x0
[0089.481] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\ytctsumrwh1cpryn.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce7f210, ftCreationTime.dwHighDateTime=0x1d3ae16, ftLastAccessTime.dwLowDateTime=0x1e492360, ftLastAccessTime.dwHighDateTime=0x1d3a8ab, ftLastWriteTime.dwLowDateTime=0x42bda00, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x6770)) returned 1
[0089.481] GetLastError () returned 0xb7
[0089.481] SetErrorMode (uMode=0x0) returned 0x1
[0089.481] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\ytctsumrwh1cpryn.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\ytctsumrwh1cpryn.mp3.lanran2.0.5")) returned 1
[0089.482] GetLastError () returned 0xb7
[0089.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PVEe2eX", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PVEe2eX", lpFilePart=0x0) returned 0x2b
[0089.482] GetLastError () returned 0xb7
[0089.482] SetErrorMode (uMode=0x1) returned 0x0
[0089.482] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PVEe2eX\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0089.482] GetLastError () returned 0xb7
[0089.482] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.482] GetLastError () returned 0xb7
[0089.482] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.482] GetLastError () returned 0xb7
[0089.482] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.482] GetLastError () returned 0xb7
[0089.482] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.482] GetLastError () returned 0x12
[0089.482] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0089.483] SetErrorMode (uMode=0x0) returned 0x1
[0089.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PVEe2eX", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PVEe2eX", lpFilePart=0x0) returned 0x2b
[0089.483] GetLastError () returned 0x12
[0089.483] SetErrorMode (uMode=0x1) returned 0x0
[0089.483] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PVEe2eX\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0089.483] GetLastError () returned 0x12
[0089.483] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.483] GetLastError () returned 0x12
[0089.483] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.483] GetLastError () returned 0x12
[0089.483] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.483] GetLastError () returned 0x12
[0089.483] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.483] GetLastError () returned 0x12
[0089.483] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0089.483] SetErrorMode (uMode=0x0) returned 0x1
[0089.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez", lpFilePart=0x0) returned 0x30
[0089.483] GetLastError () returned 0x12
[0089.483] SetErrorMode (uMode=0x1) returned 0x0
[0089.483] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0089.484] GetLastError () returned 0x12
[0089.484] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.484] GetLastError () returned 0x12
[0089.484] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.484] GetLastError () returned 0x12
[0089.484] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.484] GetLastError () returned 0x12
[0089.484] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.484] GetLastError () returned 0x12
[0089.484] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0089.484] SetErrorMode (uMode=0x0) returned 0x1
[0089.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez", lpFilePart=0x0) returned 0x30
[0089.484] GetLastError () returned 0x12
[0089.484] SetErrorMode (uMode=0x1) returned 0x0
[0089.484] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0089.484] GetLastError () returned 0x12
[0089.484] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.484] GetLastError () returned 0x12
[0089.484] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.484] GetLastError () returned 0x12
[0089.484] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.484] GetLastError () returned 0x12
[0089.484] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.484] GetLastError () returned 0x12
[0089.484] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0089.485] SetErrorMode (uMode=0x0) returned 0x1
[0089.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx", lpFilePart=0x0) returned 0x39
[0089.485] GetLastError () returned 0x12
[0089.485] SetErrorMode (uMode=0x1) returned 0x0
[0089.485] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0089.485] GetLastError () returned 0x12
[0089.485] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.485] GetLastError () returned 0x12
[0089.485] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.485] GetLastError () returned 0x12
[0089.485] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.485] GetLastError () returned 0x12
[0089.485] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.485] GetLastError () returned 0x12
[0089.485] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0089.486] SetErrorMode (uMode=0x0) returned 0x1
[0089.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx", lpFilePart=0x0) returned 0x39
[0089.486] GetLastError () returned 0x12
[0089.486] SetErrorMode (uMode=0x1) returned 0x0
[0089.486] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0089.486] GetLastError () returned 0x12
[0089.486] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.486] GetLastError () returned 0x12
[0089.486] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.486] GetLastError () returned 0x12
[0089.486] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.486] GetLastError () returned 0x12
[0089.486] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.486] GetLastError () returned 0x12
[0089.486] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0089.486] SetErrorMode (uMode=0x0) returned 0x1
[0089.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_", lpFilePart=0x0) returned 0x4c
[0089.486] GetLastError () returned 0x12
[0089.486] SetErrorMode (uMode=0x1) returned 0x0
[0089.487] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0089.487] GetLastError () returned 0x12
[0089.487] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.487] GetLastError () returned 0x12
[0089.487] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.487] GetLastError () returned 0x12
[0089.487] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.487] GetLastError () returned 0x12
[0089.487] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.487] GetLastError () returned 0x12
[0089.487] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.487] GetLastError () returned 0x12
[0089.487] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0089.487] SetErrorMode (uMode=0x0) returned 0x1
[0089.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_", lpFilePart=0x0) returned 0x4c
[0089.487] GetLastError () returned 0x12
[0089.487] SetErrorMode (uMode=0x1) returned 0x0
[0089.487] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0089.487] GetLastError () returned 0x12
[0089.487] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.487] GetLastError () returned 0x12
[0089.488] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.488] GetLastError () returned 0x12
[0089.488] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.488] GetLastError () returned 0x12
[0089.488] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.488] GetLastError () returned 0x12
[0089.488] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.488] GetLastError () returned 0x12
[0089.488] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0089.488] SetErrorMode (uMode=0x0) returned 0x1
[0089.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3", lpFilePart=0x0) returned 0x59
[0089.488] GetLastError () returned 0x12
[0089.488] SetErrorMode (uMode=0x1) returned 0x0
[0089.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\akc-l-vx\\wy6oe3new26uepdqh_\\_unfijl-.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.488] GetLastError () returned 0x0
[0089.488] GetFileType (hFile=0x220) returned 0x1
[0089.488] GetFileType (hFile=0x220) returned 0x1
[0089.488] ReadFile (in: hFile=0x220, lpBuffer=0x26b1c70, nNumberOfBytesToRead=0x63d7, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x26b1c70*, lpNumberOfBytesRead=0x39eaf8*=0x63d7, lpOverlapped=0x0) returned 1
[0089.489] GetLastError () returned 0x0
[0089.515] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3", lpFilePart=0x0) returned 0x59
[0089.515] GetLastError () returned 0x0
[0089.515] SetErrorMode (uMode=0x1) returned 0x0
[0089.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\akc-l-vx\\wy6oe3new26uepdqh_\\_unfijl-.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.516] GetLastError () returned 0xb7
[0089.516] GetFileType (hFile=0x220) returned 0x1
[0089.516] GetFileType (hFile=0x220) returned 0x1
[0089.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3", lpFilePart=0x0) returned 0x59
[0089.517] GetLastError () returned 0xb7
[0089.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x65
[0089.517] GetLastError () returned 0xb7
[0089.517] SetErrorMode (uMode=0x1) returned 0x0
[0089.517] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\akc-l-vx\\wy6oe3new26uepdqh_\\_unfijl-.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7599f2f0, ftCreationTime.dwHighDateTime=0x1d3a23b, ftLastAccessTime.dwLowDateTime=0x279f1d50, ftLastAccessTime.dwHighDateTime=0x1d3a16e, ftLastWriteTime.dwLowDateTime=0x4309cc0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x63e0)) returned 1
[0089.517] GetLastError () returned 0xb7
[0089.517] SetErrorMode (uMode=0x0) returned 0x1
[0089.518] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\akc-l-vx\\wy6oe3new26uepdqh_\\_unfijl-.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\akc-l-vx\\wy6oe3new26uepdqh_\\_unfijl-.mp3.lanran2.0.5")) returned 1
[0089.518] GetLastError () returned 0xb7
[0089.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2", lpFilePart=0x0) returned 0x39
[0089.518] GetLastError () returned 0xb7
[0089.518] SetErrorMode (uMode=0x1) returned 0x0
[0089.518] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430
[0089.518] GetLastError () returned 0xb7
[0089.518] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.518] GetLastError () returned 0xb7
[0089.518] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.518] GetLastError () returned 0xb7
[0089.518] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.518] GetLastError () returned 0xb7
[0089.518] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.519] GetLastError () returned 0xb7
[0089.519] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.519] GetLastError () returned 0x12
[0089.519] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1
[0089.519] SetErrorMode (uMode=0x0) returned 0x1
[0089.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2", lpFilePart=0x0) returned 0x39
[0089.519] GetLastError () returned 0x12
[0089.519] SetErrorMode (uMode=0x1) returned 0x0
[0089.519] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430
[0089.519] GetLastError () returned 0x12
[0089.519] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.519] GetLastError () returned 0x12
[0089.519] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.519] GetLastError () returned 0x12
[0089.519] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.519] GetLastError () returned 0x12
[0089.519] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.577] GetLastError () returned 0x12
[0089.577] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.577] GetLastError () returned 0x12
[0089.578] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1
[0089.578] SetErrorMode (uMode=0x0) returned 0x1
[0089.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3", lpFilePart=0x0) returned 0x4e
[0089.578] GetLastError () returned 0x12
[0089.578] SetErrorMode (uMode=0x1) returned 0x0
[0089.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\jgsuiwu2\\skovqzoy8i53arrb.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.578] GetLastError () returned 0x0
[0089.578] GetFileType (hFile=0x220) returned 0x1
[0089.578] GetFileType (hFile=0x220) returned 0x1
[0089.578] ReadFile (in: hFile=0x220, lpBuffer=0x362b3a8, nNumberOfBytesToRead=0x16390, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x362b3a8*, lpNumberOfBytesRead=0x39eb58*=0x16390, lpOverlapped=0x0) returned 1
[0089.580] GetLastError () returned 0x0
[0089.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3", lpFilePart=0x0) returned 0x4e
[0089.609] GetLastError () returned 0x0
[0089.609] SetErrorMode (uMode=0x1) returned 0x0
[0089.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\jgsuiwu2\\skovqzoy8i53arrb.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.610] GetLastError () returned 0xb7
[0089.610] GetFileType (hFile=0x220) returned 0x1
[0089.610] GetFileType (hFile=0x220) returned 0x1
[0089.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3", lpFilePart=0x0) returned 0x4e
[0089.612] GetLastError () returned 0xb7
[0089.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x5a
[0089.612] GetLastError () returned 0xb7
[0089.612] SetErrorMode (uMode=0x1) returned 0x0
[0089.612] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\jgsuiwu2\\skovqzoy8i53arrb.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56afc00, ftCreationTime.dwHighDateTime=0x1d3a5d7, ftLastAccessTime.dwLowDateTime=0xf39e1f30, ftLastAccessTime.dwHighDateTime=0x1d3a7e2, ftLastWriteTime.dwLowDateTime=0x43ee500, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x163a0)) returned 1
[0089.612] GetLastError () returned 0xb7
[0089.612] SetErrorMode (uMode=0x0) returned 0x1
[0089.612] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\jgsuiwu2\\skovqzoy8i53arrb.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\jgsuiwu2\\skovqzoy8i53arrb.mp3.lanran2.0.5")) returned 1
[0089.613] GetLastError () returned 0xb7
[0089.613] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x0
[0089.613] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25
[0089.613] GetLastError () returned 0x3f0
[0089.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26
[0089.621] GetLastError () returned 0x3f0
[0089.621] SetErrorMode (uMode=0x1) returned 0x0
[0089.621] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270
[0089.621] GetLastError () returned 0x3f0
[0089.621] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.621] GetLastError () returned 0x3f0
[0089.621] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.621] GetLastError () returned 0x3f0
[0089.621] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.621] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.622] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.623] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.623] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.623] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.623] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.623] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.623] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.623] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.623] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.623] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.623] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.623] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.623] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.623] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.623] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.623] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.623] GetLastError () returned 0x3f0
[0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.624] GetLastError () returned 0x12
[0089.624] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1
[0089.624] SetErrorMode (uMode=0x0) returned 0x1
[0089.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26
[0089.624] GetLastError () returned 0x12
[0089.624] SetErrorMode (uMode=0x1) returned 0x0
[0089.624] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270
[0089.624] GetLastError () returned 0x12
[0089.624] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.624] GetLastError () returned 0x12
[0089.624] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.624] GetLastError () returned 0x12
[0089.624] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.624] GetLastError () returned 0x12
[0089.624] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.624] GetLastError () returned 0x12
[0089.624] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.625] GetLastError () returned 0x12
[0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.625] GetLastError () returned 0x12
[0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.625] GetLastError () returned 0x12
[0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.625] GetLastError () returned 0x12
[0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.625] GetLastError () returned 0x12
[0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.625] GetLastError () returned 0x12
[0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.625] GetLastError () returned 0x12
[0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.625] GetLastError () returned 0x12
[0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.625] GetLastError () returned 0x12
[0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.625] GetLastError () returned 0x12
[0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.625] GetLastError () returned 0x12
[0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.625] GetLastError () returned 0x12
[0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.626] GetLastError () returned 0x12
[0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.626] GetLastError () returned 0x12
[0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.626] GetLastError () returned 0x12
[0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.626] GetLastError () returned 0x12
[0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.626] GetLastError () returned 0x12
[0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.626] GetLastError () returned 0x12
[0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.626] GetLastError () returned 0x12
[0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.626] GetLastError () returned 0x12
[0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.626] GetLastError () returned 0x12
[0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.626] GetLastError () returned 0x12
[0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.626] GetLastError () returned 0x12
[0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.626] GetLastError () returned 0x12
[0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.627] GetLastError () returned 0x12
[0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.627] GetLastError () returned 0x12
[0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.627] GetLastError () returned 0x12
[0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.627] GetLastError () returned 0x12
[0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.627] GetLastError () returned 0x12
[0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.627] GetLastError () returned 0x12
[0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.627] GetLastError () returned 0x12
[0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.627] GetLastError () returned 0x12
[0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.627] GetLastError () returned 0x12
[0089.627] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1
[0089.627] SetErrorMode (uMode=0x0) returned 0x1
[0089.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38
[0089.628] GetLastError () returned 0x12
[0089.628] SetErrorMode (uMode=0x1) returned 0x0
[0089.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.628] GetLastError () returned 0x0
[0089.628] GetFileType (hFile=0x220) returned 0x1
[0089.628] GetFileType (hFile=0x220) returned 0x1
[0089.628] ReadFile (in: hFile=0x220, lpBuffer=0x36b09b8, nNumberOfBytesToRead=0x34400, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x36b09b8*, lpNumberOfBytesRead=0x39ec18*=0x34400, lpOverlapped=0x0) returned 1
[0089.631] GetLastError () returned 0x0
[0089.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38
[0089.678] GetLastError () returned 0x0
[0089.678] SetErrorMode (uMode=0x1) returned 0x0
[0089.678] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
[0089.678] GetLastError () returned 0x20
[0089.679] SetErrorMode (uMode=0x0) returned 0x1
[0089.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX", lpFilePart=0x0) returned 0x32
[0089.679] GetLastError () returned 0x20
[0089.679] SetErrorMode (uMode=0x1) returned 0x0
[0089.679] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.679] GetLastError () returned 0x20
[0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.680] GetLastError () returned 0x20
[0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.680] GetLastError () returned 0x20
[0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.680] GetLastError () returned 0x20
[0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.680] GetLastError () returned 0x20
[0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.680] GetLastError () returned 0x20
[0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.680] GetLastError () returned 0x20
[0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.680] GetLastError () returned 0x12
[0089.680] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.680] SetErrorMode (uMode=0x0) returned 0x1
[0089.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX", lpFilePart=0x0) returned 0x32
[0089.680] GetLastError () returned 0x12
[0089.680] SetErrorMode (uMode=0x1) returned 0x0
[0089.680] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.680] GetLastError () returned 0x12
[0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.680] GetLastError () returned 0x12
[0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.680] GetLastError () returned 0x12
[0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.681] GetLastError () returned 0x12
[0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.681] GetLastError () returned 0x12
[0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.681] GetLastError () returned 0x12
[0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.681] GetLastError () returned 0x12
[0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.681] GetLastError () returned 0x12
[0089.681] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.681] SetErrorMode (uMode=0x0) returned 0x1
[0089.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC", lpFilePart=0x0) returned 0x37
[0089.681] GetLastError () returned 0x12
[0089.681] SetErrorMode (uMode=0x1) returned 0x0
[0089.681] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.681] GetLastError () returned 0x12
[0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.681] GetLastError () returned 0x12
[0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.681] GetLastError () returned 0x12
[0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.681] GetLastError () returned 0x12
[0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.681] GetLastError () returned 0x12
[0089.682] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.682] GetLastError () returned 0x12
[0089.682] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.682] SetErrorMode (uMode=0x0) returned 0x1
[0089.682] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC", lpFilePart=0x0) returned 0x37
[0089.682] GetLastError () returned 0x12
[0089.682] SetErrorMode (uMode=0x1) returned 0x0
[0089.683] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.683] GetLastError () returned 0x12
[0089.683] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.683] GetLastError () returned 0x12
[0089.683] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.683] GetLastError () returned 0x12
[0089.683] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.683] GetLastError () returned 0x12
[0089.683] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.683] GetLastError () returned 0x12
[0089.683] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.683] GetLastError () returned 0x12
[0089.684] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.684] SetErrorMode (uMode=0x0) returned 0x1
[0089.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4", lpFilePart=0x0) returned 0x39
[0089.684] GetLastError () returned 0x12
[0089.684] SetErrorMode (uMode=0x1) returned 0x0
[0089.684] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.684] GetLastError () returned 0x12
[0089.684] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.684] GetLastError () returned 0x12
[0089.684] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.684] GetLastError () returned 0x12
[0089.684] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.684] GetLastError () returned 0x12
[0089.684] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.684] GetLastError () returned 0x12
[0089.684] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.684] GetLastError () returned 0x12
[0089.684] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.684] GetLastError () returned 0x12
[0089.684] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.684] GetLastError () returned 0x12
[0089.684] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.684] SetErrorMode (uMode=0x0) returned 0x1
[0089.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4", lpFilePart=0x0) returned 0x39
[0089.685] GetLastError () returned 0x12
[0089.685] SetErrorMode (uMode=0x1) returned 0x0
[0089.685] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.685] GetLastError () returned 0x12
[0089.685] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.685] GetLastError () returned 0x12
[0089.685] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.685] GetLastError () returned 0x12
[0089.685] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.685] GetLastError () returned 0x12
[0089.685] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.685] GetLastError () returned 0x12
[0089.685] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.685] GetLastError () returned 0x12
[0089.685] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.685] GetLastError () returned 0x12
[0089.685] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.685] GetLastError () returned 0x12
[0089.685] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.685] SetErrorMode (uMode=0x0) returned 0x1
[0089.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg", lpFilePart=0x0) returned 0x48
[0089.685] GetLastError () returned 0x12
[0089.685] SetErrorMode (uMode=0x1) returned 0x0
[0089.685] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.686] GetLastError () returned 0x12
[0089.686] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.686] GetLastError () returned 0x12
[0089.686] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.686] GetLastError () returned 0x12
[0089.686] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.686] GetLastError () returned 0x12
[0089.686] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.686] GetLastError () returned 0x12
[0089.686] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.686] SetErrorMode (uMode=0x0) returned 0x1
[0089.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg", lpFilePart=0x0) returned 0x48
[0089.686] GetLastError () returned 0x12
[0089.686] SetErrorMode (uMode=0x1) returned 0x0
[0089.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.686] GetLastError () returned 0x12
[0089.686] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.686] GetLastError () returned 0x12
[0089.686] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.686] GetLastError () returned 0x12
[0089.686] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.686] GetLastError () returned 0x12
[0089.686] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.687] GetLastError () returned 0x12
[0089.687] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.687] SetErrorMode (uMode=0x0) returned 0x1
[0089.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z", lpFilePart=0x0) returned 0x42
[0089.687] GetLastError () returned 0x12
[0089.687] SetErrorMode (uMode=0x1) returned 0x0
[0089.687] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.687] GetLastError () returned 0x12
[0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.687] GetLastError () returned 0x12
[0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.687] GetLastError () returned 0x12
[0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.687] GetLastError () returned 0x12
[0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.687] GetLastError () returned 0x12
[0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.687] GetLastError () returned 0x12
[0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.687] GetLastError () returned 0x12
[0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.687] GetLastError () returned 0x12
[0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.687] GetLastError () returned 0x12
[0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.687] GetLastError () returned 0x12
[0089.687] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.687] SetErrorMode (uMode=0x0) returned 0x1
[0089.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z", lpFilePart=0x0) returned 0x42
[0089.688] GetLastError () returned 0x12
[0089.688] SetErrorMode (uMode=0x1) returned 0x0
[0089.688] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.688] GetLastError () returned 0x12
[0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.688] GetLastError () returned 0x12
[0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.688] GetLastError () returned 0x12
[0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.688] GetLastError () returned 0x12
[0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.688] GetLastError () returned 0x12
[0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.688] GetLastError () returned 0x12
[0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.688] GetLastError () returned 0x12
[0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.688] GetLastError () returned 0x12
[0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.688] GetLastError () returned 0x12
[0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.688] GetLastError () returned 0x12
[0089.688] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.688] SetErrorMode (uMode=0x0) returned 0x1
[0089.688] SHGetFolderPathW (in: hwnd=0x0, csidl=7, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x0
[0089.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b
[0089.689] GetLastError () returned 0x3f0
[0089.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x5c
[0089.689] GetLastError () returned 0x3f0
[0089.689] SetErrorMode (uMode=0x1) returned 0x0
[0089.689] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.689] GetLastError () returned 0x3f0
[0089.690] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.690] GetLastError () returned 0x3f0
[0089.690] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.690] GetLastError () returned 0x3f0
[0089.690] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.690] GetLastError () returned 0x12
[0089.690] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.690] SetErrorMode (uMode=0x0) returned 0x1
[0089.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x5c
[0089.690] GetLastError () returned 0x12
[0089.690] SetErrorMode (uMode=0x1) returned 0x0
[0089.690] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.690] GetLastError () returned 0x12
[0089.690] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.690] GetLastError () returned 0x12
[0089.690] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.690] GetLastError () returned 0x12
[0089.690] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.690] GetLastError () returned 0x12
[0089.690] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.690] SetErrorMode (uMode=0x0) returned 0x1
[0089.690] SHGetFolderPathW (in: hwnd=0x0, csidl=2, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs") returned 0x0
[0089.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x53
[0089.691] GetLastError () returned 0x3f0
[0089.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x54
[0089.691] GetLastError () returned 0x3f0
[0089.691] SetErrorMode (uMode=0x1) returned 0x0
[0089.691] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.691] GetLastError () returned 0x3f0
[0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.692] GetLastError () returned 0x3f0
[0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.692] GetLastError () returned 0x3f0
[0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.692] GetLastError () returned 0x3f0
[0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.692] GetLastError () returned 0x3f0
[0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.692] GetLastError () returned 0x3f0
[0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.692] GetLastError () returned 0x3f0
[0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.692] GetLastError () returned 0x3f0
[0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.692] GetLastError () returned 0x3f0
[0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.692] GetLastError () returned 0x12
[0089.692] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.692] SetErrorMode (uMode=0x0) returned 0x1
[0089.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x54
[0089.692] GetLastError () returned 0x12
[0089.692] SetErrorMode (uMode=0x1) returned 0x0
[0089.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.692] GetLastError () returned 0x12
[0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.692] GetLastError () returned 0x12
[0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.692] GetLastError () returned 0x12
[0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.692] GetLastError () returned 0x12
[0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.692] GetLastError () returned 0x12
[0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.692] GetLastError () returned 0x12
[0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.693] GetLastError () returned 0x12
[0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.693] GetLastError () returned 0x12
[0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.693] GetLastError () returned 0x12
[0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.693] GetLastError () returned 0x12
[0089.693] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.693] SetErrorMode (uMode=0x0) returned 0x1
[0089.693] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x5f
[0089.693] GetLastError () returned 0x12
[0089.693] SetErrorMode (uMode=0x1) returned 0x0
[0089.693] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.693] GetLastError () returned 0x12
[0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.693] GetLastError () returned 0x12
[0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.693] GetLastError () returned 0x12
[0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.693] GetLastError () returned 0x12
[0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.693] GetLastError () returned 0x12
[0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.693] GetLastError () returned 0x12
[0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.693] GetLastError () returned 0x12
[0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.693] GetLastError () returned 0x12
[0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.693] GetLastError () returned 0x12
[0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.693] GetLastError () returned 0x12
[0089.693] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.694] SetErrorMode (uMode=0x0) returned 0x1
[0089.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x5f
[0089.694] GetLastError () returned 0x12
[0089.694] SetErrorMode (uMode=0x1) returned 0x0
[0089.694] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.694] GetLastError () returned 0x12
[0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.694] GetLastError () returned 0x12
[0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.694] GetLastError () returned 0x12
[0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.694] GetLastError () returned 0x12
[0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.694] GetLastError () returned 0x12
[0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.694] GetLastError () returned 0x12
[0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.694] GetLastError () returned 0x12
[0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.694] GetLastError () returned 0x12
[0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.694] GetLastError () returned 0x12
[0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.694] GetLastError () returned 0x12
[0089.694] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.694] SetErrorMode (uMode=0x0) returned 0x1
[0089.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x6d
[0089.694] GetLastError () returned 0x12
[0089.694] SetErrorMode (uMode=0x1) returned 0x0
[0089.694] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.695] GetLastError () returned 0x12
[0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.695] GetLastError () returned 0x12
[0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.695] GetLastError () returned 0x12
[0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.695] GetLastError () returned 0x12
[0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.695] GetLastError () returned 0x12
[0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.695] GetLastError () returned 0x12
[0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.695] GetLastError () returned 0x12
[0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.695] GetLastError () returned 0x12
[0089.695] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.695] SetErrorMode (uMode=0x0) returned 0x1
[0089.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x6d
[0089.695] GetLastError () returned 0x12
[0089.695] SetErrorMode (uMode=0x1) returned 0x0
[0089.695] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.695] GetLastError () returned 0x12
[0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.695] GetLastError () returned 0x12
[0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.695] GetLastError () returned 0x12
[0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.695] GetLastError () returned 0x12
[0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.695] GetLastError () returned 0x12
[0089.696] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.696] GetLastError () returned 0x12
[0089.696] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.696] GetLastError () returned 0x12
[0089.696] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0089.696] GetLastError () returned 0x12
[0089.696] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.696] SetErrorMode (uMode=0x0) returned 0x1
[0089.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x6c
[0089.696] GetLastError () returned 0x12
[0089.696] SetErrorMode (uMode=0x1) returned 0x0
[0089.696] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.696] GetLastError () returned 0x12
[0089.696] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0089.696] GetLastError () returned 0x12
[0089.696] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.696] SetErrorMode (uMode=0x0) returned 0x1
[0089.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x6c
[0089.696] GetLastError () returned 0x12
[0089.696] SetErrorMode (uMode=0x1) returned 0x0
[0089.697] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.697] GetLastError () returned 0x12
[0089.697] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.697] SetErrorMode (uMode=0x0) returned 0x1
[0089.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x68
[0089.697] GetLastError () returned 0x12
[0089.697] SetErrorMode (uMode=0x1) returned 0x0
[0089.697] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.697] GetLastError () returned 0x12
[0089.697] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.697] SetErrorMode (uMode=0x0) returned 0x1
[0089.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x68
[0089.697] GetLastError () returned 0x12
[0089.697] SetErrorMode (uMode=0x1) returned 0x0
[0089.697] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.697] GetLastError () returned 0x12
[0089.697] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.697] SetErrorMode (uMode=0x0) returned 0x1
[0089.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x5f
[0089.698] GetLastError () returned 0x12
[0089.698] SetErrorMode (uMode=0x1) returned 0x0
[0089.698] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.698] GetLastError () returned 0x12
[0089.698] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.698] SetErrorMode (uMode=0x0) returned 0x1
[0089.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x5f
[0089.698] GetLastError () returned 0x12
[0089.698] SetErrorMode (uMode=0x1) returned 0x0
[0089.698] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.698] GetLastError () returned 0x12
[0089.698] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.698] SetErrorMode (uMode=0x0) returned 0x1
[0089.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b
[0089.698] GetLastError () returned 0x12
[0089.698] SetErrorMode (uMode=0x1) returned 0x0
[0089.698] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.698] GetLastError () returned 0x12
[0089.698] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.698] SetErrorMode (uMode=0x0) returned 0x1
[0089.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b
[0089.699] GetLastError () returned 0x12
[0089.699] SetErrorMode (uMode=0x1) returned 0x0
[0089.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.699] GetLastError () returned 0x12
[0089.699] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.699] SetErrorMode (uMode=0x0) returned 0x1
[0089.699] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0
[0089.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d
[0089.699] GetLastError () returned 0x3f0
[0089.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x2e
[0089.699] GetLastError () returned 0x3f0
[0089.699] SetErrorMode (uMode=0x1) returned 0x0
[0089.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.699] GetLastError () returned 0x3f0
[0089.699] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.699] SetErrorMode (uMode=0x0) returned 0x1
[0089.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x2e
[0089.699] GetLastError () returned 0x12
[0089.699] SetErrorMode (uMode=0x1) returned 0x0
[0089.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0
[0089.700] GetLastError () returned 0x12
[0089.700] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1
[0089.700] SetErrorMode (uMode=0x0) returned 0x1
[0089.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf", lpFilePart=0x0) returned 0x3a
[0089.700] GetLastError () returned 0x12
[0089.700] SetErrorMode (uMode=0x1) returned 0x0
[0089.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3zwe2-nh.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.700] GetLastError () returned 0x0
[0089.700] GetFileType (hFile=0x220) returned 0x1
[0089.700] GetFileType (hFile=0x220) returned 0x1
[0089.700] ReadFile (in: hFile=0x220, lpBuffer=0x24d37a4, nNumberOfBytesToRead=0x8ffd, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x24d37a4*, lpNumberOfBytesRead=0x39ec18*=0x8ffd, lpOverlapped=0x0) returned 1
[0089.701] GetLastError () returned 0x0
[0089.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf", lpFilePart=0x0) returned 0x3a
[0089.723] GetLastError () returned 0x0
[0089.723] SetErrorMode (uMode=0x1) returned 0x0
[0089.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3zwe2-nh.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.724] GetLastError () returned 0xb7
[0089.724] GetFileType (hFile=0x220) returned 0x1
[0089.724] GetFileType (hFile=0x220) returned 0x1
[0089.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf", lpFilePart=0x0) returned 0x3a
[0089.725] GetLastError () returned 0xb7
[0089.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf.LanRan2.0.5", lpFilePart=0x0) returned 0x46
[0089.725] GetLastError () returned 0xb7
[0089.725] SetErrorMode (uMode=0x1) returned 0x0
[0089.725] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3zwe2-nh.rtf"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb58bef60, ftCreationTime.dwHighDateTime=0x1d3aeef, ftLastAccessTime.dwLowDateTime=0x72bf2000, ftLastAccessTime.dwHighDateTime=0x1d3afa1, ftLastWriteTime.dwLowDateTime=0x451f000, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x9000)) returned 1
[0089.725] GetLastError () returned 0xb7
[0089.725] SetErrorMode (uMode=0x0) returned 0x1
[0089.725] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3zwe2-nh.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3zwe2-nh.rtf.lanran2.0.5")) returned 1
[0089.725] GetLastError () returned 0xb7
[0089.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi", lpFilePart=0x0) returned 0x43
[0089.725] GetLastError () returned 0xb7
[0089.725] SetErrorMode (uMode=0x1) returned 0x0
[0089.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b m-6pzp2cxtexe n.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.726] GetLastError () returned 0x0
[0089.726] GetFileType (hFile=0x220) returned 0x1
[0089.726] GetFileType (hFile=0x220) returned 0x1
[0089.726] ReadFile (in: hFile=0x220, lpBuffer=0x2591a1c, nNumberOfBytesToRead=0x1e83, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2591a1c*, lpNumberOfBytesRead=0x39ec18*=0x1e83, lpOverlapped=0x0) returned 1
[0089.726] GetLastError () returned 0x0
[0089.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi", lpFilePart=0x0) returned 0x43
[0089.743] GetLastError () returned 0x0
[0089.743] SetErrorMode (uMode=0x1) returned 0x0
[0089.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b m-6pzp2cxtexe n.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.744] GetLastError () returned 0xb7
[0089.744] GetFileType (hFile=0x220) returned 0x1
[0089.744] GetFileType (hFile=0x220) returned 0x1
[0089.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi", lpFilePart=0x0) returned 0x43
[0089.744] GetLastError () returned 0xb7
[0089.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi.LanRan2.0.5", lpFilePart=0x0) returned 0x4f
[0089.744] GetLastError () returned 0xb7
[0089.744] SetErrorMode (uMode=0x1) returned 0x0
[0089.744] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b m-6pzp2cxtexe n.avi"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc46e5b40, ftCreationTime.dwHighDateTime=0x1d3ad72, ftLastAccessTime.dwLowDateTime=0x7c10a800, ftLastAccessTime.dwHighDateTime=0x1d3a2d0, ftLastWriteTime.dwLowDateTime=0x4545160, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x1e90)) returned 1
[0089.744] GetLastError () returned 0xb7
[0089.744] SetErrorMode (uMode=0x0) returned 0x1
[0089.744] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b m-6pzp2cxtexe n.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b m-6pzp2cxtexe n.avi.lanran2.0.5")) returned 1
[0089.745] GetLastError () returned 0xb7
[0089.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp", lpFilePart=0x0) returned 0x45
[0089.745] GetLastError () returned 0xb7
[0089.745] SetErrorMode (uMode=0x1) returned 0x0
[0089.745] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dr1a9fjyb6ohzsgyw1x.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.745] GetLastError () returned 0x0
[0089.745] GetFileType (hFile=0x220) returned 0x1
[0089.745] GetFileType (hFile=0x220) returned 0x1
[0089.746] ReadFile (in: hFile=0x220, lpBuffer=0x34cb210, nNumberOfBytesToRead=0x161ef, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x34cb210*, lpNumberOfBytesRead=0x39ec18*=0x161ef, lpOverlapped=0x0) returned 1
[0089.746] GetLastError () returned 0x0
[0089.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp", lpFilePart=0x0) returned 0x45
[0089.766] GetLastError () returned 0x0
[0089.766] SetErrorMode (uMode=0x1) returned 0x0
[0089.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dr1a9fjyb6ohzsgyw1x.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.767] GetLastError () returned 0xb7
[0089.767] GetFileType (hFile=0x220) returned 0x1
[0089.767] GetFileType (hFile=0x220) returned 0x1
[0089.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp", lpFilePart=0x0) returned 0x45
[0089.768] GetLastError () returned 0xb7
[0089.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp.LanRan2.0.5", lpFilePart=0x0) returned 0x51
[0089.768] GetLastError () returned 0xb7
[0089.768] SetErrorMode (uMode=0x1) returned 0x0
[0089.768] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dr1a9fjyb6ohzsgyw1x.bmp"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe69256a0, ftCreationTime.dwHighDateTime=0x1d3aba5, ftLastAccessTime.dwLowDateTime=0x38afc690, ftLastAccessTime.dwHighDateTime=0x1d3ae65, ftLastWriteTime.dwLowDateTime=0x456b2c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x161f0)) returned 1
[0089.768] GetLastError () returned 0xb7
[0089.768] SetErrorMode (uMode=0x0) returned 0x1
[0089.768] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dr1a9fjyb6ohzsgyw1x.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dr1a9fjyb6ohzsgyw1x.bmp.lanran2.0.5")) returned 1
[0089.769] GetLastError () returned 0xb7
[0089.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png", lpFilePart=0x0) returned 0x3c
[0089.769] GetLastError () returned 0xb7
[0089.769] SetErrorMode (uMode=0x1) returned 0x0
[0089.769] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\exlimxnopc.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.769] GetLastError () returned 0x0
[0089.769] GetFileType (hFile=0x220) returned 0x1
[0089.769] GetFileType (hFile=0x220) returned 0x1
[0089.769] ReadFile (in: hFile=0x220, lpBuffer=0x26ad324, nNumberOfBytesToRead=0x10352, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26ad324*, lpNumberOfBytesRead=0x39ec18*=0x10352, lpOverlapped=0x0) returned 1
[0089.770] GetLastError () returned 0x0
[0089.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png", lpFilePart=0x0) returned 0x3c
[0089.798] GetLastError () returned 0x0
[0089.798] SetErrorMode (uMode=0x1) returned 0x0
[0089.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\exlimxnopc.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.799] GetLastError () returned 0xb7
[0089.799] GetFileType (hFile=0x220) returned 0x1
[0089.800] GetFileType (hFile=0x220) returned 0x1
[0089.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png", lpFilePart=0x0) returned 0x3c
[0089.801] GetLastError () returned 0xb7
[0089.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png.LanRan2.0.5", lpFilePart=0x0) returned 0x48
[0089.801] GetLastError () returned 0xb7
[0089.801] SetErrorMode (uMode=0x1) returned 0x0
[0089.801] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\exlimxnopc.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x741e37a0, ftCreationTime.dwHighDateTime=0x1d3a0f7, ftLastAccessTime.dwLowDateTime=0xe5956490, ftLastAccessTime.dwHighDateTime=0x1d3a6b9, ftLastWriteTime.dwLowDateTime=0x45b7580, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x10360)) returned 1
[0089.801] GetLastError () returned 0xb7
[0089.801] SetErrorMode (uMode=0x0) returned 0x1
[0089.802] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\exlimxnopc.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\exlimxnopc.png.lanran2.0.5")) returned 1
[0089.802] GetLastError () returned 0xb7
[0089.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3", lpFilePart=0x0) returned 0x43
[0089.802] GetLastError () returned 0xb7
[0089.802] SetErrorMode (uMode=0x1) returned 0x0
[0089.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fyvnazxtqq2juonn6.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.803] GetLastError () returned 0x0
[0089.803] GetFileType (hFile=0x220) returned 0x1
[0089.803] GetFileType (hFile=0x220) returned 0x1
[0089.803] ReadFile (in: hFile=0x220, lpBuffer=0x35704d0, nNumberOfBytesToRead=0x16fe7, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x35704d0*, lpNumberOfBytesRead=0x39ec18*=0x16fe7, lpOverlapped=0x0) returned 1
[0089.804] GetLastError () returned 0x0
[0089.829] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3", lpFilePart=0x0) returned 0x43
[0089.829] GetLastError () returned 0x0
[0089.829] SetErrorMode (uMode=0x1) returned 0x0
[0089.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fyvnazxtqq2juonn6.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.830] GetLastError () returned 0xb7
[0089.830] GetFileType (hFile=0x220) returned 0x1
[0089.830] GetFileType (hFile=0x220) returned 0x1
[0089.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3", lpFilePart=0x0) returned 0x43
[0089.831] GetLastError () returned 0xb7
[0089.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x4f
[0089.832] GetLastError () returned 0xb7
[0089.832] SetErrorMode (uMode=0x1) returned 0x0
[0089.832] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fyvnazxtqq2juonn6.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9ecc8e70, ftCreationTime.dwHighDateTime=0x1d3a8d6, ftLastAccessTime.dwLowDateTime=0xd61ca3b0, ftLastAccessTime.dwHighDateTime=0x1d3a908, ftLastWriteTime.dwLowDateTime=0x4603840, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x16ff0)) returned 1
[0089.832] GetLastError () returned 0xb7
[0089.832] SetErrorMode (uMode=0x0) returned 0x1
[0089.832] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fyvnazxtqq2juonn6.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fyvnazxtqq2juonn6.mp3.lanran2.0.5")) returned 1
[0089.833] GetLastError () returned 0xb7
[0089.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png", lpFilePart=0x0) returned 0x44
[0089.834] GetLastError () returned 0xb7
[0089.834] SetErrorMode (uMode=0x1) returned 0x0
[0089.834] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k-qbfp1vgociynj1 n.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.834] GetLastError () returned 0x0
[0089.834] GetFileType (hFile=0x220) returned 0x1
[0089.834] GetFileType (hFile=0x220) returned 0x1
[0089.834] ReadFile (in: hFile=0x220, lpBuffer=0x260bf40, nNumberOfBytesToRead=0x79af, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x260bf40*, lpNumberOfBytesRead=0x39ec18*=0x79af, lpOverlapped=0x0) returned 1
[0089.835] GetLastError () returned 0x0
[0089.878] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png", lpFilePart=0x0) returned 0x44
[0089.878] GetLastError () returned 0x0
[0089.878] SetErrorMode (uMode=0x1) returned 0x0
[0089.878] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k-qbfp1vgociynj1 n.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.879] GetLastError () returned 0xb7
[0089.879] GetFileType (hFile=0x220) returned 0x1
[0089.879] GetFileType (hFile=0x220) returned 0x1
[0089.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png", lpFilePart=0x0) returned 0x44
[0089.880] GetLastError () returned 0xb7
[0089.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png.LanRan2.0.5", lpFilePart=0x0) returned 0x50
[0089.880] GetLastError () returned 0xb7
[0089.880] SetErrorMode (uMode=0x1) returned 0x0
[0089.880] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k-qbfp1vgociynj1 n.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24063e10, ftCreationTime.dwHighDateTime=0x1d3ae72, ftLastAccessTime.dwLowDateTime=0x4b5f3a0, ftLastAccessTime.dwHighDateTime=0x1d3acf3, ftLastWriteTime.dwLowDateTime=0x469bdc0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x79b0)) returned 1
[0089.880] GetLastError () returned 0xb7
[0089.880] SetErrorMode (uMode=0x0) returned 0x1
[0089.880] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k-qbfp1vgociynj1 n.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k-qbfp1vgociynj1 n.png.lanran2.0.5")) returned 1
[0089.880] GetLastError () returned 0xb7
[0089.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv", lpFilePart=0x0) returned 0x39
[0089.880] GetLastError () returned 0xb7
[0089.880] SetErrorMode (uMode=0x1) returned 0x0
[0089.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kveoden.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.881] GetLastError () returned 0x0
[0089.881] GetFileType (hFile=0x220) returned 0x1
[0089.881] GetFileType (hFile=0x220) returned 0x1
[0089.881] ReadFile (in: hFile=0x220, lpBuffer=0x26c1a1c, nNumberOfBytesToRead=0x6c0e, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26c1a1c*, lpNumberOfBytesRead=0x39ec18*=0x6c0e, lpOverlapped=0x0) returned 1
[0089.881] GetLastError () returned 0x0
[0089.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv", lpFilePart=0x0) returned 0x39
[0089.903] GetLastError () returned 0x0
[0089.903] SetErrorMode (uMode=0x1) returned 0x0
[0089.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kveoden.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.904] GetLastError () returned 0xb7
[0089.904] GetFileType (hFile=0x220) returned 0x1
[0089.904] GetFileType (hFile=0x220) returned 0x1
[0089.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv", lpFilePart=0x0) returned 0x39
[0089.905] GetLastError () returned 0xb7
[0089.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv.LanRan2.0.5", lpFilePart=0x0) returned 0x45
[0089.905] GetLastError () returned 0xb7
[0089.905] SetErrorMode (uMode=0x1) returned 0x0
[0089.905] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kveoden.flv"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa62d90, ftCreationTime.dwHighDateTime=0x1d3ad3c, ftLastAccessTime.dwLowDateTime=0x6a5ad1b0, ftLastAccessTime.dwHighDateTime=0x1d3a5ca, ftLastWriteTime.dwLowDateTime=0x46c1f20, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x6c10)) returned 1
[0089.905] GetLastError () returned 0xb7
[0089.905] SetErrorMode (uMode=0x0) returned 0x1
[0089.905] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kveoden.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kveoden.flv.lanran2.0.5")) returned 1
[0089.906] GetLastError () returned 0xb7
[0089.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3", lpFilePart=0x0) returned 0x3e
[0089.906] GetLastError () returned 0xb7
[0089.906] SetErrorMode (uMode=0x1) returned 0x0
[0089.906] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m-1llo1xsmqy.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.906] GetLastError () returned 0x0
[0089.906] GetFileType (hFile=0x220) returned 0x1
[0089.906] GetFileType (hFile=0x220) returned 0x1
[0089.906] ReadFile (in: hFile=0x220, lpBuffer=0x35fa4c8, nNumberOfBytesToRead=0x17dd6, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x35fa4c8*, lpNumberOfBytesRead=0x39ec18*=0x17dd6, lpOverlapped=0x0) returned 1
[0089.907] GetLastError () returned 0x0
[0089.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3", lpFilePart=0x0) returned 0x3e
[0089.932] GetLastError () returned 0x0
[0089.932] SetErrorMode (uMode=0x1) returned 0x0
[0089.932] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m-1llo1xsmqy.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.933] GetLastError () returned 0xb7
[0089.933] GetFileType (hFile=0x220) returned 0x1
[0089.933] GetFileType (hFile=0x220) returned 0x1
[0089.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3", lpFilePart=0x0) returned 0x3e
[0089.934] GetLastError () returned 0xb7
[0089.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x4a
[0089.934] GetLastError () returned 0xb7
[0089.934] SetErrorMode (uMode=0x1) returned 0x0
[0089.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m-1llo1xsmqy.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xddc428a0, ftCreationTime.dwHighDateTime=0x1d3a7d1, ftLastAccessTime.dwLowDateTime=0x77afda0, ftLastAccessTime.dwHighDateTime=0x1d3add0, ftLastWriteTime.dwLowDateTime=0x470e1e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x17de0)) returned 1
[0089.934] GetLastError () returned 0xb7
[0089.934] SetErrorMode (uMode=0x0) returned 0x1
[0089.934] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m-1llo1xsmqy.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m-1llo1xsmqy.mp3.lanran2.0.5")) returned 1
[0089.935] GetLastError () returned 0xb7
[0089.935] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx", lpFilePart=0x0) returned 0x42
[0089.935] GetLastError () returned 0xb7
[0089.935] SetErrorMode (uMode=0x1) returned 0x0
[0089.935] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oujzqbivduif6pi.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.935] GetLastError () returned 0x0
[0089.935] GetFileType (hFile=0x220) returned 0x1
[0089.935] GetFileType (hFile=0x220) returned 0x1
[0089.935] ReadFile (in: hFile=0x220, lpBuffer=0x260151c, nNumberOfBytesToRead=0x988f, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x260151c*, lpNumberOfBytesRead=0x39ec18*=0x988f, lpOverlapped=0x0) returned 1
[0089.936] GetLastError () returned 0x0
[0089.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx", lpFilePart=0x0) returned 0x42
[0089.960] GetLastError () returned 0x0
[0089.960] SetErrorMode (uMode=0x1) returned 0x0
[0089.960] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oujzqbivduif6pi.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.961] GetLastError () returned 0xb7
[0089.961] GetFileType (hFile=0x220) returned 0x1
[0089.961] GetFileType (hFile=0x220) returned 0x1
[0089.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx", lpFilePart=0x0) returned 0x42
[0089.962] GetLastError () returned 0xb7
[0089.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x4e
[0089.962] GetLastError () returned 0xb7
[0089.962] SetErrorMode (uMode=0x1) returned 0x0
[0089.963] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oujzqbivduif6pi.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x72cef550, ftCreationTime.dwHighDateTime=0x1d3a3aa, ftLastAccessTime.dwLowDateTime=0x191d9de0, ftLastAccessTime.dwHighDateTime=0x1d3a0c1, ftLastWriteTime.dwLowDateTime=0x475a4a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x9890)) returned 1
[0089.963] GetLastError () returned 0xb7
[0089.963] SetErrorMode (uMode=0x0) returned 0x1
[0089.963] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oujzqbivduif6pi.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oujzqbivduif6pi.docx.lanran2.0.5")) returned 1
[0089.963] GetLastError () returned 0xb7
[0089.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls", lpFilePart=0x0) returned 0x39
[0089.963] GetLastError () returned 0xb7
[0089.963] SetErrorMode (uMode=0x1) returned 0x0
[0089.964] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pqinwrm.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.964] GetLastError () returned 0x0
[0089.964] GetFileType (hFile=0x220) returned 0x1
[0089.964] GetFileType (hFile=0x220) returned 0x1
[0089.964] ReadFile (in: hFile=0x220, lpBuffer=0x26c295c, nNumberOfBytesToRead=0x111d0, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26c295c*, lpNumberOfBytesRead=0x39ec18*=0x111d0, lpOverlapped=0x0) returned 1
[0089.964] GetLastError () returned 0x0
[0089.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls", lpFilePart=0x0) returned 0x39
[0089.989] GetLastError () returned 0x0
[0089.989] SetErrorMode (uMode=0x1) returned 0x0
[0089.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pqinwrm.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.990] GetLastError () returned 0xb7
[0089.990] GetFileType (hFile=0x220) returned 0x1
[0089.990] GetFileType (hFile=0x220) returned 0x1
[0089.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls", lpFilePart=0x0) returned 0x39
[0089.991] GetLastError () returned 0xb7
[0089.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls.LanRan2.0.5", lpFilePart=0x0) returned 0x45
[0089.992] GetLastError () returned 0xb7
[0089.992] SetErrorMode (uMode=0x1) returned 0x0
[0089.992] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pqinwrm.xls"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc61fa760, ftCreationTime.dwHighDateTime=0x1d3b028, ftLastAccessTime.dwLowDateTime=0xe6228840, ftLastAccessTime.dwHighDateTime=0x1d3a84c, ftLastWriteTime.dwLowDateTime=0x47a6760, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x111e0)) returned 1
[0089.992] GetLastError () returned 0xb7
[0089.992] SetErrorMode (uMode=0x0) returned 0x1
[0089.992] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pqinwrm.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pqinwrm.xls.lanran2.0.5")) returned 1
[0089.992] GetLastError () returned 0xb7
[0089.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png", lpFilePart=0x0) returned 0x42
[0089.992] GetLastError () returned 0xb7
[0089.992] SetErrorMode (uMode=0x1) returned 0x0
[0089.992] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tdbbjpidntvk8-du.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0089.992] GetLastError () returned 0x0
[0089.992] GetFileType (hFile=0x220) returned 0x1
[0089.992] GetFileType (hFile=0x220) returned 0x1
[0089.993] ReadFile (in: hFile=0x220, lpBuffer=0x25abd58, nNumberOfBytesToRead=0x10200, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25abd58*, lpNumberOfBytesRead=0x39ec18*=0x10200, lpOverlapped=0x0) returned 1
[0089.993] GetLastError () returned 0x0
[0090.012] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png", lpFilePart=0x0) returned 0x42
[0090.012] GetLastError () returned 0x0
[0090.012] SetErrorMode (uMode=0x1) returned 0x0
[0090.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tdbbjpidntvk8-du.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.013] GetLastError () returned 0xb7
[0090.013] GetFileType (hFile=0x220) returned 0x1
[0090.013] GetFileType (hFile=0x220) returned 0x1
[0090.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png", lpFilePart=0x0) returned 0x42
[0090.014] GetLastError () returned 0xb7
[0090.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png.LanRan2.0.5", lpFilePart=0x0) returned 0x4e
[0090.014] GetLastError () returned 0xb7
[0090.014] SetErrorMode (uMode=0x1) returned 0x0
[0090.014] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tdbbjpidntvk8-du.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf33389a0, ftCreationTime.dwHighDateTime=0x1d3af4d, ftLastAccessTime.dwLowDateTime=0xd7571180, ftLastAccessTime.dwHighDateTime=0x1d3a24f, ftLastWriteTime.dwLowDateTime=0x47cc8c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x10210)) returned 1
[0090.014] GetLastError () returned 0xb7
[0090.014] SetErrorMode (uMode=0x0) returned 0x1
[0090.014] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tdbbjpidntvk8-du.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tdbbjpidntvk8-du.png.lanran2.0.5")) returned 1
[0090.016] GetLastError () returned 0xb7
[0090.016] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif", lpFilePart=0x0) returned 0x3d
[0090.016] GetLastError () returned 0xb7
[0090.016] SetErrorMode (uMode=0x1) returned 0x0
[0090.016] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vepxh_ jzar.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.016] GetLastError () returned 0x0
[0090.016] GetFileType (hFile=0x220) returned 0x1
[0090.016] GetFileType (hFile=0x220) returned 0x1
[0090.016] ReadFile (in: hFile=0x220, lpBuffer=0x2674820, nNumberOfBytesToRead=0x8605, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2674820*, lpNumberOfBytesRead=0x39ec18*=0x8605, lpOverlapped=0x0) returned 1
[0090.017] GetLastError () returned 0x0
[0090.035] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif", lpFilePart=0x0) returned 0x3d
[0090.035] GetLastError () returned 0x0
[0090.035] SetErrorMode (uMode=0x1) returned 0x0
[0090.035] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vepxh_ jzar.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.036] GetLastError () returned 0xb7
[0090.036] GetFileType (hFile=0x220) returned 0x1
[0090.036] GetFileType (hFile=0x220) returned 0x1
[0090.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif", lpFilePart=0x0) returned 0x3d
[0090.038] GetLastError () returned 0xb7
[0090.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x49
[0090.038] GetLastError () returned 0xb7
[0090.038] SetErrorMode (uMode=0x1) returned 0x0
[0090.038] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vepxh_ jzar.gif"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4d2c5f0, ftCreationTime.dwHighDateTime=0x1d3a3fc, ftLastAccessTime.dwLowDateTime=0xcbbc9690, ftLastAccessTime.dwHighDateTime=0x1d3afb2, ftLastWriteTime.dwLowDateTime=0x4818b80, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x8610)) returned 1
[0090.038] GetLastError () returned 0xb7
[0090.038] SetErrorMode (uMode=0x0) returned 0x1
[0090.038] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vepxh_ jzar.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vepxh_ jzar.gif.lanran2.0.5")) returned 1
[0090.039] GetLastError () returned 0xb7
[0090.039] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3", lpFilePart=0x0) returned 0x41
[0090.039] GetLastError () returned 0xb7
[0090.039] SetErrorMode (uMode=0x1) returned 0x0
[0090.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wvhdidgpq5gsdm_.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.039] GetLastError () returned 0x0
[0090.039] GetFileType (hFile=0x220) returned 0x1
[0090.039] GetFileType (hFile=0x220) returned 0x1
[0090.039] ReadFile (in: hFile=0x220, lpBuffer=0x24f2b5c, nNumberOfBytesToRead=0x5903, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x24f2b5c*, lpNumberOfBytesRead=0x39ec18*=0x5903, lpOverlapped=0x0) returned 1
[0090.039] GetLastError () returned 0x0
[0090.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3", lpFilePart=0x0) returned 0x41
[0090.058] GetLastError () returned 0x0
[0090.058] SetErrorMode (uMode=0x1) returned 0x0
[0090.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wvhdidgpq5gsdm_.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.059] GetLastError () returned 0xb7
[0090.059] GetFileType (hFile=0x220) returned 0x1
[0090.059] GetFileType (hFile=0x220) returned 0x1
[0090.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3", lpFilePart=0x0) returned 0x41
[0090.060] GetLastError () returned 0xb7
[0090.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x4d
[0090.060] GetLastError () returned 0xb7
[0090.060] SetErrorMode (uMode=0x1) returned 0x0
[0090.060] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wvhdidgpq5gsdm_.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62f4ce30, ftCreationTime.dwHighDateTime=0x1d3a8a4, ftLastAccessTime.dwLowDateTime=0x2cacc950, ftLastAccessTime.dwHighDateTime=0x1d3abc3, ftLastWriteTime.dwLowDateTime=0x483ece0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x5910)) returned 1
[0090.060] GetLastError () returned 0xb7
[0090.060] SetErrorMode (uMode=0x0) returned 0x1
[0090.060] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wvhdidgpq5gsdm_.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wvhdidgpq5gsdm_.mp3.lanran2.0.5")) returned 1
[0090.060] GetLastError () returned 0xb7
[0090.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv", lpFilePart=0x0) returned 0x37
[0090.060] GetLastError () returned 0xb7
[0090.061] SetErrorMode (uMode=0x1) returned 0x0
[0090.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9rrw.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.061] GetLastError () returned 0x0
[0090.061] GetFileType (hFile=0x220) returned 0x1
[0090.061] GetFileType (hFile=0x220) returned 0x1
[0090.061] ReadFile (in: hFile=0x220, lpBuffer=0x259ca8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x259ca8c*, lpNumberOfBytesRead=0x39ec18*=0x640, lpOverlapped=0x0) returned 1
[0090.061] GetLastError () returned 0x0
[0090.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv", lpFilePart=0x0) returned 0x37
[0090.077] GetLastError () returned 0x0
[0090.077] SetErrorMode (uMode=0x1) returned 0x0
[0090.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9rrw.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.078] GetLastError () returned 0xb7
[0090.078] GetFileType (hFile=0x220) returned 0x1
[0090.078] GetFileType (hFile=0x220) returned 0x1
[0090.078] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv", lpFilePart=0x0) returned 0x37
[0090.078] GetLastError () returned 0xb7
[0090.078] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv.LanRan2.0.5", lpFilePart=0x0) returned 0x43
[0090.078] GetLastError () returned 0xb7
[0090.078] SetErrorMode (uMode=0x1) returned 0x0
[0090.078] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9rrw.flv"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x217a6b00, ftCreationTime.dwHighDateTime=0x1d3a2a9, ftLastAccessTime.dwLowDateTime=0xab32e0c0, ftLastAccessTime.dwHighDateTime=0x1d3a6eb, ftLastWriteTime.dwLowDateTime=0x4864e40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x650)) returned 1
[0090.078] GetLastError () returned 0xb7
[0090.078] SetErrorMode (uMode=0x0) returned 0x1
[0090.079] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9rrw.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9rrw.flv.lanran2.0.5")) returned 1
[0090.079] GetLastError () returned 0xb7
[0090.079] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf", lpFilePart=0x0) returned 0x38
[0090.079] GetLastError () returned 0xb7
[0090.079] SetErrorMode (uMode=0x1) returned 0x0
[0090.079] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9uzbi.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.079] GetLastError () returned 0x0
[0090.079] GetFileType (hFile=0x220) returned 0x1
[0090.079] GetFileType (hFile=0x220) returned 0x1
[0090.079] ReadFile (in: hFile=0x220, lpBuffer=0x2628a64, nNumberOfBytesToRead=0x136b3, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2628a64*, lpNumberOfBytesRead=0x39ec18*=0x136b3, lpOverlapped=0x0) returned 1
[0090.080] GetLastError () returned 0x0
[0090.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf", lpFilePart=0x0) returned 0x38
[0090.099] GetLastError () returned 0x0
[0090.099] SetErrorMode (uMode=0x1) returned 0x0
[0090.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9uzbi.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.100] GetLastError () returned 0xb7
[0090.100] GetFileType (hFile=0x220) returned 0x1
[0090.100] GetFileType (hFile=0x220) returned 0x1
[0090.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf", lpFilePart=0x0) returned 0x38
[0090.101] GetLastError () returned 0xb7
[0090.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf.LanRan2.0.5", lpFilePart=0x0) returned 0x44
[0090.101] GetLastError () returned 0xb7
[0090.101] SetErrorMode (uMode=0x1) returned 0x0
[0090.101] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9uzbi.pdf"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4aba1a80, ftCreationTime.dwHighDateTime=0x1d3a973, ftLastAccessTime.dwLowDateTime=0xb6cb6e20, ftLastAccessTime.dwHighDateTime=0x1d3abd7, ftLastWriteTime.dwLowDateTime=0x48b1100, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x136c0)) returned 1
[0090.101] GetLastError () returned 0xb7
[0090.101] SetErrorMode (uMode=0x0) returned 0x1
[0090.101] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9uzbi.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9uzbi.pdf.lanran2.0.5")) returned 1
[0090.102] GetLastError () returned 0xb7
[0090.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx", lpFilePart=0x0) returned 0x42
[0090.102] GetLastError () returned 0xb7
[0090.102] SetErrorMode (uMode=0x1) returned 0x0
[0090.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_fwwi71jjtryvqn.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.102] GetLastError () returned 0x0
[0090.102] GetFileType (hFile=0x220) returned 0x1
[0090.102] GetFileType (hFile=0x220) returned 0x1
[0090.104] ReadFile (in: hFile=0x220, lpBuffer=0x24f2610, nNumberOfBytesToRead=0x14259, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x24f2610*, lpNumberOfBytesRead=0x39ec18*=0x14259, lpOverlapped=0x0) returned 1
[0090.104] GetLastError () returned 0x0
[0090.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx", lpFilePart=0x0) returned 0x42
[0090.125] GetLastError () returned 0x0
[0090.125] SetErrorMode (uMode=0x1) returned 0x0
[0090.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_fwwi71jjtryvqn.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.126] GetLastError () returned 0xb7
[0090.126] GetFileType (hFile=0x220) returned 0x1
[0090.126] GetFileType (hFile=0x220) returned 0x1
[0090.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx", lpFilePart=0x0) returned 0x42
[0090.127] GetLastError () returned 0xb7
[0090.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x4e
[0090.127] GetLastError () returned 0xb7
[0090.127] SetErrorMode (uMode=0x1) returned 0x0
[0090.127] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_fwwi71jjtryvqn.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9339fe30, ftCreationTime.dwHighDateTime=0x1d3a4df, ftLastAccessTime.dwLowDateTime=0xb6c992d0, ftLastAccessTime.dwHighDateTime=0x1d3a457, ftLastWriteTime.dwLowDateTime=0x48d7260, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x14260)) returned 1
[0090.127] GetLastError () returned 0xb7
[0090.127] SetErrorMode (uMode=0x0) returned 0x1
[0090.127] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_fwwi71jjtryvqn.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_fwwi71jjtryvqn.pptx.lanran2.0.5")) returned 1
[0090.129] GetLastError () returned 0xb7
[0090.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x33
[0090.129] GetLastError () returned 0xb7
[0090.129] SetErrorMode (uMode=0x1) returned 0x0
[0090.129] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.190] GetLastError () returned 0xb7
[0090.191] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.191] SetErrorMode (uMode=0x0) returned 0x1
[0090.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x33
[0090.191] GetLastError () returned 0x12
[0090.191] SetErrorMode (uMode=0x1) returned 0x0
[0090.191] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.192] GetLastError () returned 0x12
[0090.192] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.193] SetErrorMode (uMode=0x0) returned 0x1
[0090.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3b
[0090.193] GetLastError () returned 0x12
[0090.193] SetErrorMode (uMode=0x1) returned 0x0
[0090.193] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.194] GetLastError () returned 0x12
[0090.194] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.194] SetErrorMode (uMode=0x0) returned 0x1
[0090.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3b
[0090.194] GetLastError () returned 0x12
[0090.194] SetErrorMode (uMode=0x1) returned 0x0
[0090.194] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.194] GetLastError () returned 0x12
[0090.194] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.194] SetErrorMode (uMode=0x0) returned 0x1
[0090.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x40
[0090.194] GetLastError () returned 0x12
[0090.194] SetErrorMode (uMode=0x1) returned 0x0
[0090.195] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.198] GetLastError () returned 0x12
[0090.198] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.198] SetErrorMode (uMode=0x0) returned 0x1
[0090.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x40
[0090.198] GetLastError () returned 0x12
[0090.198] SetErrorMode (uMode=0x1) returned 0x0
[0090.198] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.198] GetLastError () returned 0x12
[0090.198] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.198] SetErrorMode (uMode=0x0) returned 0x1
[0090.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x47
[0090.198] GetLastError () returned 0x12
[0090.199] SetErrorMode (uMode=0x1) returned 0x0
[0090.199] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.295] GetLastError () returned 0x12
[0090.295] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.295] SetErrorMode (uMode=0x0) returned 0x1
[0090.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x47
[0090.295] GetLastError () returned 0x12
[0090.295] SetErrorMode (uMode=0x1) returned 0x0
[0090.295] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.295] GetLastError () returned 0x12
[0090.295] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.295] SetErrorMode (uMode=0x0) returned 0x1
[0090.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x46
[0090.295] GetLastError () returned 0x12
[0090.296] SetErrorMode (uMode=0x1) returned 0x0
[0090.296] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.296] GetLastError () returned 0x12
[0090.296] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.296] SetErrorMode (uMode=0x0) returned 0x1
[0090.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x46
[0090.296] GetLastError () returned 0x12
[0090.296] SetErrorMode (uMode=0x1) returned 0x0
[0090.296] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.296] GetLastError () returned 0x12
[0090.296] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.296] SetErrorMode (uMode=0x0) returned 0x1
[0090.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x4c
[0090.296] GetLastError () returned 0x12
[0090.296] SetErrorMode (uMode=0x1) returned 0x0
[0090.297] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.345] GetLastError () returned 0x12
[0090.346] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.346] SetErrorMode (uMode=0x0) returned 0x1
[0090.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x4c
[0090.346] GetLastError () returned 0x12
[0090.346] SetErrorMode (uMode=0x1) returned 0x0
[0090.346] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.346] GetLastError () returned 0x12
[0090.346] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.346] SetErrorMode (uMode=0x0) returned 0x1
[0090.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", lpFilePart=0x0) returned 0x49
[0090.346] GetLastError () returned 0x12
[0090.347] SetErrorMode (uMode=0x1) returned 0x0
[0090.347] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.347] GetLastError () returned 0x12
[0090.347] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.347] SetErrorMode (uMode=0x0) returned 0x1
[0090.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", lpFilePart=0x0) returned 0x49
[0090.347] GetLastError () returned 0x12
[0090.347] SetErrorMode (uMode=0x1) returned 0x0
[0090.347] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.347] GetLastError () returned 0x12
[0090.347] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.347] SetErrorMode (uMode=0x0) returned 0x1
[0090.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", lpFilePart=0x0) returned 0x52
[0090.347] GetLastError () returned 0x12
[0090.347] SetErrorMode (uMode=0x1) returned 0x0
[0090.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.348] GetLastError () returned 0x12
[0090.348] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.348] SetErrorMode (uMode=0x0) returned 0x1
[0090.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", lpFilePart=0x0) returned 0x52
[0090.348] GetLastError () returned 0x12
[0090.348] SetErrorMode (uMode=0x1) returned 0x0
[0090.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.349] GetLastError () returned 0x12
[0090.349] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.349] SetErrorMode (uMode=0x0) returned 0x1
[0090.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x40
[0090.349] GetLastError () returned 0x12
[0090.349] SetErrorMode (uMode=0x1) returned 0x0
[0090.349] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.349] GetLastError () returned 0x12
[0090.349] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.350] SetErrorMode (uMode=0x0) returned 0x1
[0090.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x40
[0090.350] GetLastError () returned 0x12
[0090.350] SetErrorMode (uMode=0x1) returned 0x0
[0090.350] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.350] GetLastError () returned 0x12
[0090.350] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.350] SetErrorMode (uMode=0x0) returned 0x1
[0090.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x4b
[0090.350] GetLastError () returned 0x12
[0090.350] SetErrorMode (uMode=0x1) returned 0x0
[0090.350] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.351] GetLastError () returned 0x12
[0090.351] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.351] SetErrorMode (uMode=0x0) returned 0x1
[0090.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x4b
[0090.351] GetLastError () returned 0x12
[0090.351] SetErrorMode (uMode=0x1) returned 0x0
[0090.351] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.351] GetLastError () returned 0x12
[0090.351] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.351] SetErrorMode (uMode=0x0) returned 0x1
[0090.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", lpFilePart=0x0) returned 0x54
[0090.352] GetLastError () returned 0x12
[0090.352] SetErrorMode (uMode=0x1) returned 0x0
[0090.352] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.361] GetLastError () returned 0x12
[0090.361] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.361] SetErrorMode (uMode=0x0) returned 0x1
[0090.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", lpFilePart=0x0) returned 0x54
[0090.361] GetLastError () returned 0x12
[0090.361] SetErrorMode (uMode=0x1) returned 0x0
[0090.362] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.362] GetLastError () returned 0x12
[0090.362] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.362] SetErrorMode (uMode=0x0) returned 0x1
[0090.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x3e
[0090.362] GetLastError () returned 0x12
[0090.362] SetErrorMode (uMode=0x1) returned 0x0
[0090.362] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.362] GetLastError () returned 0x12
[0090.362] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.362] SetErrorMode (uMode=0x0) returned 0x1
[0090.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x3e
[0090.362] GetLastError () returned 0x12
[0090.362] SetErrorMode (uMode=0x1) returned 0x0
[0090.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.363] GetLastError () returned 0x12
[0090.363] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.363] SetErrorMode (uMode=0x0) returned 0x1
[0090.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x3f
[0090.363] GetLastError () returned 0x12
[0090.363] SetErrorMode (uMode=0x1) returned 0x0
[0090.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.363] GetLastError () returned 0x12
[0090.363] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.363] SetErrorMode (uMode=0x0) returned 0x1
[0090.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x3f
[0090.363] GetLastError () returned 0x12
[0090.363] SetErrorMode (uMode=0x1) returned 0x0
[0090.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.364] GetLastError () returned 0x12
[0090.364] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.364] SetErrorMode (uMode=0x0) returned 0x1
[0090.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4c
[0090.364] GetLastError () returned 0x12
[0090.364] SetErrorMode (uMode=0x1) returned 0x0
[0090.364] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.364] GetLastError () returned 0x12
[0090.364] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.364] SetErrorMode (uMode=0x0) returned 0x1
[0090.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4c
[0090.364] GetLastError () returned 0x12
[0090.364] SetErrorMode (uMode=0x1) returned 0x0
[0090.364] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.364] GetLastError () returned 0x12
[0090.364] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.365] SetErrorMode (uMode=0x0) returned 0x1
[0090.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x41
[0090.365] GetLastError () returned 0x12
[0090.365] SetErrorMode (uMode=0x1) returned 0x0
[0090.365] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.365] GetLastError () returned 0x12
[0090.365] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.365] SetErrorMode (uMode=0x0) returned 0x1
[0090.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x41
[0090.365] GetLastError () returned 0x12
[0090.365] SetErrorMode (uMode=0x1) returned 0x0
[0090.365] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.365] GetLastError () returned 0x12
[0090.365] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.365] SetErrorMode (uMode=0x0) returned 0x1
[0090.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x38
[0090.365] GetLastError () returned 0x12
[0090.366] SetErrorMode (uMode=0x1) returned 0x0
[0090.366] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.366] GetLastError () returned 0x12
[0090.366] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.366] SetErrorMode (uMode=0x0) returned 0x1
[0090.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x38
[0090.366] GetLastError () returned 0x12
[0090.366] SetErrorMode (uMode=0x1) returned 0x0
[0090.366] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.366] GetLastError () returned 0x12
[0090.366] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.367] SetErrorMode (uMode=0x0) returned 0x1
[0090.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x5f
[0090.367] GetLastError () returned 0x12
[0090.367] SetErrorMode (uMode=0x1) returned 0x0
[0090.367] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.367] GetLastError () returned 0x12
[0090.367] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.367] SetErrorMode (uMode=0x0) returned 0x1
[0090.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x5f
[0090.367] GetLastError () returned 0x12
[0090.367] SetErrorMode (uMode=0x1) returned 0x0
[0090.367] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.367] GetLastError () returned 0x12
[0090.367] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.367] SetErrorMode (uMode=0x0) returned 0x1
[0090.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x38
[0090.368] GetLastError () returned 0x12
[0090.368] SetErrorMode (uMode=0x1) returned 0x0
[0090.368] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.368] GetLastError () returned 0x12
[0090.368] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.368] SetErrorMode (uMode=0x0) returned 0x1
[0090.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x38
[0090.368] GetLastError () returned 0x12
[0090.368] SetErrorMode (uMode=0x1) returned 0x0
[0090.368] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.368] GetLastError () returned 0x12
[0090.368] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.369] SetErrorMode (uMode=0x0) returned 0x1
[0090.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x45
[0090.369] GetLastError () returned 0x12
[0090.369] SetErrorMode (uMode=0x1) returned 0x0
[0090.369] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.369] GetLastError () returned 0x12
[0090.369] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.369] SetErrorMode (uMode=0x0) returned 0x1
[0090.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x45
[0090.369] GetLastError () returned 0x12
[0090.369] SetErrorMode (uMode=0x1) returned 0x0
[0090.369] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.369] GetLastError () returned 0x12
[0090.369] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.369] SetErrorMode (uMode=0x0) returned 0x1
[0090.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpFilePart=0x0) returned 0x54
[0090.370] GetLastError () returned 0x12
[0090.370] SetErrorMode (uMode=0x1) returned 0x0
[0090.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.370] GetLastError () returned 0x12
[0090.370] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.370] SetErrorMode (uMode=0x0) returned 0x1
[0090.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpFilePart=0x0) returned 0x54
[0090.370] GetLastError () returned 0x12
[0090.370] SetErrorMode (uMode=0x1) returned 0x0
[0090.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.371] GetLastError () returned 0x12
[0090.371] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.371] SetErrorMode (uMode=0x0) returned 0x1
[0090.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", lpFilePart=0x0) returned 0x5d
[0090.371] GetLastError () returned 0x12
[0090.371] SetErrorMode (uMode=0x1) returned 0x0
[0090.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.373] GetLastError () returned 0x12
[0090.373] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.374] SetErrorMode (uMode=0x0) returned 0x1
[0090.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", lpFilePart=0x0) returned 0x5d
[0090.374] GetLastError () returned 0x12
[0090.374] SetErrorMode (uMode=0x1) returned 0x0
[0090.374] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.374] GetLastError () returned 0x12
[0090.374] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.374] SetErrorMode (uMode=0x0) returned 0x1
[0090.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x54
[0090.374] GetLastError () returned 0x12
[0090.374] SetErrorMode (uMode=0x1) returned 0x0
[0090.374] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.375] GetLastError () returned 0x12
[0090.375] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.375] SetErrorMode (uMode=0x0) returned 0x1
[0090.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x54
[0090.375] GetLastError () returned 0x12
[0090.375] SetErrorMode (uMode=0x1) returned 0x0
[0090.375] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.375] GetLastError () returned 0x12
[0090.375] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.375] SetErrorMode (uMode=0x0) returned 0x1
[0090.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x5c
[0090.375] GetLastError () returned 0x12
[0090.375] SetErrorMode (uMode=0x1) returned 0x0
[0090.375] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.376] GetLastError () returned 0x12
[0090.376] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.376] SetErrorMode (uMode=0x0) returned 0x1
[0090.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x5c
[0090.376] GetLastError () returned 0x12
[0090.376] SetErrorMode (uMode=0x1) returned 0x0
[0090.376] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.376] GetLastError () returned 0x12
[0090.377] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.377] SetErrorMode (uMode=0x0) returned 0x1
[0090.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x68
[0090.377] GetLastError () returned 0x12
[0090.377] SetErrorMode (uMode=0x1) returned 0x0
[0090.377] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.377] GetLastError () returned 0x12
[0090.377] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.378] SetErrorMode (uMode=0x0) returned 0x1
[0090.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x68
[0090.378] GetLastError () returned 0x12
[0090.378] SetErrorMode (uMode=0x1) returned 0x0
[0090.378] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.378] GetLastError () returned 0x12
[0090.378] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.378] SetErrorMode (uMode=0x0) returned 0x1
[0090.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x39e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x6c
[0090.378] GetLastError () returned 0x12
[0090.378] SetErrorMode (uMode=0x1) returned 0x0
[0090.378] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.378] GetLastError () returned 0x12
[0090.378] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.378] SetErrorMode (uMode=0x0) returned 0x1
[0090.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x39e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x6c
[0090.379] GetLastError () returned 0x12
[0090.379] SetErrorMode (uMode=0x1) returned 0x0
[0090.379] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.379] GetLastError () returned 0x12
[0090.379] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.379] SetErrorMode (uMode=0x0) returned 0x1
[0090.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x37
[0090.379] GetLastError () returned 0x12
[0090.379] SetErrorMode (uMode=0x1) returned 0x0
[0090.379] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.379] GetLastError () returned 0x12
[0090.379] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.379] SetErrorMode (uMode=0x0) returned 0x1
[0090.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x37
[0090.379] GetLastError () returned 0x12
[0090.379] SetErrorMode (uMode=0x1) returned 0x0
[0090.380] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.380] GetLastError () returned 0x12
[0090.380] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.380] SetErrorMode (uMode=0x0) returned 0x1
[0090.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x3e
[0090.380] GetLastError () returned 0x12
[0090.380] SetErrorMode (uMode=0x1) returned 0x0
[0090.380] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.381] GetLastError () returned 0x12
[0090.381] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.381] SetErrorMode (uMode=0x0) returned 0x1
[0090.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x3e
[0090.381] GetLastError () returned 0x12
[0090.381] SetErrorMode (uMode=0x1) returned 0x0
[0090.381] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.381] GetLastError () returned 0x12
[0090.381] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.381] SetErrorMode (uMode=0x0) returned 0x1
[0090.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x43
[0090.381] GetLastError () returned 0x12
[0090.381] SetErrorMode (uMode=0x1) returned 0x0
[0090.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.382] GetLastError () returned 0x12
[0090.382] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.382] SetErrorMode (uMode=0x0) returned 0x1
[0090.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x43
[0090.382] GetLastError () returned 0x12
[0090.382] SetErrorMode (uMode=0x1) returned 0x0
[0090.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.382] GetLastError () returned 0x12
[0090.382] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.382] SetErrorMode (uMode=0x0) returned 0x1
[0090.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x3e
[0090.382] GetLastError () returned 0x12
[0090.382] SetErrorMode (uMode=0x1) returned 0x0
[0090.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.383] GetLastError () returned 0x12
[0090.383] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.383] SetErrorMode (uMode=0x0) returned 0x1
[0090.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x3e
[0090.383] GetLastError () returned 0x12
[0090.383] SetErrorMode (uMode=0x1) returned 0x0
[0090.383] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.383] GetLastError () returned 0x12
[0090.383] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.383] SetErrorMode (uMode=0x0) returned 0x1
[0090.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x42
[0090.383] GetLastError () returned 0x12
[0090.383] SetErrorMode (uMode=0x1) returned 0x0
[0090.383] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.384] GetLastError () returned 0x12
[0090.384] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.384] SetErrorMode (uMode=0x0) returned 0x1
[0090.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x42
[0090.384] GetLastError () returned 0x12
[0090.384] SetErrorMode (uMode=0x1) returned 0x0
[0090.384] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.384] GetLastError () returned 0x12
[0090.384] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.384] SetErrorMode (uMode=0x0) returned 0x1
[0090.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x71
[0090.384] GetLastError () returned 0x12
[0090.384] SetErrorMode (uMode=0x1) returned 0x0
[0090.384] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.394] GetLastError () returned 0x12
[0090.394] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.394] SetErrorMode (uMode=0x0) returned 0x1
[0090.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x71
[0090.394] GetLastError () returned 0x12
[0090.394] SetErrorMode (uMode=0x1) returned 0x0
[0090.394] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470
[0090.395] GetLastError () returned 0x12
[0090.395] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1
[0090.396] SetErrorMode (uMode=0x0) returned 0x1
[0090.426] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFilePart=0x0) returned 0xb7
[0090.426] GetLastError () returned 0x12
[0090.426] SetErrorMode (uMode=0x1) returned 0x0
[0090.426] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.427] GetLastError () returned 0x0
[0090.427] GetFileType (hFile=0x220) returned 0x1
[0090.427] SetErrorMode (uMode=0x0) returned 0x1
[0090.427] GetFileType (hFile=0x220) returned 0x1
[0090.428] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x39eaf0 | out: lpFileSizeHigh=0x39eaf0*=0x0) returned 0x2d
[0090.428] GetLastError () returned 0x0
[0090.428] ReadFile (in: hFile=0x220, lpBuffer=0x25ee5b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x25ee5b8*, lpNumberOfBytesRead=0x39ea98*=0x2d, lpOverlapped=0x0) returned 1
[0090.428] GetLastError () returned 0x0
[0090.428] CloseHandle (hObject=0x220) returned 1
[0090.428] GetLastError () returned 0x0
[0090.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFilePart=0x0) returned 0xb7
[0090.482] GetLastError () returned 0x0
[0090.483] SetErrorMode (uMode=0x1) returned 0x0
[0090.483] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
[0090.483] GetLastError () returned 0x5
[0090.484] SetErrorMode (uMode=0x0) returned 0x1
[0090.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFilePart=0x0) returned 0xb7
[0090.485] GetLastError () returned 0x5
[0090.485] SetErrorMode (uMode=0x1) returned 0x0
[0090.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.486] GetLastError () returned 0x0
[0090.486] GetFileType (hFile=0x220) returned 0x1
[0090.486] GetFileType (hFile=0x220) returned 0x1
[0090.486] ReadFile (in: hFile=0x220, lpBuffer=0x2678070, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2678070*, lpNumberOfBytesRead=0x39ea98*=0x57, lpOverlapped=0x0) returned 1
[0090.486] GetLastError () returned 0x0
[0090.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFilePart=0x0) returned 0xb7
[0090.512] GetLastError () returned 0x0
[0090.512] SetErrorMode (uMode=0x1) returned 0x0
[0090.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
[0090.513] GetLastError () returned 0x5
[0090.514] SetErrorMode (uMode=0x0) returned 0x1
[0090.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFilePart=0x0) returned 0xb7
[0090.514] GetLastError () returned 0x5
[0090.514] SetErrorMode (uMode=0x1) returned 0x0
[0090.514] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.515] GetLastError () returned 0x0
[0090.515] GetFileType (hFile=0x220) returned 0x1
[0090.515] GetFileType (hFile=0x220) returned 0x1
[0090.515] ReadFile (in: hFile=0x220, lpBuffer=0x25039e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x25039e8*, lpNumberOfBytesRead=0x39ea98*=0x3d, lpOverlapped=0x0) returned 1
[0090.516] GetLastError () returned 0x0
[0090.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFilePart=0x0) returned 0xb7
[0090.539] GetLastError () returned 0x0
[0090.539] SetErrorMode (uMode=0x1) returned 0x0
[0090.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
[0090.539] GetLastError () returned 0x5
[0090.540] SetErrorMode (uMode=0x0) returned 0x1
[0090.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x50
[0090.540] GetLastError () returned 0x5
[0090.540] SetErrorMode (uMode=0x1) returned 0x0
[0090.540] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.541] GetLastError () returned 0x5
[0090.541] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.541] SetErrorMode (uMode=0x0) returned 0x1
[0090.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x50
[0090.541] GetLastError () returned 0x12
[0090.541] SetErrorMode (uMode=0x1) returned 0x0
[0090.541] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.541] GetLastError () returned 0x12
[0090.541] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.541] SetErrorMode (uMode=0x0) returned 0x1
[0090.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x55
[0090.541] GetLastError () returned 0x12
[0090.541] SetErrorMode (uMode=0x1) returned 0x0
[0090.541] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.541] GetLastError () returned 0x12
[0090.541] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.542] SetErrorMode (uMode=0x0) returned 0x1
[0090.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x55
[0090.542] GetLastError () returned 0x12
[0090.542] SetErrorMode (uMode=0x1) returned 0x0
[0090.542] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.542] GetLastError () returned 0x12
[0090.542] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.542] SetErrorMode (uMode=0x0) returned 0x1
[0090.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", lpFilePart=0x0) returned 0x58
[0090.542] GetLastError () returned 0x12
[0090.542] SetErrorMode (uMode=0x1) returned 0x0
[0090.542] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.543] GetLastError () returned 0x12
[0090.543] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.543] SetErrorMode (uMode=0x0) returned 0x1
[0090.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", lpFilePart=0x0) returned 0x58
[0090.543] GetLastError () returned 0x12
[0090.543] SetErrorMode (uMode=0x1) returned 0x0
[0090.543] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.543] GetLastError () returned 0x12
[0090.543] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.543] SetErrorMode (uMode=0x0) returned 0x1
[0090.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x3d
[0090.543] GetLastError () returned 0x12
[0090.543] SetErrorMode (uMode=0x1) returned 0x0
[0090.543] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.544] GetLastError () returned 0x12
[0090.544] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.544] SetErrorMode (uMode=0x0) returned 0x1
[0090.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x3d
[0090.544] GetLastError () returned 0x12
[0090.544] SetErrorMode (uMode=0x1) returned 0x0
[0090.544] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.544] GetLastError () returned 0x12
[0090.544] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.544] SetErrorMode (uMode=0x0) returned 0x1
[0090.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x45
[0090.544] GetLastError () returned 0x12
[0090.544] SetErrorMode (uMode=0x1) returned 0x0
[0090.544] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.544] GetLastError () returned 0x12
[0090.544] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.544] SetErrorMode (uMode=0x0) returned 0x1
[0090.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x45
[0090.545] GetLastError () returned 0x12
[0090.545] SetErrorMode (uMode=0x1) returned 0x0
[0090.545] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.545] GetLastError () returned 0x12
[0090.545] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.545] SetErrorMode (uMode=0x0) returned 0x1
[0090.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3d
[0090.545] GetLastError () returned 0x12
[0090.545] SetErrorMode (uMode=0x1) returned 0x0
[0090.545] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.546] GetLastError () returned 0x12
[0090.546] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.546] SetErrorMode (uMode=0x0) returned 0x1
[0090.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3d
[0090.546] GetLastError () returned 0x12
[0090.546] SetErrorMode (uMode=0x1) returned 0x0
[0090.546] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.546] GetLastError () returned 0x12
[0090.546] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.546] SetErrorMode (uMode=0x0) returned 0x1
[0090.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3e
[0090.546] GetLastError () returned 0x12
[0090.546] SetErrorMode (uMode=0x1) returned 0x0
[0090.546] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.547] GetLastError () returned 0x12
[0090.547] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.547] SetErrorMode (uMode=0x0) returned 0x1
[0090.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3e
[0090.547] GetLastError () returned 0x12
[0090.547] SetErrorMode (uMode=0x1) returned 0x0
[0090.547] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.547] GetLastError () returned 0x12
[0090.547] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.547] SetErrorMode (uMode=0x0) returned 0x1
[0090.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3f
[0090.547] GetLastError () returned 0x12
[0090.547] SetErrorMode (uMode=0x1) returned 0x0
[0090.547] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.548] GetLastError () returned 0x12
[0090.548] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.548] SetErrorMode (uMode=0x0) returned 0x1
[0090.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3f
[0090.548] GetLastError () returned 0x12
[0090.548] SetErrorMode (uMode=0x1) returned 0x0
[0090.548] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.548] GetLastError () returned 0x12
[0090.548] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.548] SetErrorMode (uMode=0x0) returned 0x1
[0090.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3f
[0090.548] GetLastError () returned 0x12
[0090.548] SetErrorMode (uMode=0x1) returned 0x0
[0090.548] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.549] GetLastError () returned 0x12
[0090.549] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.549] SetErrorMode (uMode=0x0) returned 0x1
[0090.549] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3f
[0090.549] GetLastError () returned 0x12
[0090.549] SetErrorMode (uMode=0x1) returned 0x0
[0090.549] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.549] GetLastError () returned 0x12
[0090.549] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.549] SetErrorMode (uMode=0x0) returned 0x1
[0090.549] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x49
[0090.549] GetLastError () returned 0x12
[0090.549] SetErrorMode (uMode=0x1) returned 0x0
[0090.549] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.549] GetLastError () returned 0x12
[0090.550] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.550] SetErrorMode (uMode=0x0) returned 0x1
[0090.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x49
[0090.550] GetLastError () returned 0x12
[0090.550] SetErrorMode (uMode=0x1) returned 0x0
[0090.550] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.550] GetLastError () returned 0x12
[0090.550] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.550] SetErrorMode (uMode=0x0) returned 0x1
[0090.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x56
[0090.550] GetLastError () returned 0x12
[0090.550] SetErrorMode (uMode=0x1) returned 0x0
[0090.550] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.550] GetLastError () returned 0x12
[0090.550] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.550] SetErrorMode (uMode=0x0) returned 0x1
[0090.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x56
[0090.550] GetLastError () returned 0x12
[0090.550] SetErrorMode (uMode=0x1) returned 0x0
[0090.551] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.551] GetLastError () returned 0x12
[0090.551] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.551] SetErrorMode (uMode=0x0) returned 0x1
[0090.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x62
[0090.551] GetLastError () returned 0x12
[0090.551] SetErrorMode (uMode=0x1) returned 0x0
[0090.551] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.551] GetLastError () returned 0x12
[0090.551] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.551] SetErrorMode (uMode=0x0) returned 0x1
[0090.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x62
[0090.551] GetLastError () returned 0x12
[0090.551] SetErrorMode (uMode=0x1) returned 0x0
[0090.551] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.551] GetLastError () returned 0x12
[0090.551] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.551] SetErrorMode (uMode=0x0) returned 0x1
[0090.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x77
[0090.552] GetLastError () returned 0x12
[0090.552] SetErrorMode (uMode=0x1) returned 0x0
[0090.552] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.552] GetLastError () returned 0x12
[0090.552] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.552] SetErrorMode (uMode=0x0) returned 0x1
[0090.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x77
[0090.552] GetLastError () returned 0x12
[0090.552] SetErrorMode (uMode=0x1) returned 0x0
[0090.552] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.552] GetLastError () returned 0x12
[0090.552] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.552] SetErrorMode (uMode=0x0) returned 0x1
[0090.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x6a
[0090.553] GetLastError () returned 0x12
[0090.553] SetErrorMode (uMode=0x1) returned 0x0
[0090.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.553] GetLastError () returned 0x12
[0090.553] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.553] SetErrorMode (uMode=0x0) returned 0x1
[0090.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x6a
[0090.553] GetLastError () returned 0x12
[0090.553] SetErrorMode (uMode=0x1) returned 0x0
[0090.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.553] GetLastError () returned 0x12
[0090.553] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.553] SetErrorMode (uMode=0x0) returned 0x1
[0090.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x52
[0090.553] GetLastError () returned 0x12
[0090.553] SetErrorMode (uMode=0x1) returned 0x0
[0090.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.555] GetLastError () returned 0x12
[0090.555] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.555] SetErrorMode (uMode=0x0) returned 0x1
[0090.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x52
[0090.555] GetLastError () returned 0x12
[0090.555] SetErrorMode (uMode=0x1) returned 0x0
[0090.555] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.555] GetLastError () returned 0x12
[0090.555] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.555] SetErrorMode (uMode=0x0) returned 0x1
[0090.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x56
[0090.555] GetLastError () returned 0x12
[0090.555] SetErrorMode (uMode=0x1) returned 0x0
[0090.555] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.556] GetLastError () returned 0x12
[0090.556] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.556] SetErrorMode (uMode=0x0) returned 0x1
[0090.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x56
[0090.556] GetLastError () returned 0x12
[0090.556] SetErrorMode (uMode=0x1) returned 0x0
[0090.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.556] GetLastError () returned 0x12
[0090.556] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.556] SetErrorMode (uMode=0x0) returned 0x1
[0090.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0", lpFilePart=0x0) returned 0x5f
[0090.556] GetLastError () returned 0x12
[0090.556] SetErrorMode (uMode=0x1) returned 0x0
[0090.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.557] GetLastError () returned 0x12
[0090.557] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.557] SetErrorMode (uMode=0x0) returned 0x1
[0090.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0", lpFilePart=0x0) returned 0x5f
[0090.557] GetLastError () returned 0x12
[0090.557] SetErrorMode (uMode=0x1) returned 0x0
[0090.557] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.557] GetLastError () returned 0x12
[0090.558] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.558] SetErrorMode (uMode=0x0) returned 0x1
[0090.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR", lpFilePart=0x0) returned 0x5f
[0090.558] GetLastError () returned 0x12
[0090.558] SetErrorMode (uMode=0x1) returned 0x0
[0090.558] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.558] GetLastError () returned 0x12
[0090.558] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.558] SetErrorMode (uMode=0x0) returned 0x1
[0090.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR", lpFilePart=0x0) returned 0x5f
[0090.558] GetLastError () returned 0x12
[0090.558] SetErrorMode (uMode=0x1) returned 0x0
[0090.558] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.558] GetLastError () returned 0x12
[0090.558] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.558] SetErrorMode (uMode=0x0) returned 0x1
[0090.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC", lpFilePart=0x0) returned 0x5f
[0090.558] GetLastError () returned 0x12
[0090.559] SetErrorMode (uMode=0x1) returned 0x0
[0090.559] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.559] GetLastError () returned 0x12
[0090.559] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.559] SetErrorMode (uMode=0x0) returned 0x1
[0090.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC", lpFilePart=0x0) returned 0x5f
[0090.559] GetLastError () returned 0x12
[0090.559] SetErrorMode (uMode=0x1) returned 0x0
[0090.559] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.559] GetLastError () returned 0x12
[0090.559] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.559] SetErrorMode (uMode=0x0) returned 0x1
[0090.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E", lpFilePart=0x0) returned 0x5f
[0090.559] GetLastError () returned 0x12
[0090.559] SetErrorMode (uMode=0x1) returned 0x0
[0090.559] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.560] GetLastError () returned 0x12
[0090.560] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.560] SetErrorMode (uMode=0x0) returned 0x1
[0090.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E", lpFilePart=0x0) returned 0x5f
[0090.560] GetLastError () returned 0x12
[0090.560] SetErrorMode (uMode=0x1) returned 0x0
[0090.560] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.560] GetLastError () returned 0x12
[0090.560] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.560] SetErrorMode (uMode=0x0) returned 0x1
[0090.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x3b
[0090.560] GetLastError () returned 0x12
[0090.560] SetErrorMode (uMode=0x1) returned 0x0
[0090.560] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.560] GetLastError () returned 0x12
[0090.560] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.561] SetErrorMode (uMode=0x0) returned 0x1
[0090.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x3b
[0090.561] GetLastError () returned 0x12
[0090.561] SetErrorMode (uMode=0x1) returned 0x0
[0090.561] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.561] GetLastError () returned 0x12
[0090.561] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.561] SetErrorMode (uMode=0x0) returned 0x1
[0090.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x42
[0090.561] GetLastError () returned 0x12
[0090.561] SetErrorMode (uMode=0x1) returned 0x0
[0090.561] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.562] GetLastError () returned 0x12
[0090.562] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.562] SetErrorMode (uMode=0x0) returned 0x1
[0090.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x42
[0090.562] GetLastError () returned 0x12
[0090.562] SetErrorMode (uMode=0x1) returned 0x0
[0090.562] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.562] GetLastError () returned 0x12
[0090.562] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.562] SetErrorMode (uMode=0x0) returned 0x1
[0090.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14", lpFilePart=0x0) returned 0x45
[0090.562] GetLastError () returned 0x12
[0090.562] SetErrorMode (uMode=0x1) returned 0x0
[0090.562] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.563] GetLastError () returned 0x12
[0090.563] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.563] SetErrorMode (uMode=0x0) returned 0x1
[0090.563] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14", lpFilePart=0x0) returned 0x45
[0090.563] GetLastError () returned 0x12
[0090.563] SetErrorMode (uMode=0x1) returned 0x0
[0090.564] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.564] GetLastError () returned 0x12
[0090.564] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.564] SetErrorMode (uMode=0x0) returned 0x1
[0090.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033", lpFilePart=0x0) returned 0x4a
[0090.564] GetLastError () returned 0x12
[0090.564] SetErrorMode (uMode=0x1) returned 0x0
[0090.564] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.565] GetLastError () returned 0x12
[0090.565] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.565] SetErrorMode (uMode=0x0) returned 0x1
[0090.565] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033", lpFilePart=0x0) returned 0x4a
[0090.565] GetLastError () returned 0x12
[0090.566] SetErrorMode (uMode=0x1) returned 0x0
[0090.566] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.566] GetLastError () returned 0x12
[0090.566] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.566] SetErrorMode (uMode=0x0) returned 0x1
[0090.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x3f
[0090.566] GetLastError () returned 0x12
[0090.566] SetErrorMode (uMode=0x1) returned 0x0
[0090.566] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.566] GetLastError () returned 0x12
[0090.567] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.567] SetErrorMode (uMode=0x0) returned 0x1
[0090.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x3f
[0090.567] GetLastError () returned 0x12
[0090.567] SetErrorMode (uMode=0x1) returned 0x0
[0090.567] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.567] GetLastError () returned 0x12
[0090.567] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.567] SetErrorMode (uMode=0x0) returned 0x1
[0090.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x4b
[0090.567] GetLastError () returned 0x12
[0090.567] SetErrorMode (uMode=0x1) returned 0x0
[0090.567] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.568] GetLastError () returned 0x12
[0090.568] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.568] SetErrorMode (uMode=0x0) returned 0x1
[0090.568] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x4b
[0090.568] GetLastError () returned 0x12
[0090.568] SetErrorMode (uMode=0x1) returned 0x0
[0090.568] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.568] GetLastError () returned 0x12
[0090.568] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.568] SetErrorMode (uMode=0x0) returned 0x1
[0090.568] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpFilePart=0x0) returned 0x4f
[0090.568] GetLastError () returned 0x12
[0090.568] SetErrorMode (uMode=0x1) returned 0x0
[0090.568] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.569] GetLastError () returned 0x12
[0090.569] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.569] SetErrorMode (uMode=0x0) returned 0x1
[0090.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpFilePart=0x0) returned 0x4f
[0090.569] GetLastError () returned 0x12
[0090.569] SetErrorMode (uMode=0x1) returned 0x0
[0090.569] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.569] GetLastError () returned 0x12
[0090.569] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.569] SetErrorMode (uMode=0x0) returned 0x1
[0090.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpFilePart=0x0) returned 0x5a
[0090.569] GetLastError () returned 0x12
[0090.569] SetErrorMode (uMode=0x1) returned 0x0
[0090.569] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.570] GetLastError () returned 0x12
[0090.570] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.570] SetErrorMode (uMode=0x0) returned 0x1
[0090.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpFilePart=0x0) returned 0x5a
[0090.570] GetLastError () returned 0x12
[0090.570] SetErrorMode (uMode=0x1) returned 0x0
[0090.570] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.570] GetLastError () returned 0x12
[0090.570] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.570] SetErrorMode (uMode=0x0) returned 0x1
[0090.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x3e
[0090.570] GetLastError () returned 0x12
[0090.570] SetErrorMode (uMode=0x1) returned 0x0
[0090.571] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.582] GetLastError () returned 0x12
[0090.582] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.583] SetErrorMode (uMode=0x0) returned 0x1
[0090.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x3e
[0090.583] GetLastError () returned 0x12
[0090.583] SetErrorMode (uMode=0x1) returned 0x0
[0090.583] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.583] GetLastError () returned 0x12
[0090.583] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.583] SetErrorMode (uMode=0x0) returned 0x1
[0090.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpFilePart=0x0) returned 0x45
[0090.583] GetLastError () returned 0x12
[0090.583] SetErrorMode (uMode=0x1) returned 0x0
[0090.583] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.584] GetLastError () returned 0x12
[0090.584] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.584] SetErrorMode (uMode=0x0) returned 0x1
[0090.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpFilePart=0x0) returned 0x45
[0090.584] GetLastError () returned 0x12
[0090.584] SetErrorMode (uMode=0x1) returned 0x0
[0090.585] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.585] GetLastError () returned 0x12
[0090.585] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.585] SetErrorMode (uMode=0x0) returned 0x1
[0090.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3f
[0090.585] GetLastError () returned 0x12
[0090.585] SetErrorMode (uMode=0x1) returned 0x0
[0090.585] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.586] GetLastError () returned 0x12
[0090.586] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.586] SetErrorMode (uMode=0x0) returned 0x1
[0090.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3f
[0090.586] GetLastError () returned 0x12
[0090.586] SetErrorMode (uMode=0x1) returned 0x0
[0090.586] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0090.587] GetLastError () returned 0x12
[0090.587] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0090.587] SetErrorMode (uMode=0x0) returned 0x1
[0090.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", lpFilePart=0x0) returned 0x4b
[0090.587] GetLastError () returned 0x12
[0090.587] SetErrorMode (uMode=0x1) returned 0x0
[0090.587] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.587] GetLastError () returned 0x0
[0090.587] GetFileType (hFile=0x220) returned 0x1
[0090.587] GetFileType (hFile=0x220) returned 0x1
[0090.587] ReadFile (in: hFile=0x220, lpBuffer=0x25b0ab8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25b0ab8*, lpNumberOfBytesRead=0x39eb58*=0x9a2, lpOverlapped=0x0) returned 1
[0090.598] GetLastError () returned 0x0
[0090.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", lpFilePart=0x0) returned 0x4b
[0090.623] GetLastError () returned 0x0
[0090.623] SetErrorMode (uMode=0x1) returned 0x0
[0090.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.624] GetLastError () returned 0xb7
[0090.624] GetFileType (hFile=0x220) returned 0x1
[0090.624] GetFileType (hFile=0x220) returned 0x1
[0090.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", lpFilePart=0x0) returned 0x4b
[0090.624] GetLastError () returned 0xb7
[0090.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.LanRan2.0.5", lpFilePart=0x0) returned 0x57
[0090.624] GetLastError () returned 0xb7
[0090.624] SetErrorMode (uMode=0x1) returned 0x0
[0090.625] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4d99e60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x9b0)) returned 1
[0090.625] GetLastError () returned 0xb7
[0090.625] SetErrorMode (uMode=0x0) returned 0x1
[0090.625] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.lanran2.0.5")) returned 1
[0090.625] GetLastError () returned 0xb7
[0090.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", lpFilePart=0x0) returned 0x42
[0090.625] GetLastError () returned 0xb7
[0090.625] SetErrorMode (uMode=0x1) returned 0x0
[0090.625] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c5b0
[0090.626] GetLastError () returned 0xb7
[0090.626] FindClose (in: hFindFile=0x42c5b0 | out: hFindFile=0x42c5b0) returned 1
[0090.626] SetErrorMode (uMode=0x0) returned 0x1
[0090.626] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", lpFilePart=0x0) returned 0x42
[0090.626] GetLastError () returned 0x12
[0090.627] SetErrorMode (uMode=0x1) returned 0x0
[0090.627] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c5b0
[0090.627] GetLastError () returned 0x12
[0090.627] FindClose (in: hFindFile=0x42c5b0 | out: hFindFile=0x42c5b0) returned 1
[0090.627] SetErrorMode (uMode=0x0) returned 0x1
[0090.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", lpFilePart=0x0) returned 0x3d
[0090.627] GetLastError () returned 0x12
[0090.627] SetErrorMode (uMode=0x1) returned 0x0
[0090.627] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c5b0
[0090.634] GetLastError () returned 0x12
[0090.634] FindClose (in: hFindFile=0x42c5b0 | out: hFindFile=0x42c5b0) returned 1
[0090.634] SetErrorMode (uMode=0x0) returned 0x1
[0090.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", lpFilePart=0x0) returned 0x3d
[0090.634] GetLastError () returned 0x12
[0090.634] SetErrorMode (uMode=0x1) returned 0x0
[0090.634] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c5b0
[0090.634] GetLastError () returned 0x12
[0090.634] FindClose (in: hFindFile=0x42c5b0 | out: hFindFile=0x42c5b0) returned 1
[0090.635] SetErrorMode (uMode=0x0) returned 0x1
[0090.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x3f
[0090.635] GetLastError () returned 0x12
[0090.635] SetErrorMode (uMode=0x1) returned 0x0
[0090.635] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c5b0
[0090.635] GetLastError () returned 0x12
[0090.635] FindClose (in: hFindFile=0x42c5b0 | out: hFindFile=0x42c5b0) returned 1
[0090.635] SetErrorMode (uMode=0x0) returned 0x1
[0090.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x3f
[0090.635] GetLastError () returned 0x12
[0090.635] SetErrorMode (uMode=0x1) returned 0x0
[0090.635] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c5b0
[0090.636] GetLastError () returned 0x12
[0090.636] FindClose (in: hFindFile=0x42c5b0 | out: hFindFile=0x42c5b0) returned 1
[0090.636] SetErrorMode (uMode=0x0) returned 0x1
[0090.636] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST", lpFilePart=0x0) returned 0x48
[0090.636] GetLastError () returned 0x12
[0090.636] SetErrorMode (uMode=0x1) returned 0x0
[0090.636] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\credhist"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.636] GetLastError () returned 0x0
[0090.636] GetFileType (hFile=0x220) returned 0x1
[0090.636] GetFileType (hFile=0x220) returned 0x1
[0090.636] ReadFile (in: hFile=0x220, lpBuffer=0x2640d84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x2640d84*, lpNumberOfBytesRead=0x39eb58*=0xa8, lpOverlapped=0x0) returned 1
[0090.637] GetLastError () returned 0x0
[0090.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST", lpFilePart=0x0) returned 0x48
[0090.666] GetLastError () returned 0x0
[0090.666] SetErrorMode (uMode=0x1) returned 0x0
[0090.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\credhist"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
[0090.667] GetLastError () returned 0x5
[0090.668] SetErrorMode (uMode=0x0) returned 0x1
[0090.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST", lpFilePart=0x0) returned 0x48
[0090.669] GetLastError () returned 0x5
[0090.669] SetErrorMode (uMode=0x1) returned 0x0
[0090.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\synchist"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.669] GetLastError () returned 0x0
[0090.669] GetFileType (hFile=0x220) returned 0x1
[0090.669] GetFileType (hFile=0x220) returned 0x1
[0090.669] ReadFile (in: hFile=0x220, lpBuffer=0x26ca3f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x26ca3f4*, lpNumberOfBytesRead=0x39eb58*=0x4c, lpOverlapped=0x0) returned 1
[0090.670] GetLastError () returned 0x0
[0090.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST", lpFilePart=0x0) returned 0x48
[0090.705] GetLastError () returned 0x0
[0090.705] SetErrorMode (uMode=0x1) returned 0x0
[0090.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\synchist"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
[0090.705] GetLastError () returned 0x5
[0090.707] SetErrorMode (uMode=0x0) returned 0x1
[0090.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x6d
[0090.707] GetLastError () returned 0x5
[0090.707] SetErrorMode (uMode=0x1) returned 0x0
[0090.707] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3b0
[0090.716] GetLastError () returned 0x5
[0090.716] FindClose (in: hFindFile=0x42c3b0 | out: hFindFile=0x42c3b0) returned 1
[0090.716] SetErrorMode (uMode=0x0) returned 0x1
[0090.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x6d
[0090.716] GetLastError () returned 0x12
[0090.716] SetErrorMode (uMode=0x1) returned 0x0
[0090.717] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3b0
[0090.717] GetLastError () returned 0x12
[0090.717] FindClose (in: hFindFile=0x42c3b0 | out: hFindFile=0x42c3b0) returned 1
[0090.719] SetErrorMode (uMode=0x0) returned 0x1
[0090.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", lpFilePart=0x0) returned 0x92
[0090.719] GetLastError () returned 0x12
[0090.719] SetErrorMode (uMode=0x1) returned 0x0
[0090.720] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.721] GetLastError () returned 0x0
[0090.721] GetFileType (hFile=0x220) returned 0x1
[0090.721] GetFileType (hFile=0x220) returned 0x1
[0090.721] ReadFile (in: hFile=0x220, lpBuffer=0x25551e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x25551e4*, lpNumberOfBytesRead=0x39eaf8*=0x1d4, lpOverlapped=0x0) returned 1
[0090.722] GetLastError () returned 0x0
[0090.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", lpFilePart=0x0) returned 0x92
[0090.750] GetLastError () returned 0x0
[0090.750] SetErrorMode (uMode=0x1) returned 0x0
[0090.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
[0090.750] GetLastError () returned 0x5
[0090.751] SetErrorMode (uMode=0x0) returned 0x1
[0090.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred", lpFilePart=0x0) returned 0x77
[0090.751] GetLastError () returned 0x5
[0090.751] SetErrorMode (uMode=0x1) returned 0x0
[0090.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.752] GetLastError () returned 0x0
[0090.752] GetFileType (hFile=0x220) returned 0x1
[0090.752] GetFileType (hFile=0x220) returned 0x1
[0090.752] ReadFile (in: hFile=0x220, lpBuffer=0x25df388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x25df388*, lpNumberOfBytesRead=0x39eaf8*=0x18, lpOverlapped=0x0) returned 1
[0090.753] GetLastError () returned 0x0
[0090.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred", lpFilePart=0x0) returned 0x77
[0090.781] GetLastError () returned 0x0
[0090.781] SetErrorMode (uMode=0x1) returned 0x0
[0090.781] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
[0090.781] GetLastError () returned 0x5
[0090.782] SetErrorMode (uMode=0x0) returned 0x1
[0090.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x6e
[0090.783] GetLastError () returned 0x5
[0090.783] SetErrorMode (uMode=0x1) returned 0x0
[0090.783] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0
[0090.784] GetLastError () returned 0x5
[0090.784] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1
[0090.784] SetErrorMode (uMode=0x0) returned 0x1
[0090.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x6e
[0090.784] GetLastError () returned 0x12
[0090.784] SetErrorMode (uMode=0x1) returned 0x0
[0090.784] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0
[0090.784] GetLastError () returned 0x12
[0090.784] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1
[0090.784] SetErrorMode (uMode=0x0) returned 0x1
[0090.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c", lpFilePart=0x0) returned 0x93
[0090.784] GetLastError () returned 0x12
[0090.784] SetErrorMode (uMode=0x1) returned 0x0
[0090.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.801] GetLastError () returned 0x0
[0090.801] GetFileType (hFile=0x220) returned 0x1
[0090.801] GetFileType (hFile=0x220) returned 0x1
[0090.801] ReadFile (in: hFile=0x220, lpBuffer=0x266a944, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x266a944*, lpNumberOfBytesRead=0x39eaf8*=0x1d4, lpOverlapped=0x0) returned 1
[0090.802] GetLastError () returned 0x0
[0090.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c", lpFilePart=0x0) returned 0x93
[0090.841] GetLastError () returned 0x0
[0090.841] SetErrorMode (uMode=0x1) returned 0x0
[0090.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
[0090.842] GetLastError () returned 0x5
[0090.847] SetErrorMode (uMode=0x0) returned 0x1
[0090.848] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d", lpFilePart=0x0) returned 0x93
[0090.848] GetLastError () returned 0x5
[0090.848] SetErrorMode (uMode=0x1) returned 0x0
[0090.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.848] GetLastError () returned 0x0
[0090.848] GetFileType (hFile=0x220) returned 0x1
[0090.848] GetFileType (hFile=0x220) returned 0x1
[0090.848] ReadFile (in: hFile=0x220, lpBuffer=0x24f4e38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x24f4e38*, lpNumberOfBytesRead=0x39eaf8*=0x1d4, lpOverlapped=0x0) returned 1
[0090.849] GetLastError () returned 0x0
[0090.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d", lpFilePart=0x0) returned 0x93
[0090.874] GetLastError () returned 0x0
[0090.874] SetErrorMode (uMode=0x1) returned 0x0
[0090.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
[0090.874] GetLastError () returned 0x5
[0090.875] SetErrorMode (uMode=0x0) returned 0x1
[0090.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d", lpFilePart=0x0) returned 0x93
[0090.876] GetLastError () returned 0x5
[0090.876] SetErrorMode (uMode=0x1) returned 0x0
[0090.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.876] GetLastError () returned 0x0
[0090.876] GetFileType (hFile=0x220) returned 0x1
[0090.876] GetFileType (hFile=0x220) returned 0x1
[0090.876] ReadFile (in: hFile=0x220, lpBuffer=0x257f20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x257f20c*, lpNumberOfBytesRead=0x39eaf8*=0x1d4, lpOverlapped=0x0) returned 1
[0090.877] GetLastError () returned 0x0
[0090.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d", lpFilePart=0x0) returned 0x93
[0090.902] GetLastError () returned 0x0
[0090.902] SetErrorMode (uMode=0x1) returned 0x0
[0090.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
[0090.902] GetLastError () returned 0x5
[0090.903] SetErrorMode (uMode=0x0) returned 0x1
[0090.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", lpFilePart=0x0) returned 0x78
[0090.904] GetLastError () returned 0x5
[0090.904] SetErrorMode (uMode=0x1) returned 0x0
[0090.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\preferred"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.904] GetLastError () returned 0x0
[0090.904] GetFileType (hFile=0x220) returned 0x1
[0090.904] GetFileType (hFile=0x220) returned 0x1
[0090.905] ReadFile (in: hFile=0x220, lpBuffer=0x2609214, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x2609214*, lpNumberOfBytesRead=0x39eaf8*=0x18, lpOverlapped=0x0) returned 1
[0090.905] GetLastError () returned 0x0
[0090.930] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", lpFilePart=0x0) returned 0x78
[0090.930] GetLastError () returned 0x0
[0090.930] SetErrorMode (uMode=0x1) returned 0x0
[0090.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\preferred"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff
[0090.930] GetLastError () returned 0x5
[0090.931] SetErrorMode (uMode=0x0) returned 0x1
[0090.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x41
[0090.932] GetLastError () returned 0x5
[0090.932] SetErrorMode (uMode=0x1) returned 0x0
[0090.932] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3b0
[0090.933] GetLastError () returned 0x5
[0090.933] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.933] GetLastError () returned 0x5
[0090.933] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.933] GetLastError () returned 0x12
[0090.933] FindClose (in: hFindFile=0x42c3b0 | out: hFindFile=0x42c3b0) returned 1
[0090.933] SetErrorMode (uMode=0x0) returned 0x1
[0090.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x41
[0090.933] GetLastError () returned 0x12
[0090.933] SetErrorMode (uMode=0x1) returned 0x0
[0090.933] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3b0
[0090.933] GetLastError () returned 0x12
[0090.933] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.933] GetLastError () returned 0x12
[0090.934] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.934] GetLastError () returned 0x12
[0090.934] FindClose (in: hFindFile=0x42c3b0 | out: hFindFile=0x42c3b0) returned 1
[0090.934] SetErrorMode (uMode=0x0) returned 0x1
[0090.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", lpFilePart=0x0) returned 0x51
[0090.934] GetLastError () returned 0x12
[0090.934] SetErrorMode (uMode=0x1) returned 0x0
[0090.934] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3b0
[0090.945] GetLastError () returned 0x12
[0090.945] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.945] GetLastError () returned 0x12
[0090.945] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.945] GetLastError () returned 0x12
[0090.945] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.945] GetLastError () returned 0x12
[0090.945] FindClose (in: hFindFile=0x42c3b0 | out: hFindFile=0x42c3b0) returned 1
[0090.945] SetErrorMode (uMode=0x0) returned 0x1
[0090.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", lpFilePart=0x0) returned 0x51
[0090.946] GetLastError () returned 0x12
[0090.946] SetErrorMode (uMode=0x1) returned 0x0
[0090.946] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3b0
[0090.946] GetLastError () returned 0x12
[0090.946] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.946] GetLastError () returned 0x12
[0090.946] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.946] GetLastError () returned 0x12
[0090.946] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.946] GetLastError () returned 0x12
[0090.946] FindClose (in: hFindFile=0x42c3b0 | out: hFindFile=0x42c3b0) returned 1
[0090.947] SetErrorMode (uMode=0x0) returned 0x1
[0090.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", lpFilePart=0x0) returned 0x62
[0090.947] GetLastError () returned 0x12
[0090.947] SetErrorMode (uMode=0x1) returned 0x0
[0090.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.948] GetLastError () returned 0x0
[0090.948] GetFileType (hFile=0x220) returned 0x1
[0090.948] GetFileType (hFile=0x220) returned 0x1
[0090.948] ReadFile (in: hFile=0x220, lpBuffer=0x2694940, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x2694940*, lpNumberOfBytesRead=0x39eb58*=0xa8, lpOverlapped=0x0) returned 1
[0090.949] GetLastError () returned 0x0
[0090.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", lpFilePart=0x0) returned 0x62
[0090.976] GetLastError () returned 0x0
[0090.977] SetErrorMode (uMode=0x1) returned 0x0
[0090.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0090.977] GetLastError () returned 0xb7
[0090.977] GetFileType (hFile=0x220) returned 0x1
[0090.977] GetFileType (hFile=0x220) returned 0x1
[0090.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", lpFilePart=0x0) returned 0x62
[0090.978] GetLastError () returned 0xb7
[0090.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.LanRan2.0.5", lpFilePart=0x0) returned 0x6e
[0090.978] GetLastError () returned 0xb7
[0090.978] SetErrorMode (uMode=0x1) returned 0x0
[0090.978] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5105e00, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1
[0090.978] GetLastError () returned 0xb7
[0090.979] SetErrorMode (uMode=0x0) returned 0x1
[0090.979] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml.lanran2.0.5")) returned 1
[0090.979] GetLastError () returned 0xb7
[0090.979] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x3e
[0090.979] GetLastError () returned 0xb7
[0090.979] SetErrorMode (uMode=0x1) returned 0x0
[0090.979] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.980] GetLastError () returned 0xb7
[0090.980] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.980] GetLastError () returned 0xb7
[0090.980] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.980] GetLastError () returned 0x12
[0090.980] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.980] SetErrorMode (uMode=0x0) returned 0x1
[0090.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x3e
[0090.980] GetLastError () returned 0x12
[0090.980] SetErrorMode (uMode=0x1) returned 0x0
[0090.980] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.980] GetLastError () returned 0x12
[0090.981] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.981] GetLastError () returned 0x12
[0090.981] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.981] GetLastError () returned 0x12
[0090.981] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.981] SetErrorMode (uMode=0x0) returned 0x1
[0090.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x4a
[0090.981] GetLastError () returned 0x12
[0090.981] SetErrorMode (uMode=0x1) returned 0x0
[0090.981] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.981] GetLastError () returned 0x12
[0090.982] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.982] GetLastError () returned 0x12
[0090.982] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.982] GetLastError () returned 0x12
[0090.982] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.982] GetLastError () returned 0x12
[0090.982] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.982] SetErrorMode (uMode=0x0) returned 0x1
[0090.982] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x4a
[0090.982] GetLastError () returned 0x12
[0090.982] SetErrorMode (uMode=0x1) returned 0x0
[0090.982] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.982] GetLastError () returned 0x12
[0090.982] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.982] GetLastError () returned 0x12
[0090.982] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.982] GetLastError () returned 0x12
[0090.983] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.983] GetLastError () returned 0x12
[0090.983] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.983] SetErrorMode (uMode=0x0) returned 0x1
[0090.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x4d
[0090.983] GetLastError () returned 0x12
[0090.983] SetErrorMode (uMode=0x1) returned 0x0
[0090.983] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.983] GetLastError () returned 0x12
[0090.983] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.983] GetLastError () returned 0x12
[0090.983] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.983] GetLastError () returned 0x12
[0090.983] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.983] GetLastError () returned 0x12
[0090.983] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.984] GetLastError () returned 0x12
[0090.984] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.984] GetLastError () returned 0x12
[0090.984] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.984] SetErrorMode (uMode=0x0) returned 0x1
[0090.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x4d
[0090.984] GetLastError () returned 0x12
[0090.984] SetErrorMode (uMode=0x1) returned 0x0
[0090.984] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.984] GetLastError () returned 0x12
[0090.984] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.984] GetLastError () returned 0x12
[0090.984] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.984] GetLastError () returned 0x12
[0090.984] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.984] GetLastError () returned 0x12
[0090.984] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.984] GetLastError () returned 0x12
[0090.985] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.985] GetLastError () returned 0x12
[0090.985] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.985] SetErrorMode (uMode=0x0) returned 0x1
[0090.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x5a
[0090.985] GetLastError () returned 0x12
[0090.985] SetErrorMode (uMode=0x1) returned 0x0
[0090.985] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.985] GetLastError () returned 0x12
[0090.985] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.985] GetLastError () returned 0x12
[0090.985] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.985] GetLastError () returned 0x12
[0090.985] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.986] SetErrorMode (uMode=0x0) returned 0x1
[0090.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x5a
[0090.986] GetLastError () returned 0x12
[0090.986] SetErrorMode (uMode=0x1) returned 0x0
[0090.987] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.987] GetLastError () returned 0x12
[0090.987] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.987] GetLastError () returned 0x12
[0090.987] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.987] GetLastError () returned 0x12
[0090.987] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.987] SetErrorMode (uMode=0x0) returned 0x1
[0090.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x52
[0090.987] GetLastError () returned 0x12
[0090.987] SetErrorMode (uMode=0x1) returned 0x0
[0090.987] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.987] GetLastError () returned 0x12
[0090.988] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.988] GetLastError () returned 0x12
[0090.988] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.988] GetLastError () returned 0x12
[0090.988] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.988] SetErrorMode (uMode=0x0) returned 0x1
[0090.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x52
[0090.988] GetLastError () returned 0x12
[0090.988] SetErrorMode (uMode=0x1) returned 0x0
[0090.988] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.988] GetLastError () returned 0x12
[0090.988] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.988] GetLastError () returned 0x12
[0090.988] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.988] GetLastError () returned 0x12
[0090.988] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.989] SetErrorMode (uMode=0x0) returned 0x1
[0090.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x52
[0090.989] GetLastError () returned 0x12
[0090.989] SetErrorMode (uMode=0x1) returned 0x0
[0090.989] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.989] GetLastError () returned 0x12
[0090.989] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.989] GetLastError () returned 0x12
[0090.989] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.989] GetLastError () returned 0x12
[0090.989] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.989] SetErrorMode (uMode=0x0) returned 0x1
[0090.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x52
[0090.989] GetLastError () returned 0x12
[0090.989] SetErrorMode (uMode=0x1) returned 0x0
[0090.990] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.990] GetLastError () returned 0x12
[0090.990] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.990] GetLastError () returned 0x12
[0090.990] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.990] GetLastError () returned 0x12
[0090.990] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.990] SetErrorMode (uMode=0x0) returned 0x1
[0090.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x41
[0090.990] GetLastError () returned 0x12
[0090.990] SetErrorMode (uMode=0x1) returned 0x0
[0090.990] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.991] GetLastError () returned 0x12
[0090.991] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.991] GetLastError () returned 0x12
[0090.991] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.991] GetLastError () returned 0x12
[0090.991] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.991] GetLastError () returned 0x12
[0090.991] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.991] SetErrorMode (uMode=0x0) returned 0x1
[0090.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x41
[0090.992] GetLastError () returned 0x12
[0090.992] SetErrorMode (uMode=0x1) returned 0x0
[0090.992] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.992] GetLastError () returned 0x12
[0090.992] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.992] GetLastError () returned 0x12
[0090.992] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.992] GetLastError () returned 0x12
[0090.992] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.992] GetLastError () returned 0x12
[0090.992] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.992] SetErrorMode (uMode=0x0) returned 0x1
[0090.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x3e
[0090.992] GetLastError () returned 0x12
[0090.992] SetErrorMode (uMode=0x1) returned 0x0
[0090.993] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.993] GetLastError () returned 0x12
[0090.993] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.993] GetLastError () returned 0x12
[0090.993] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.993] GetLastError () returned 0x12
[0090.994] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.994] GetLastError () returned 0x12
[0090.994] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.994] SetErrorMode (uMode=0x0) returned 0x1
[0090.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x3e
[0090.994] GetLastError () returned 0x12
[0090.994] SetErrorMode (uMode=0x1) returned 0x0
[0090.994] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.994] GetLastError () returned 0x12
[0090.994] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.994] GetLastError () returned 0x12
[0090.994] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.994] GetLastError () returned 0x12
[0090.994] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.994] GetLastError () returned 0x12
[0090.994] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.995] SetErrorMode (uMode=0x0) returned 0x1
[0090.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x3f
[0090.995] GetLastError () returned 0x12
[0090.995] SetErrorMode (uMode=0x1) returned 0x0
[0090.995] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.995] GetLastError () returned 0x12
[0090.995] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.995] GetLastError () returned 0x12
[0090.995] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.995] GetLastError () returned 0x12
[0090.995] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.995] GetLastError () returned 0x12
[0090.995] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.995] GetLastError () returned 0x12
[0090.995] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.995] GetLastError () returned 0x12
[0090.995] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.995] GetLastError () returned 0x12
[0090.995] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.996] GetLastError () returned 0x12
[0090.996] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.996] GetLastError () returned 0x12
[0090.996] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.996] GetLastError () returned 0x12
[0090.996] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.996] GetLastError () returned 0x12
[0090.996] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.996] GetLastError () returned 0x12
[0090.996] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.996] GetLastError () returned 0x12
[0090.996] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.996] GetLastError () returned 0x12
[0090.996] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.996] GetLastError () returned 0x12
[0090.996] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.996] SetErrorMode (uMode=0x0) returned 0x1
[0090.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x3f
[0090.996] GetLastError () returned 0x12
[0090.996] SetErrorMode (uMode=0x1) returned 0x0
[0090.997] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.997] GetLastError () returned 0x12
[0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.997] GetLastError () returned 0x12
[0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.997] GetLastError () returned 0x12
[0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.997] GetLastError () returned 0x12
[0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.997] GetLastError () returned 0x12
[0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.997] GetLastError () returned 0x12
[0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.997] GetLastError () returned 0x12
[0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.997] GetLastError () returned 0x12
[0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.997] GetLastError () returned 0x12
[0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.997] GetLastError () returned 0x12
[0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.998] GetLastError () returned 0x12
[0090.998] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.998] GetLastError () returned 0x12
[0090.998] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.998] GetLastError () returned 0x12
[0090.998] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.998] GetLastError () returned 0x12
[0090.998] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0090.998] GetLastError () returned 0x12
[0090.998] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0090.998] SetErrorMode (uMode=0x0) returned 0x1
[0090.998] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x47
[0090.998] GetLastError () returned 0x12
[0090.998] SetErrorMode (uMode=0x1) returned 0x0
[0090.998] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0090.998] GetLastError () returned 0x12
[0090.998] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.999] GetLastError () returned 0x12
[0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.999] GetLastError () returned 0x12
[0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.999] GetLastError () returned 0x12
[0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.999] GetLastError () returned 0x12
[0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.999] GetLastError () returned 0x12
[0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.999] GetLastError () returned 0x12
[0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.999] GetLastError () returned 0x12
[0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.999] GetLastError () returned 0x12
[0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.999] GetLastError () returned 0x12
[0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.999] GetLastError () returned 0x12
[0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0090.999] GetLastError () returned 0x12
[0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0091.000] GetLastError () returned 0x12
[0091.000] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0091.000] SetErrorMode (uMode=0x0) returned 0x1
[0091.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x47
[0091.000] GetLastError () returned 0x12
[0091.000] SetErrorMode (uMode=0x1) returned 0x0
[0091.000] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0091.000] GetLastError () returned 0x12
[0091.000] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.000] GetLastError () returned 0x12
[0091.000] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.000] GetLastError () returned 0x12
[0091.000] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.000] GetLastError () returned 0x12
[0091.000] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.000] GetLastError () returned 0x12
[0091.000] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.000] GetLastError () returned 0x12
[0091.001] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.001] GetLastError () returned 0x12
[0091.001] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.001] GetLastError () returned 0x12
[0091.001] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.001] GetLastError () returned 0x12
[0091.001] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.001] GetLastError () returned 0x12
[0091.001] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.001] GetLastError () returned 0x12
[0091.001] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.001] GetLastError () returned 0x12
[0091.001] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0091.001] GetLastError () returned 0x12
[0091.001] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0091.001] SetErrorMode (uMode=0x0) returned 0x1
[0091.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", lpFilePart=0x0) returned 0x69
[0091.002] GetLastError () returned 0x12
[0091.002] SetErrorMode (uMode=0x1) returned 0x0
[0091.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.003] GetLastError () returned 0x0
[0091.003] GetFileType (hFile=0x220) returned 0x1
[0091.003] GetFileType (hFile=0x220) returned 0x1
[0091.003] ReadFile (in: hFile=0x220, lpBuffer=0x252a6b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x252a6b4*, lpNumberOfBytesRead=0x39eaf8*=0x53, lpOverlapped=0x0) returned 1
[0091.003] GetLastError () returned 0x0
[0091.039] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", lpFilePart=0x0) returned 0x69
[0091.039] GetLastError () returned 0x0
[0091.039] SetErrorMode (uMode=0x1) returned 0x0
[0091.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.040] GetLastError () returned 0xb7
[0091.040] GetFileType (hFile=0x220) returned 0x1
[0091.040] GetFileType (hFile=0x220) returned 0x1
[0091.041] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", lpFilePart=0x0) returned 0x69
[0091.041] GetLastError () returned 0xb7
[0091.041] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x75
[0091.041] GetLastError () returned 0xb7
[0091.041] SetErrorMode (uMode=0x1) returned 0x0
[0091.041] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x519e380, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1
[0091.041] GetLastError () returned 0xb7
[0091.041] SetErrorMode (uMode=0x0) returned 0x1
[0091.041] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.lanran2.0.5")) returned 1
[0091.042] GetLastError () returned 0xb7
[0091.042] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", lpFilePart=0x0) returned 0x69
[0091.042] GetLastError () returned 0xb7
[0091.042] SetErrorMode (uMode=0x1) returned 0x0
[0091.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.043] GetLastError () returned 0x0
[0091.043] GetFileType (hFile=0x220) returned 0x1
[0091.044] GetFileType (hFile=0x220) returned 0x1
[0091.044] ReadFile (in: hFile=0x220, lpBuffer=0x25b4f04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x25b4f04*, lpNumberOfBytesRead=0x39eaf8*=0x227, lpOverlapped=0x0) returned 1
[0091.044] GetLastError () returned 0x0
[0091.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", lpFilePart=0x0) returned 0x69
[0091.069] GetLastError () returned 0x0
[0091.069] SetErrorMode (uMode=0x1) returned 0x0
[0091.069] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.070] GetLastError () returned 0xb7
[0091.070] GetFileType (hFile=0x220) returned 0x1
[0091.070] GetFileType (hFile=0x220) returned 0x1
[0091.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", lpFilePart=0x0) returned 0x69
[0091.071] GetLastError () returned 0xb7
[0091.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x75
[0091.071] GetLastError () returned 0xb7
[0091.071] SetErrorMode (uMode=0x1) returned 0x0
[0091.071] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x51ea640, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x230)) returned 1
[0091.071] GetLastError () returned 0xb7
[0091.071] SetErrorMode (uMode=0x0) returned 0x1
[0091.071] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.lanran2.0.5")) returned 1
[0091.075] GetLastError () returned 0xb7
[0091.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", lpFilePart=0x0) returned 0x6a
[0091.075] GetLastError () returned 0xb7
[0091.075] SetErrorMode (uMode=0x1) returned 0x0
[0091.075] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.076] GetLastError () returned 0x0
[0091.076] GetFileType (hFile=0x220) returned 0x1
[0091.076] GetFileType (hFile=0x220) returned 0x1
[0091.076] ReadFile (in: hFile=0x220, lpBuffer=0x263fd8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x263fd8c*, lpNumberOfBytesRead=0x39eaf8*=0xf1, lpOverlapped=0x0) returned 1
[0091.077] GetLastError () returned 0x0
[0091.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", lpFilePart=0x0) returned 0x6a
[0091.102] GetLastError () returned 0x0
[0091.102] SetErrorMode (uMode=0x1) returned 0x0
[0091.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.102] GetLastError () returned 0xb7
[0091.103] GetFileType (hFile=0x220) returned 0x1
[0091.103] GetFileType (hFile=0x220) returned 0x1
[0091.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", lpFilePart=0x0) returned 0x6a
[0091.103] GetLastError () returned 0xb7
[0091.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x76
[0091.103] GetLastError () returned 0xb7
[0091.103] SetErrorMode (uMode=0x1) returned 0x0
[0091.103] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x5236900, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x100)) returned 1
[0091.104] GetLastError () returned 0xb7
[0091.104] SetErrorMode (uMode=0x0) returned 0x1
[0091.104] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.lanran2.0.5")) returned 1
[0091.104] GetLastError () returned 0xb7
[0091.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpFilePart=0x0) returned 0x6e
[0091.104] GetLastError () returned 0xb7
[0091.105] SetErrorMode (uMode=0x1) returned 0x0
[0091.105] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.106] GetLastError () returned 0x0
[0091.106] GetFileType (hFile=0x220) returned 0x1
[0091.106] GetFileType (hFile=0x220) returned 0x1
[0091.106] ReadFile (in: hFile=0x220, lpBuffer=0x26ca3ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x26ca3ec*, lpNumberOfBytesRead=0x39eaf8*=0x6f, lpOverlapped=0x0) returned 1
[0091.106] GetLastError () returned 0x0
[0091.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpFilePart=0x0) returned 0x6e
[0091.133] GetLastError () returned 0x0
[0091.133] SetErrorMode (uMode=0x1) returned 0x0
[0091.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.136] GetLastError () returned 0xb7
[0091.136] GetFileType (hFile=0x220) returned 0x1
[0091.137] GetFileType (hFile=0x220) returned 0x1
[0091.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpFilePart=0x0) returned 0x6e
[0091.137] GetLastError () returned 0xb7
[0091.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7a
[0091.137] GetLastError () returned 0xb7
[0091.137] SetErrorMode (uMode=0x1) returned 0x0
[0091.137] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x5282bc0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1
[0091.138] GetLastError () returned 0xb7
[0091.138] SetErrorMode (uMode=0x0) returned 0x1
[0091.138] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.lanran2.0.5")) returned 1
[0091.138] GetLastError () returned 0xb7
[0091.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpFilePart=0x0) returned 0x6f
[0091.138] GetLastError () returned 0xb7
[0091.139] SetErrorMode (uMode=0x1) returned 0x0
[0091.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.139] GetLastError () returned 0x0
[0091.139] GetFileType (hFile=0x220) returned 0x1
[0091.139] GetFileType (hFile=0x220) returned 0x1
[0091.139] ReadFile (in: hFile=0x220, lpBuffer=0x25552d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x25552d4*, lpNumberOfBytesRead=0x39eaf8*=0x6e, lpOverlapped=0x0) returned 1
[0091.140] GetLastError () returned 0x0
[0091.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpFilePart=0x0) returned 0x6f
[0091.165] GetLastError () returned 0x0
[0091.165] SetErrorMode (uMode=0x1) returned 0x0
[0091.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.166] GetLastError () returned 0xb7
[0091.166] GetFileType (hFile=0x220) returned 0x1
[0091.166] GetFileType (hFile=0x220) returned 0x1
[0091.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpFilePart=0x0) returned 0x6f
[0091.166] GetLastError () returned 0xb7
[0091.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7b
[0091.167] GetLastError () returned 0xb7
[0091.167] SetErrorMode (uMode=0x1) returned 0x0
[0091.167] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x52cee80, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1
[0091.167] GetLastError () returned 0xb7
[0091.167] SetErrorMode (uMode=0x0) returned 0x1
[0091.167] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.lanran2.0.5")) returned 1
[0091.168] GetLastError () returned 0xb7
[0091.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", lpFilePart=0x0) returned 0x6a
[0091.168] GetLastError () returned 0xb7
[0091.168] SetErrorMode (uMode=0x1) returned 0x0
[0091.168] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.181] GetLastError () returned 0x0
[0091.182] GetFileType (hFile=0x220) returned 0x1
[0091.182] GetFileType (hFile=0x220) returned 0x1
[0091.182] ReadFile (in: hFile=0x220, lpBuffer=0x25dfa68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x25dfa68*, lpNumberOfBytesRead=0x39eaf8*=0x114, lpOverlapped=0x0) returned 1
[0091.182] GetLastError () returned 0x0
[0091.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", lpFilePart=0x0) returned 0x6a
[0091.208] GetLastError () returned 0x0
[0091.208] SetErrorMode (uMode=0x1) returned 0x0
[0091.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.209] GetLastError () returned 0xb7
[0091.209] GetFileType (hFile=0x220) returned 0x1
[0091.209] GetFileType (hFile=0x220) returned 0x1
[0091.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", lpFilePart=0x0) returned 0x6a
[0091.210] GetLastError () returned 0xb7
[0091.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x76
[0091.210] GetLastError () returned 0xb7
[0091.210] SetErrorMode (uMode=0x1) returned 0x0
[0091.210] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x53412a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x120)) returned 1
[0091.210] GetLastError () returned 0xb7
[0091.210] SetErrorMode (uMode=0x0) returned 0x1
[0091.210] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.lanran2.0.5")) returned 1
[0091.211] GetLastError () returned 0xb7
[0091.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", lpFilePart=0x0) returned 0x69
[0091.211] GetLastError () returned 0xb7
[0091.211] SetErrorMode (uMode=0x1) returned 0x0
[0091.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.211] GetLastError () returned 0x0
[0091.211] GetFileType (hFile=0x220) returned 0x1
[0091.211] GetFileType (hFile=0x220) returned 0x1
[0091.211] ReadFile (in: hFile=0x220, lpBuffer=0x266a310, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x266a310*, lpNumberOfBytesRead=0x39eaf8*=0x56, lpOverlapped=0x0) returned 1
[0091.212] GetLastError () returned 0x0
[0091.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", lpFilePart=0x0) returned 0x69
[0091.228] GetLastError () returned 0x0
[0091.228] SetErrorMode (uMode=0x1) returned 0x0
[0091.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.228] GetLastError () returned 0xb7
[0091.228] GetFileType (hFile=0x220) returned 0x1
[0091.228] GetFileType (hFile=0x220) returned 0x1
[0091.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", lpFilePart=0x0) returned 0x69
[0091.229] GetLastError () returned 0xb7
[0091.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x75
[0091.229] GetLastError () returned 0xb7
[0091.229] SetErrorMode (uMode=0x1) returned 0x0
[0091.229] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x5367400, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1
[0091.229] GetLastError () returned 0xb7
[0091.229] SetErrorMode (uMode=0x0) returned 0x1
[0091.229] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.lanran2.0.5")) returned 1
[0091.231] GetLastError () returned 0xb7
[0091.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpFilePart=0x0) returned 0x69
[0091.231] GetLastError () returned 0xb7
[0091.231] SetErrorMode (uMode=0x1) returned 0x0
[0091.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.231] GetLastError () returned 0x0
[0091.231] GetFileType (hFile=0x220) returned 0x1
[0091.232] GetFileType (hFile=0x220) returned 0x1
[0091.232] ReadFile (in: hFile=0x220, lpBuffer=0x26f4930, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x26f4930*, lpNumberOfBytesRead=0x39eaf8*=0x19e, lpOverlapped=0x0) returned 1
[0091.232] GetLastError () returned 0x0
[0091.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpFilePart=0x0) returned 0x69
[0091.250] GetLastError () returned 0x0
[0091.250] SetErrorMode (uMode=0x1) returned 0x0
[0091.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.251] GetLastError () returned 0xb7
[0091.251] GetFileType (hFile=0x220) returned 0x1
[0091.251] GetFileType (hFile=0x220) returned 0x1
[0091.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpFilePart=0x0) returned 0x69
[0091.251] GetLastError () returned 0xb7
[0091.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x75
[0091.251] GetLastError () returned 0xb7
[0091.251] SetErrorMode (uMode=0x1) returned 0x0
[0091.251] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x53b36c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x1a0)) returned 1
[0091.251] GetLastError () returned 0xb7
[0091.252] SetErrorMode (uMode=0x0) returned 0x1
[0091.252] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.lanran2.0.5")) returned 1
[0091.252] GetLastError () returned 0xb7
[0091.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", lpFilePart=0x0) returned 0x4b
[0091.252] GetLastError () returned 0xb7
[0091.252] SetErrorMode (uMode=0x1) returned 0x0
[0091.252] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0
[0091.267] GetLastError () returned 0xb7
[0091.267] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.285] GetLastError () returned 0xb7
[0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.286] GetLastError () returned 0xb7
[0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.286] GetLastError () returned 0xb7
[0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.286] GetLastError () returned 0xb7
[0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.286] GetLastError () returned 0xb7
[0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.286] GetLastError () returned 0xb7
[0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.286] GetLastError () returned 0xb7
[0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.286] GetLastError () returned 0xb7
[0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.286] GetLastError () returned 0xb7
[0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.286] GetLastError () returned 0xb7
[0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.286] GetLastError () returned 0xb7
[0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.286] GetLastError () returned 0xb7
[0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.286] GetLastError () returned 0xb7
[0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0091.286] GetLastError () returned 0x12
[0091.286] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1
[0091.287] SetErrorMode (uMode=0x0) returned 0x1
[0091.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", lpFilePart=0x0) returned 0x4b
[0091.287] GetLastError () returned 0x12
[0091.287] SetErrorMode (uMode=0x1) returned 0x0
[0091.287] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0
[0091.287] GetLastError () returned 0x12
[0091.287] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.288] GetLastError () returned 0x12
[0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.288] GetLastError () returned 0x12
[0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.288] GetLastError () returned 0x12
[0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.288] GetLastError () returned 0x12
[0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.288] GetLastError () returned 0x12
[0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.288] GetLastError () returned 0x12
[0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.288] GetLastError () returned 0x12
[0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.288] GetLastError () returned 0x12
[0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.288] GetLastError () returned 0x12
[0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.288] GetLastError () returned 0x12
[0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.288] GetLastError () returned 0x12
[0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.288] GetLastError () returned 0x12
[0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.288] GetLastError () returned 0x12
[0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.288] GetLastError () returned 0x12
[0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.288] GetLastError () returned 0x12
[0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.289] GetLastError () returned 0x12
[0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.289] GetLastError () returned 0x12
[0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.289] GetLastError () returned 0x12
[0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.289] GetLastError () returned 0x12
[0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.289] GetLastError () returned 0x12
[0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.289] GetLastError () returned 0x12
[0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.289] GetLastError () returned 0x12
[0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.289] GetLastError () returned 0x12
[0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.289] GetLastError () returned 0x12
[0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.289] GetLastError () returned 0x12
[0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.289] GetLastError () returned 0x12
[0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.289] GetLastError () returned 0x12
[0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.289] GetLastError () returned 0x12
[0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0091.289] GetLastError () returned 0x12
[0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0091.289] GetLastError () returned 0x12
[0091.289] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1
[0091.290] SetErrorMode (uMode=0x0) returned 0x1
[0091.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", lpFilePart=0x0) returned 0x7c
[0091.290] GetLastError () returned 0x12
[0091.290] SetErrorMode (uMode=0x1) returned 0x0
[0091.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.291] GetLastError () returned 0x0
[0091.291] GetFileType (hFile=0x220) returned 0x1
[0091.291] GetFileType (hFile=0x220) returned 0x1
[0091.291] ReadFile (in: hFile=0x220, lpBuffer=0x2583158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2583158*, lpNumberOfBytesRead=0x39ea98*=0x66, lpOverlapped=0x0) returned 1
[0091.291] GetLastError () returned 0x0
[0091.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", lpFilePart=0x0) returned 0x7c
[0091.308] GetLastError () returned 0x0
[0091.308] SetErrorMode (uMode=0x1) returned 0x0
[0091.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.308] GetLastError () returned 0xb7
[0091.308] GetFileType (hFile=0x220) returned 0x1
[0091.308] GetFileType (hFile=0x220) returned 0x1
[0091.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", lpFilePart=0x0) returned 0x7c
[0091.309] GetLastError () returned 0xb7
[0091.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x88
[0091.309] GetLastError () returned 0xb7
[0091.309] SetErrorMode (uMode=0x1) returned 0x0
[0091.309] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5425ae0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1
[0091.309] GetLastError () returned 0xb7
[0091.309] SetErrorMode (uMode=0x0) returned 0x1
[0091.309] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.lanran2.0.5")) returned 1
[0091.310] GetLastError () returned 0xb7
[0091.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x77
[0091.310] GetLastError () returned 0xb7
[0091.310] SetErrorMode (uMode=0x1) returned 0x0
[0091.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.310] GetLastError () returned 0x0
[0091.310] GetFileType (hFile=0x220) returned 0x1
[0091.310] GetFileType (hFile=0x220) returned 0x1
[0091.310] ReadFile (in: hFile=0x220, lpBuffer=0x260d750, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x260d750*, lpNumberOfBytesRead=0x39ea98*=0x66, lpOverlapped=0x0) returned 1
[0091.311] GetLastError () returned 0x0
[0091.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x77
[0091.327] GetLastError () returned 0x0
[0091.327] SetErrorMode (uMode=0x1) returned 0x0
[0091.327] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.327] GetLastError () returned 0xb7
[0091.327] GetFileType (hFile=0x220) returned 0x1
[0091.327] GetFileType (hFile=0x220) returned 0x1
[0091.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x77
[0091.328] GetLastError () returned 0xb7
[0091.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x83
[0091.328] GetLastError () returned 0xb7
[0091.328] SetErrorMode (uMode=0x1) returned 0x0
[0091.328] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x544bc40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1
[0091.328] GetLastError () returned 0xb7
[0091.328] SetErrorMode (uMode=0x0) returned 0x1
[0091.328] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.lanran2.0.5")) returned 1
[0091.329] GetLastError () returned 0xb7
[0091.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpFilePart=0x0) returned 0x71
[0091.329] GetLastError () returned 0xb7
[0091.329] SetErrorMode (uMode=0x1) returned 0x0
[0091.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.330] GetLastError () returned 0x0
[0091.330] GetFileType (hFile=0x220) returned 0x1
[0091.330] GetFileType (hFile=0x220) returned 0x1
[0091.330] ReadFile (in: hFile=0x220, lpBuffer=0x2697cec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2697cec*, lpNumberOfBytesRead=0x39ea98*=0x5d, lpOverlapped=0x0) returned 1
[0091.330] GetLastError () returned 0x0
[0091.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpFilePart=0x0) returned 0x71
[0091.355] GetLastError () returned 0x0
[0091.355] SetErrorMode (uMode=0x1) returned 0x0
[0091.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.355] GetLastError () returned 0xb7
[0091.355] GetFileType (hFile=0x220) returned 0x1
[0091.356] GetFileType (hFile=0x220) returned 0x1
[0091.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpFilePart=0x0) returned 0x71
[0091.356] GetLastError () returned 0xb7
[0091.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7d
[0091.356] GetLastError () returned 0xb7
[0091.356] SetErrorMode (uMode=0x1) returned 0x0
[0091.356] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0x5497f00, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1
[0091.356] GetLastError () returned 0xb7
[0091.356] SetErrorMode (uMode=0x0) returned 0x1
[0091.356] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.lanran2.0.5")) returned 1
[0091.357] GetLastError () returned 0xb7
[0091.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", lpFilePart=0x0) returned 0x6e
[0091.357] GetLastError () returned 0xb7
[0091.357] SetErrorMode (uMode=0x1) returned 0x0
[0091.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.358] GetLastError () returned 0x0
[0091.358] GetFileType (hFile=0x220) returned 0x1
[0091.358] GetFileType (hFile=0x220) returned 0x1
[0091.358] ReadFile (in: hFile=0x220, lpBuffer=0x2523f3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2523f3c*, lpNumberOfBytesRead=0x39ea98*=0xea, lpOverlapped=0x0) returned 1
[0091.358] GetLastError () returned 0x0
[0091.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", lpFilePart=0x0) returned 0x6e
[0091.383] GetLastError () returned 0x0
[0091.383] SetErrorMode (uMode=0x1) returned 0x0
[0091.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.384] GetLastError () returned 0xb7
[0091.384] GetFileType (hFile=0x220) returned 0x1
[0091.384] GetFileType (hFile=0x220) returned 0x1
[0091.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", lpFilePart=0x0) returned 0x6e
[0091.384] GetLastError () returned 0xb7
[0091.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7a
[0091.385] GetLastError () returned 0xb7
[0091.385] SetErrorMode (uMode=0x1) returned 0x0
[0091.385] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0x54e41c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xf0)) returned 1
[0091.385] GetLastError () returned 0xb7
[0091.385] SetErrorMode (uMode=0x0) returned 0x1
[0091.385] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt.lanran2.0.5")) returned 1
[0091.385] GetLastError () returned 0xb7
[0091.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpFilePart=0x0) returned 0x6d
[0091.385] GetLastError () returned 0xb7
[0091.385] SetErrorMode (uMode=0x1) returned 0x0
[0091.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.386] GetLastError () returned 0x0
[0091.386] GetFileType (hFile=0x220) returned 0x1
[0091.386] GetFileType (hFile=0x220) returned 0x1
[0091.386] ReadFile (in: hFile=0x220, lpBuffer=0x25ae8fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x25ae8fc*, lpNumberOfBytesRead=0x39ea98*=0x242, lpOverlapped=0x0) returned 1
[0091.400] GetLastError () returned 0x0
[0091.427] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpFilePart=0x0) returned 0x6d
[0091.427] GetLastError () returned 0x0
[0091.427] SetErrorMode (uMode=0x1) returned 0x0
[0091.427] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.428] GetLastError () returned 0xb7
[0091.428] GetFileType (hFile=0x220) returned 0x1
[0091.428] GetFileType (hFile=0x220) returned 0x1
[0091.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpFilePart=0x0) returned 0x6d
[0091.429] GetLastError () returned 0xb7
[0091.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x79
[0091.429] GetLastError () returned 0xb7
[0091.429] SetErrorMode (uMode=0x1) returned 0x0
[0091.429] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x55565e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1
[0091.429] GetLastError () returned 0xb7
[0091.429] SetErrorMode (uMode=0x0) returned 0x1
[0091.429] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.lanran2.0.5")) returned 1
[0091.430] GetLastError () returned 0xb7
[0091.430] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", lpFilePart=0x0) returned 0x6e
[0091.430] GetLastError () returned 0xb7
[0091.430] SetErrorMode (uMode=0x1) returned 0x0
[0091.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.431] GetLastError () returned 0x0
[0091.431] GetFileType (hFile=0x220) returned 0x1
[0091.431] GetFileType (hFile=0x220) returned 0x1
[0091.431] ReadFile (in: hFile=0x220, lpBuffer=0x26397c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x26397c4*, lpNumberOfBytesRead=0x39ea98*=0x65, lpOverlapped=0x0) returned 1
[0091.431] GetLastError () returned 0x0
[0091.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", lpFilePart=0x0) returned 0x6e
[0091.456] GetLastError () returned 0x0
[0091.456] SetErrorMode (uMode=0x1) returned 0x0
[0091.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.457] GetLastError () returned 0xb7
[0091.457] GetFileType (hFile=0x220) returned 0x1
[0091.457] GetFileType (hFile=0x220) returned 0x1
[0091.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", lpFilePart=0x0) returned 0x6e
[0091.458] GetLastError () returned 0xb7
[0091.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7a
[0091.458] GetLastError () returned 0xb7
[0091.458] SetErrorMode (uMode=0x1) returned 0x0
[0091.458] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55a28a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1
[0091.458] GetLastError () returned 0xb7
[0091.458] SetErrorMode (uMode=0x0) returned 0x1
[0091.458] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.lanran2.0.5")) returned 1
[0091.459] GetLastError () returned 0xb7
[0091.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpFilePart=0x0) returned 0x6e
[0091.459] GetLastError () returned 0xb7
[0091.459] SetErrorMode (uMode=0x1) returned 0x0
[0091.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.459] GetLastError () returned 0x0
[0091.459] GetFileType (hFile=0x220) returned 0x1
[0091.459] GetFileType (hFile=0x220) returned 0x1
[0091.460] ReadFile (in: hFile=0x220, lpBuffer=0x26c3cfc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x26c3cfc*, lpNumberOfBytesRead=0x39ea98*=0x52, lpOverlapped=0x0) returned 1
[0091.460] GetLastError () returned 0x0
[0091.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpFilePart=0x0) returned 0x6e
[0091.487] GetLastError () returned 0x0
[0091.487] SetErrorMode (uMode=0x1) returned 0x0
[0091.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.488] GetLastError () returned 0xb7
[0091.488] GetFileType (hFile=0x220) returned 0x1
[0091.488] GetFileType (hFile=0x220) returned 0x1
[0091.489] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpFilePart=0x0) returned 0x6e
[0091.489] GetLastError () returned 0xb7
[0091.489] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7a
[0091.489] GetLastError () returned 0xb7
[0091.489] SetErrorMode (uMode=0x1) returned 0x0
[0091.489] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55eeb60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1
[0091.489] GetLastError () returned 0xb7
[0091.489] SetErrorMode (uMode=0x0) returned 0x1
[0091.489] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.lanran2.0.5")) returned 1
[0091.490] GetLastError () returned 0xb7
[0091.490] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", lpFilePart=0x0) returned 0x73
[0091.490] GetLastError () returned 0xb7
[0091.490] SetErrorMode (uMode=0x1) returned 0x0
[0091.490] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.490] GetLastError () returned 0x0
[0091.490] GetFileType (hFile=0x220) returned 0x1
[0091.490] GetFileType (hFile=0x220) returned 0x1
[0091.490] ReadFile (in: hFile=0x220, lpBuffer=0x254e2f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x254e2f4*, lpNumberOfBytesRead=0x39ea98*=0x125, lpOverlapped=0x0) returned 1
[0091.491] GetLastError () returned 0x0
[0091.515] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", lpFilePart=0x0) returned 0x73
[0091.515] GetLastError () returned 0x0
[0091.515] SetErrorMode (uMode=0x1) returned 0x0
[0091.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.516] GetLastError () returned 0xb7
[0091.516] GetFileType (hFile=0x220) returned 0x1
[0091.516] GetFileType (hFile=0x220) returned 0x1
[0091.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", lpFilePart=0x0) returned 0x73
[0091.517] GetLastError () returned 0xb7
[0091.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7f
[0091.517] GetLastError () returned 0xb7
[0091.517] SetErrorMode (uMode=0x1) returned 0x0
[0091.517] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x563ae20, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x130)) returned 1
[0091.517] GetLastError () returned 0xb7
[0091.518] SetErrorMode (uMode=0x0) returned 0x1
[0091.518] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.lanran2.0.5")) returned 1
[0091.518] GetLastError () returned 0xb7
[0091.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpFilePart=0x0) returned 0x70
[0091.518] GetLastError () returned 0xb7
[0091.518] SetErrorMode (uMode=0x1) returned 0x0
[0091.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.522] GetLastError () returned 0x0
[0091.522] GetFileType (hFile=0x220) returned 0x1
[0091.522] GetFileType (hFile=0x220) returned 0x1
[0091.522] ReadFile (in: hFile=0x220, lpBuffer=0x25d8e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x25d8e78*, lpNumberOfBytesRead=0x39ea98*=0xdd, lpOverlapped=0x0) returned 1
[0091.523] GetLastError () returned 0x0
[0091.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpFilePart=0x0) returned 0x70
[0091.547] GetLastError () returned 0x0
[0091.547] SetErrorMode (uMode=0x1) returned 0x0
[0091.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.548] GetLastError () returned 0xb7
[0091.548] GetFileType (hFile=0x220) returned 0x1
[0091.548] GetFileType (hFile=0x220) returned 0x1
[0091.549] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpFilePart=0x0) returned 0x70
[0091.549] GetLastError () returned 0xb7
[0091.549] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7c
[0091.549] GetLastError () returned 0xb7
[0091.549] SetErrorMode (uMode=0x1) returned 0x0
[0091.549] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x56870e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xe0)) returned 1
[0091.549] GetLastError () returned 0xb7
[0091.549] SetErrorMode (uMode=0x0) returned 0x1
[0091.549] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.lanran2.0.5")) returned 1
[0091.550] GetLastError () returned 0xb7
[0091.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", lpFilePart=0x0) returned 0x71
[0091.550] GetLastError () returned 0xb7
[0091.550] SetErrorMode (uMode=0x1) returned 0x0
[0091.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.550] GetLastError () returned 0x0
[0091.550] GetFileType (hFile=0x220) returned 0x1
[0091.551] GetFileType (hFile=0x220) returned 0x1
[0091.551] ReadFile (in: hFile=0x220, lpBuffer=0x2663654, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2663654*, lpNumberOfBytesRead=0x39ea98*=0x201, lpOverlapped=0x0) returned 1
[0091.551] GetLastError () returned 0x0
[0091.576] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", lpFilePart=0x0) returned 0x71
[0091.576] GetLastError () returned 0x0
[0091.576] SetErrorMode (uMode=0x1) returned 0x0
[0091.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.577] GetLastError () returned 0xb7
[0091.577] GetFileType (hFile=0x220) returned 0x1
[0091.577] GetFileType (hFile=0x220) returned 0x1
[0091.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", lpFilePart=0x0) returned 0x71
[0091.578] GetLastError () returned 0xb7
[0091.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7d
[0091.578] GetLastError () returned 0xb7
[0091.578] SetErrorMode (uMode=0x1) returned 0x0
[0091.578] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4611db50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4611db50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x56ad240, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x210)) returned 1
[0091.578] GetLastError () returned 0xb7
[0091.578] SetErrorMode (uMode=0x0) returned 0x1
[0091.578] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.lanran2.0.5")) returned 1
[0091.578] GetLastError () returned 0xb7
[0091.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", lpFilePart=0x0) returned 0x6c
[0091.579] GetLastError () returned 0xb7
[0091.579] SetErrorMode (uMode=0x1) returned 0x0
[0091.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.580] GetLastError () returned 0x0
[0091.580] GetFileType (hFile=0x220) returned 0x1
[0091.580] GetFileType (hFile=0x220) returned 0x1
[0091.580] ReadFile (in: hFile=0x220, lpBuffer=0x26ee580, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x26ee580*, lpNumberOfBytesRead=0x39ea98*=0x1ea, lpOverlapped=0x0) returned 1
[0091.581] GetLastError () returned 0x0
[0091.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", lpFilePart=0x0) returned 0x6c
[0091.609] GetLastError () returned 0x0
[0091.609] SetErrorMode (uMode=0x1) returned 0x0
[0091.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.610] GetLastError () returned 0xb7
[0091.610] GetFileType (hFile=0x220) returned 0x1
[0091.610] GetFileType (hFile=0x220) returned 0x1
[0091.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", lpFilePart=0x0) returned 0x6c
[0091.611] GetLastError () returned 0xb7
[0091.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x78
[0091.611] GetLastError () returned 0xb7
[0091.611] SetErrorMode (uMode=0x1) returned 0x0
[0091.611] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x534b4210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x562c6900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x571f660, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1
[0091.611] GetLastError () returned 0xb7
[0091.611] SetErrorMode (uMode=0x0) returned 0x1
[0091.611] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt.lanran2.0.5")) returned 1
[0091.611] GetLastError () returned 0xb7
[0091.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", lpFilePart=0x0) returned 0x6e
[0091.611] GetLastError () returned 0xb7
[0091.612] SetErrorMode (uMode=0x1) returned 0x0
[0091.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.612] GetLastError () returned 0x0
[0091.612] GetFileType (hFile=0x220) returned 0x1
[0091.612] GetFileType (hFile=0x220) returned 0x1
[0091.612] ReadFile (in: hFile=0x220, lpBuffer=0x2579534, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2579534*, lpNumberOfBytesRead=0x39ea98*=0x1c8, lpOverlapped=0x0) returned 1
[0091.613] GetLastError () returned 0x0
[0091.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", lpFilePart=0x0) returned 0x6e
[0091.638] GetLastError () returned 0x0
[0091.639] SetErrorMode (uMode=0x1) returned 0x0
[0091.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.639] GetLastError () returned 0xb7
[0091.640] GetFileType (hFile=0x220) returned 0x1
[0091.640] GetFileType (hFile=0x220) returned 0x1
[0091.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", lpFilePart=0x0) returned 0x6e
[0091.640] GetLastError () returned 0xb7
[0091.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7a
[0091.641] GetLastError () returned 0xb7
[0091.641] SetErrorMode (uMode=0x1) returned 0x0
[0091.641] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x57457c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1
[0091.641] GetLastError () returned 0xb7
[0091.641] SetErrorMode (uMode=0x0) returned 0x1
[0091.641] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.lanran2.0.5")) returned 1
[0091.642] GetLastError () returned 0xb7
[0091.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", lpFilePart=0x0) returned 0x6d
[0091.642] GetLastError () returned 0xb7
[0091.642] SetErrorMode (uMode=0x1) returned 0x0
[0091.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.643] GetLastError () returned 0x0
[0091.643] GetFileType (hFile=0x220) returned 0x1
[0091.643] GetFileType (hFile=0x220) returned 0x1
[0091.643] ReadFile (in: hFile=0x220, lpBuffer=0x2604340, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2604340*, lpNumberOfBytesRead=0x39ea98*=0x82, lpOverlapped=0x0) returned 1
[0091.644] GetLastError () returned 0x0
[0091.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", lpFilePart=0x0) returned 0x6d
[0091.671] GetLastError () returned 0x0
[0091.671] SetErrorMode (uMode=0x1) returned 0x0
[0091.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.676] GetLastError () returned 0xb7
[0091.676] GetFileType (hFile=0x220) returned 0x1
[0091.676] GetFileType (hFile=0x220) returned 0x1
[0091.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", lpFilePart=0x0) returned 0x6d
[0091.677] GetLastError () returned 0xb7
[0091.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x79
[0091.677] GetLastError () returned 0xb7
[0091.677] SetErrorMode (uMode=0x1) returned 0x0
[0091.677] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdf95770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdf95770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0x57b7be0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x90)) returned 1
[0091.677] GetLastError () returned 0xb7
[0091.677] SetErrorMode (uMode=0x0) returned 0x1
[0091.677] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.lanran2.0.5")) returned 1
[0091.677] GetLastError () returned 0xb7
[0091.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", lpFilePart=0x0) returned 0x73
[0091.678] GetLastError () returned 0xb7
[0091.678] SetErrorMode (uMode=0x1) returned 0x0
[0091.678] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.678] GetLastError () returned 0x0
[0091.678] GetFileType (hFile=0x220) returned 0x1
[0091.678] GetFileType (hFile=0x220) returned 0x1
[0091.679] ReadFile (in: hFile=0x220, lpBuffer=0x268e974, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x268e974*, lpNumberOfBytesRead=0x39ea98*=0x110, lpOverlapped=0x0) returned 1
[0091.679] GetLastError () returned 0x0
[0091.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", lpFilePart=0x0) returned 0x73
[0091.705] GetLastError () returned 0x0
[0091.705] SetErrorMode (uMode=0x1) returned 0x0
[0091.706] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.706] GetLastError () returned 0xb7
[0091.706] GetFileType (hFile=0x220) returned 0x1
[0091.706] GetFileType (hFile=0x220) returned 0x1
[0091.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", lpFilePart=0x0) returned 0x73
[0091.707] GetLastError () returned 0xb7
[0091.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7f
[0091.707] GetLastError () returned 0xb7
[0091.707] SetErrorMode (uMode=0x1) returned 0x0
[0091.707] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6301df20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a15b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5803ea0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x120)) returned 1
[0091.707] GetLastError () returned 0xb7
[0091.707] SetErrorMode (uMode=0x0) returned 0x1
[0091.707] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.lanran2.0.5")) returned 1
[0091.707] GetLastError () returned 0xb7
[0091.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", lpFilePart=0x0) returned 0x6e
[0091.707] GetLastError () returned 0xb7
[0091.707] SetErrorMode (uMode=0x1) returned 0x0
[0091.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.708] GetLastError () returned 0x0
[0091.708] GetFileType (hFile=0x220) returned 0x1
[0091.708] GetFileType (hFile=0x220) returned 0x1
[0091.708] ReadFile (in: hFile=0x220, lpBuffer=0x2519374, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2519374*, lpNumberOfBytesRead=0x39ea98*=0x256, lpOverlapped=0x0) returned 1
[0091.723] GetLastError () returned 0x0
[0091.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", lpFilePart=0x0) returned 0x6e
[0091.740] GetLastError () returned 0x0
[0091.740] SetErrorMode (uMode=0x1) returned 0x0
[0091.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.741] GetLastError () returned 0xb7
[0091.741] GetFileType (hFile=0x220) returned 0x1
[0091.741] GetFileType (hFile=0x220) returned 0x1
[0091.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", lpFilePart=0x0) returned 0x6e
[0091.742] GetLastError () returned 0xb7
[0091.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7a
[0091.742] GetLastError () returned 0xb7
[0091.742] SetErrorMode (uMode=0x1) returned 0x0
[0091.742] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5850160, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x260)) returned 1
[0091.742] GetLastError () returned 0xb7
[0091.742] SetErrorMode (uMode=0x0) returned 0x1
[0091.742] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt.lanran2.0.5")) returned 1
[0091.742] GetLastError () returned 0xb7
[0091.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", lpFilePart=0x0) returned 0x6e
[0091.742] GetLastError () returned 0xb7
[0091.742] SetErrorMode (uMode=0x1) returned 0x0
[0091.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.743] GetLastError () returned 0x0
[0091.743] GetFileType (hFile=0x220) returned 0x1
[0091.743] GetFileType (hFile=0x220) returned 0x1
[0091.743] ReadFile (in: hFile=0x220, lpBuffer=0x25a449c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x25a449c*, lpNumberOfBytesRead=0x39ea98*=0xc4, lpOverlapped=0x0) returned 1
[0091.744] GetLastError () returned 0x0
[0091.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", lpFilePart=0x0) returned 0x6e
[0091.759] GetLastError () returned 0x0
[0091.759] SetErrorMode (uMode=0x1) returned 0x0
[0091.759] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.760] GetLastError () returned 0xb7
[0091.760] GetFileType (hFile=0x220) returned 0x1
[0091.760] GetFileType (hFile=0x220) returned 0x1
[0091.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", lpFilePart=0x0) returned 0x6e
[0091.761] GetLastError () returned 0xb7
[0091.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7a
[0091.761] GetLastError () returned 0xb7
[0091.761] SetErrorMode (uMode=0x1) returned 0x0
[0091.761] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58762c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xd0)) returned 1
[0091.761] GetLastError () returned 0xb7
[0091.761] SetErrorMode (uMode=0x0) returned 0x1
[0091.761] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt.lanran2.0.5")) returned 1
[0091.762] GetLastError () returned 0xb7
[0091.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", lpFilePart=0x0) returned 0x6e
[0091.762] GetLastError () returned 0xb7
[0091.762] SetErrorMode (uMode=0x1) returned 0x0
[0091.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.762] GetLastError () returned 0x0
[0091.762] GetFileType (hFile=0x220) returned 0x1
[0091.762] GetFileType (hFile=0x220) returned 0x1
[0091.762] ReadFile (in: hFile=0x220, lpBuffer=0x262ec60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x262ec60*, lpNumberOfBytesRead=0x39ea98*=0x21f, lpOverlapped=0x0) returned 1
[0091.763] GetLastError () returned 0x0
[0091.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", lpFilePart=0x0) returned 0x6e
[0091.780] GetLastError () returned 0x0
[0091.780] SetErrorMode (uMode=0x1) returned 0x0
[0091.780] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.780] GetLastError () returned 0xb7
[0091.780] GetFileType (hFile=0x220) returned 0x1
[0091.781] GetFileType (hFile=0x220) returned 0x1
[0091.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", lpFilePart=0x0) returned 0x6e
[0091.781] GetLastError () returned 0xb7
[0091.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7a
[0091.781] GetLastError () returned 0xb7
[0091.781] SetErrorMode (uMode=0x1) returned 0x0
[0091.781] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e777a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64e777a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x589c420, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x220)) returned 1
[0091.781] GetLastError () returned 0xb7
[0091.781] SetErrorMode (uMode=0x0) returned 0x1
[0091.782] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt.lanran2.0.5")) returned 1
[0091.782] GetLastError () returned 0xb7
[0091.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", lpFilePart=0x0) returned 0x70
[0091.782] GetLastError () returned 0xb7
[0091.782] SetErrorMode (uMode=0x1) returned 0x0
[0091.782] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.783] GetLastError () returned 0x0
[0091.783] GetFileType (hFile=0x220) returned 0x1
[0091.783] GetFileType (hFile=0x220) returned 0x1
[0091.783] ReadFile (in: hFile=0x220, lpBuffer=0x26b9af0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x26b9af0*, lpNumberOfBytesRead=0x39ea98*=0x110, lpOverlapped=0x0) returned 1
[0091.783] GetLastError () returned 0x0
[0091.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", lpFilePart=0x0) returned 0x70
[0091.823] GetLastError () returned 0x0
[0091.823] SetErrorMode (uMode=0x1) returned 0x0
[0091.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.824] GetLastError () returned 0xb7
[0091.824] GetFileType (hFile=0x220) returned 0x1
[0091.824] GetFileType (hFile=0x220) returned 0x1
[0091.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", lpFilePart=0x0) returned 0x70
[0091.824] GetLastError () returned 0xb7
[0091.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7c
[0091.824] GetLastError () returned 0xb7
[0091.824] SetErrorMode (uMode=0x1) returned 0x0
[0091.824] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x465ba5f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x465ba5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x590e840, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x120)) returned 1
[0091.824] GetLastError () returned 0xb7
[0091.824] SetErrorMode (uMode=0x0) returned 0x1
[0091.824] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.lanran2.0.5")) returned 1
[0091.825] GetLastError () returned 0xb7
[0091.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", lpFilePart=0x0) returned 0x71
[0091.825] GetLastError () returned 0xb7
[0091.825] SetErrorMode (uMode=0x1) returned 0x0
[0091.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.826] GetLastError () returned 0x0
[0091.826] GetFileType (hFile=0x220) returned 0x1
[0091.826] GetFileType (hFile=0x220) returned 0x1
[0091.826] ReadFile (in: hFile=0x220, lpBuffer=0x2544420, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2544420*, lpNumberOfBytesRead=0x39ea98*=0x76, lpOverlapped=0x0) returned 1
[0091.826] GetLastError () returned 0x0
[0091.842] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", lpFilePart=0x0) returned 0x71
[0091.842] GetLastError () returned 0x0
[0091.842] SetErrorMode (uMode=0x1) returned 0x0
[0091.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.843] GetLastError () returned 0xb7
[0091.843] GetFileType (hFile=0x220) returned 0x1
[0091.843] GetFileType (hFile=0x220) returned 0x1
[0091.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", lpFilePart=0x0) returned 0x71
[0091.844] GetLastError () returned 0xb7
[0091.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7d
[0091.844] GetLastError () returned 0xb7
[0091.844] SetErrorMode (uMode=0x1) returned 0x0
[0091.844] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa5cef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa5cef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0x59349a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1
[0091.845] GetLastError () returned 0xb7
[0091.845] SetErrorMode (uMode=0x0) returned 0x1
[0091.845] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.lanran2.0.5")) returned 1
[0091.845] GetLastError () returned 0xb7
[0091.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", lpFilePart=0x0) returned 0x6b
[0091.845] GetLastError () returned 0xb7
[0091.845] SetErrorMode (uMode=0x1) returned 0x0
[0091.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.845] GetLastError () returned 0x0
[0091.845] GetFileType (hFile=0x220) returned 0x1
[0091.845] GetFileType (hFile=0x220) returned 0x1
[0091.845] ReadFile (in: hFile=0x220, lpBuffer=0x25cee04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x25cee04*, lpNumberOfBytesRead=0x39ea98*=0x337, lpOverlapped=0x0) returned 1
[0091.859] GetLastError () returned 0x0
[0091.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", lpFilePart=0x0) returned 0x6b
[0091.876] GetLastError () returned 0x0
[0091.876] SetErrorMode (uMode=0x1) returned 0x0
[0091.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.877] GetLastError () returned 0xb7
[0091.877] GetFileType (hFile=0x220) returned 0x1
[0091.877] GetFileType (hFile=0x220) returned 0x1
[0091.878] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", lpFilePart=0x0) returned 0x6b
[0091.878] GetLastError () returned 0xb7
[0091.878] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x77
[0091.878] GetLastError () returned 0xb7
[0091.878] SetErrorMode (uMode=0x1) returned 0x0
[0091.878] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b50050, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50b50050, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x59a6dc0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1
[0091.878] GetLastError () returned 0xb7
[0091.878] SetErrorMode (uMode=0x0) returned 0x1
[0091.878] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt.lanran2.0.5")) returned 1
[0091.878] GetLastError () returned 0xb7
[0091.879] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", lpFilePart=0x0) returned 0x79
[0091.879] GetLastError () returned 0xb7
[0091.879] SetErrorMode (uMode=0x1) returned 0x0
[0091.879] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.879] GetLastError () returned 0x0
[0091.879] GetFileType (hFile=0x220) returned 0x1
[0091.879] GetFileType (hFile=0x220) returned 0x1
[0091.880] ReadFile (in: hFile=0x220, lpBuffer=0x265a1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x265a1f4*, lpNumberOfBytesRead=0x39ea98*=0xce, lpOverlapped=0x0) returned 1
[0091.880] GetLastError () returned 0x0
[0091.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", lpFilePart=0x0) returned 0x79
[0091.905] GetLastError () returned 0x0
[0091.905] SetErrorMode (uMode=0x1) returned 0x0
[0091.905] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.907] GetLastError () returned 0xb7
[0091.907] GetFileType (hFile=0x220) returned 0x1
[0091.907] GetFileType (hFile=0x220) returned 0x1
[0091.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", lpFilePart=0x0) returned 0x79
[0091.908] GetLastError () returned 0xb7
[0091.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x85
[0091.908] GetLastError () returned 0xb7
[0091.908] SetErrorMode (uMode=0x1) returned 0x0
[0091.909] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x59f3080, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xd0)) returned 1
[0091.909] GetLastError () returned 0xb7
[0091.909] SetErrorMode (uMode=0x0) returned 0x1
[0091.909] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.lanran2.0.5")) returned 1
[0091.909] GetLastError () returned 0xb7
[0091.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", lpFilePart=0x0) returned 0x78
[0091.909] GetLastError () returned 0xb7
[0091.909] SetErrorMode (uMode=0x1) returned 0x0
[0091.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.910] GetLastError () returned 0x0
[0091.910] GetFileType (hFile=0x220) returned 0x1
[0091.910] GetFileType (hFile=0x220) returned 0x1
[0091.910] ReadFile (in: hFile=0x220, lpBuffer=0x26e4888, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x26e4888*, lpNumberOfBytesRead=0x39ea98*=0x6c, lpOverlapped=0x0) returned 1
[0091.910] GetLastError () returned 0x0
[0091.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", lpFilePart=0x0) returned 0x78
[0091.939] GetLastError () returned 0x0
[0091.939] SetErrorMode (uMode=0x1) returned 0x0
[0091.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.940] GetLastError () returned 0xb7
[0091.940] GetFileType (hFile=0x220) returned 0x1
[0091.940] GetFileType (hFile=0x220) returned 0x1
[0091.940] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", lpFilePart=0x0) returned 0x78
[0091.941] GetLastError () returned 0xb7
[0091.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x84
[0091.941] GetLastError () returned 0xb7
[0091.941] SetErrorMode (uMode=0x1) returned 0x0
[0091.941] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0x5a3f340, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1
[0091.941] GetLastError () returned 0xb7
[0091.941] SetErrorMode (uMode=0x0) returned 0x1
[0091.941] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.lanran2.0.5")) returned 1
[0091.942] GetLastError () returned 0xb7
[0091.942] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", lpFilePart=0x0) returned 0x6f
[0091.942] GetLastError () returned 0xb7
[0091.942] SetErrorMode (uMode=0x1) returned 0x0
[0091.942] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.942] GetLastError () returned 0x0
[0091.942] GetFileType (hFile=0x220) returned 0x1
[0091.942] GetFileType (hFile=0x220) returned 0x1
[0091.942] ReadFile (in: hFile=0x220, lpBuffer=0x256ed6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x256ed6c*, lpNumberOfBytesRead=0x39ea98*=0x68, lpOverlapped=0x0) returned 1
[0091.943] GetLastError () returned 0x0
[0091.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", lpFilePart=0x0) returned 0x6f
[0091.962] GetLastError () returned 0x0
[0091.962] SetErrorMode (uMode=0x1) returned 0x0
[0091.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.962] GetLastError () returned 0xb7
[0091.962] GetFileType (hFile=0x220) returned 0x1
[0091.962] GetFileType (hFile=0x220) returned 0x1
[0091.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", lpFilePart=0x0) returned 0x6f
[0091.963] GetLastError () returned 0xb7
[0091.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7b
[0091.963] GetLastError () returned 0xb7
[0091.963] SetErrorMode (uMode=0x1) returned 0x0
[0091.963] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf99e810, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf99e810, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0x5a654a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1
[0091.963] GetLastError () returned 0xb7
[0091.963] SetErrorMode (uMode=0x0) returned 0x1
[0091.963] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.lanran2.0.5")) returned 1
[0091.964] GetLastError () returned 0xb7
[0091.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", lpFilePart=0x0) returned 0x74
[0091.964] GetLastError () returned 0xb7
[0091.964] SetErrorMode (uMode=0x1) returned 0x0
[0091.964] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.964] GetLastError () returned 0x0
[0091.964] GetFileType (hFile=0x220) returned 0x1
[0091.964] GetFileType (hFile=0x220) returned 0x1
[0091.965] ReadFile (in: hFile=0x220, lpBuffer=0x25f94bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x25f94bc*, lpNumberOfBytesRead=0x39ea98*=0xb2, lpOverlapped=0x0) returned 1
[0091.965] GetLastError () returned 0x0
[0091.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", lpFilePart=0x0) returned 0x74
[0091.983] GetLastError () returned 0x0
[0091.983] SetErrorMode (uMode=0x1) returned 0x0
[0091.983] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.984] GetLastError () returned 0xb7
[0091.984] GetFileType (hFile=0x220) returned 0x1
[0091.984] GetFileType (hFile=0x220) returned 0x1
[0091.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", lpFilePart=0x0) returned 0x74
[0091.984] GetLastError () returned 0xb7
[0091.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x80
[0091.984] GetLastError () returned 0xb7
[0091.984] SetErrorMode (uMode=0x1) returned 0x0
[0091.984] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0x5ab1760, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1
[0091.984] GetLastError () returned 0xb7
[0091.985] SetErrorMode (uMode=0x0) returned 0x1
[0091.985] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.lanran2.0.5")) returned 1
[0091.985] GetLastError () returned 0xb7
[0091.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", lpFilePart=0x0) returned 0x70
[0091.985] GetLastError () returned 0xb7
[0091.985] SetErrorMode (uMode=0x1) returned 0x0
[0091.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0091.986] GetLastError () returned 0x0
[0091.986] GetFileType (hFile=0x220) returned 0x1
[0091.986] GetFileType (hFile=0x220) returned 0x1
[0091.986] ReadFile (in: hFile=0x220, lpBuffer=0x2683b60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2683b60*, lpNumberOfBytesRead=0x39ea98*=0xd7, lpOverlapped=0x0) returned 1
[0091.986] GetLastError () returned 0x0
[0092.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", lpFilePart=0x0) returned 0x70
[0092.007] GetLastError () returned 0x0
[0092.007] SetErrorMode (uMode=0x1) returned 0x0
[0092.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0092.007] GetLastError () returned 0xb7
[0092.007] GetFileType (hFile=0x220) returned 0x1
[0092.008] GetFileType (hFile=0x220) returned 0x1
[0092.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", lpFilePart=0x0) returned 0x70
[0092.008] GetLastError () returned 0xb7
[0092.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7c
[0092.008] GetLastError () returned 0xb7
[0092.008] SetErrorMode (uMode=0x1) returned 0x0
[0092.008] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555a9a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555a9a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ad78c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xe0)) returned 1
[0092.008] GetLastError () returned 0xb7
[0092.008] SetErrorMode (uMode=0x0) returned 0x1
[0092.008] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.lanran2.0.5")) returned 1
[0092.009] GetLastError () returned 0xb7
[0092.009] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", lpFilePart=0x0) returned 0x74
[0092.009] GetLastError () returned 0xb7
[0092.009] SetErrorMode (uMode=0x1) returned 0x0
[0092.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0092.009] GetLastError () returned 0x0
[0092.009] GetFileType (hFile=0x220) returned 0x1
[0092.009] GetFileType (hFile=0x220) returned 0x1
[0092.010] ReadFile (in: hFile=0x220, lpBuffer=0x250e254, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x250e254*, lpNumberOfBytesRead=0x39ea98*=0xa9, lpOverlapped=0x0) returned 1
[0092.010] GetLastError () returned 0x0
[0092.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", lpFilePart=0x0) returned 0x74
[0092.034] GetLastError () returned 0x0
[0092.034] SetErrorMode (uMode=0x1) returned 0x0
[0092.035] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0092.035] GetLastError () returned 0xb7
[0092.035] GetFileType (hFile=0x220) returned 0x1
[0092.035] GetFileType (hFile=0x220) returned 0x1
[0092.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", lpFilePart=0x0) returned 0x74
[0092.036] GetLastError () returned 0xb7
[0092.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x80
[0092.036] GetLastError () returned 0xb7
[0092.036] SetErrorMode (uMode=0x1) returned 0x0
[0092.036] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b23b80, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1
[0092.036] GetLastError () returned 0xb7
[0092.036] SetErrorMode (uMode=0x0) returned 0x1
[0092.036] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.lanran2.0.5")) returned 1
[0092.037] GetLastError () returned 0xb7
[0092.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", lpFilePart=0x0) returned 0x6f
[0092.037] GetLastError () returned 0xb7
[0092.037] SetErrorMode (uMode=0x1) returned 0x0
[0092.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0092.037] GetLastError () returned 0x0
[0092.037] GetFileType (hFile=0x220) returned 0x1
[0092.037] GetFileType (hFile=0x220) returned 0x1
[0092.037] ReadFile (in: hFile=0x220, lpBuffer=0x2598d98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2598d98*, lpNumberOfBytesRead=0x39ea98*=0x402, lpOverlapped=0x0) returned 1
[0092.059] GetLastError () returned 0x0
[0092.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", lpFilePart=0x0) returned 0x6f
[0092.088] GetLastError () returned 0x0
[0092.088] SetErrorMode (uMode=0x1) returned 0x0
[0092.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0092.089] GetLastError () returned 0xb7
[0092.089] GetFileType (hFile=0x220) returned 0x1
[0092.089] GetFileType (hFile=0x220) returned 0x1
[0092.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", lpFilePart=0x0) returned 0x6f
[0092.090] GetLastError () returned 0xb7
[0092.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7b
[0092.090] GetLastError () returned 0xb7
[0092.090] SetErrorMode (uMode=0x1) returned 0x0
[0092.090] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5b95fa0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x410)) returned 1
[0092.090] GetLastError () returned 0xb7
[0092.090] SetErrorMode (uMode=0x0) returned 0x1
[0092.090] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.lanran2.0.5")) returned 1
[0092.090] GetLastError () returned 0xb7
[0092.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x4d
[0092.090] GetLastError () returned 0xb7
[0092.091] SetErrorMode (uMode=0x1) returned 0x0
[0092.091] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.091] GetLastError () returned 0xb7
[0092.091] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.091] GetLastError () returned 0xb7
[0092.091] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.091] GetLastError () returned 0xb7
[0092.091] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.091] GetLastError () returned 0x12
[0092.091] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.091] SetErrorMode (uMode=0x0) returned 0x1
[0092.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x4d
[0092.092] GetLastError () returned 0x12
[0092.092] SetErrorMode (uMode=0x1) returned 0x0
[0092.092] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.092] GetLastError () returned 0x12
[0092.092] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.092] GetLastError () returned 0x12
[0092.092] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.092] GetLastError () returned 0x12
[0092.092] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.092] GetLastError () returned 0x12
[0092.092] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.092] SetErrorMode (uMode=0x0) returned 0x1
[0092.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x51
[0092.092] GetLastError () returned 0x12
[0092.092] SetErrorMode (uMode=0x1) returned 0x0
[0092.092] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.093] GetLastError () returned 0x12
[0092.093] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.093] GetLastError () returned 0x12
[0092.093] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.093] GetLastError () returned 0x12
[0092.093] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.093] SetErrorMode (uMode=0x0) returned 0x1
[0092.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x51
[0092.093] GetLastError () returned 0x12
[0092.093] SetErrorMode (uMode=0x1) returned 0x0
[0092.093] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.093] GetLastError () returned 0x12
[0092.093] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.093] GetLastError () returned 0x12
[0092.094] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.094] GetLastError () returned 0x12
[0092.094] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.094] SetErrorMode (uMode=0x0) returned 0x1
[0092.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x4a
[0092.094] GetLastError () returned 0x12
[0092.094] SetErrorMode (uMode=0x1) returned 0x0
[0092.094] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.094] GetLastError () returned 0x12
[0092.094] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.094] GetLastError () returned 0x12
[0092.094] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.094] GetLastError () returned 0x12
[0092.095] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.095] GetLastError () returned 0x12
[0092.095] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.095] GetLastError () returned 0x12
[0092.095] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.095] SetErrorMode (uMode=0x0) returned 0x1
[0092.095] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x4a
[0092.095] GetLastError () returned 0x12
[0092.095] SetErrorMode (uMode=0x1) returned 0x0
[0092.095] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.095] GetLastError () returned 0x12
[0092.095] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.095] GetLastError () returned 0x12
[0092.095] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.095] GetLastError () returned 0x12
[0092.095] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.095] GetLastError () returned 0x12
[0092.095] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.095] GetLastError () returned 0x12
[0092.095] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.096] SetErrorMode (uMode=0x0) returned 0x1
[0092.096] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x4e
[0092.096] GetLastError () returned 0x12
[0092.096] SetErrorMode (uMode=0x1) returned 0x0
[0092.096] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.096] GetLastError () returned 0x12
[0092.096] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.096] GetLastError () returned 0x12
[0092.096] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.096] GetLastError () returned 0x12
[0092.096] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.096] GetLastError () returned 0x12
[0092.096] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.096] SetErrorMode (uMode=0x0) returned 0x1
[0092.096] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x4e
[0092.096] GetLastError () returned 0x12
[0092.096] SetErrorMode (uMode=0x1) returned 0x0
[0092.096] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.097] GetLastError () returned 0x12
[0092.097] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.097] GetLastError () returned 0x12
[0092.097] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.097] GetLastError () returned 0x12
[0092.097] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.097] GetLastError () returned 0x12
[0092.097] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.097] SetErrorMode (uMode=0x0) returned 0x1
[0092.097] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x49
[0092.097] GetLastError () returned 0x12
[0092.097] SetErrorMode (uMode=0x1) returned 0x0
[0092.097] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.097] GetLastError () returned 0x12
[0092.097] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.097] GetLastError () returned 0x12
[0092.097] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.097] GetLastError () returned 0x12
[0092.097] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.097] GetLastError () returned 0x12
[0092.098] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.098] GetLastError () returned 0x12
[0092.098] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.098] GetLastError () returned 0x12
[0092.098] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.098] GetLastError () returned 0x12
[0092.098] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.098] GetLastError () returned 0x12
[0092.098] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.098] SetErrorMode (uMode=0x0) returned 0x1
[0092.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x49
[0092.098] GetLastError () returned 0x12
[0092.098] SetErrorMode (uMode=0x1) returned 0x0
[0092.098] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.098] GetLastError () returned 0x12
[0092.098] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.098] GetLastError () returned 0x12
[0092.098] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.098] GetLastError () returned 0x12
[0092.098] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.098] GetLastError () returned 0x12
[0092.098] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.098] GetLastError () returned 0x12
[0092.099] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.099] GetLastError () returned 0x12
[0092.099] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.099] GetLastError () returned 0x12
[0092.099] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.099] GetLastError () returned 0x12
[0092.099] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.099] SetErrorMode (uMode=0x0) returned 0x1
[0092.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x51
[0092.099] GetLastError () returned 0x12
[0092.099] SetErrorMode (uMode=0x1) returned 0x0
[0092.099] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.100] GetLastError () returned 0x12
[0092.100] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.100] GetLastError () returned 0x12
[0092.100] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.100] GetLastError () returned 0x12
[0092.100] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.100] SetErrorMode (uMode=0x0) returned 0x1
[0092.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x51
[0092.100] GetLastError () returned 0x12
[0092.100] SetErrorMode (uMode=0x1) returned 0x0
[0092.100] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.100] GetLastError () returned 0x12
[0092.100] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.100] GetLastError () returned 0x12
[0092.100] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.100] GetLastError () returned 0x12
[0092.100] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.100] SetErrorMode (uMode=0x0) returned 0x1
[0092.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x51
[0092.101] GetLastError () returned 0x12
[0092.101] SetErrorMode (uMode=0x1) returned 0x0
[0092.101] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.101] GetLastError () returned 0x12
[0092.101] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.101] GetLastError () returned 0x12
[0092.101] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.101] GetLastError () returned 0x12
[0092.101] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.101] SetErrorMode (uMode=0x0) returned 0x1
[0092.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x51
[0092.101] GetLastError () returned 0x12
[0092.101] SetErrorMode (uMode=0x1) returned 0x0
[0092.101] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.101] GetLastError () returned 0x12
[0092.101] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.101] GetLastError () returned 0x12
[0092.101] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.102] GetLastError () returned 0x12
[0092.102] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.102] SetErrorMode (uMode=0x0) returned 0x1
[0092.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x48
[0092.102] GetLastError () returned 0x12
[0092.102] SetErrorMode (uMode=0x1) returned 0x0
[0092.102] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.102] GetLastError () returned 0x12
[0092.102] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.102] GetLastError () returned 0x12
[0092.102] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.102] GetLastError () returned 0x12
[0092.102] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.103] GetLastError () returned 0x12
[0092.103] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.103] GetLastError () returned 0x12
[0092.103] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.103] SetErrorMode (uMode=0x0) returned 0x1
[0092.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x48
[0092.103] GetLastError () returned 0x12
[0092.103] SetErrorMode (uMode=0x1) returned 0x0
[0092.103] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.103] GetLastError () returned 0x12
[0092.103] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.103] GetLastError () returned 0x12
[0092.103] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.103] GetLastError () returned 0x12
[0092.103] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.103] GetLastError () returned 0x12
[0092.103] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.103] GetLastError () returned 0x12
[0092.103] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.103] SetErrorMode (uMode=0x0) returned 0x1
[0092.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x4c
[0092.104] GetLastError () returned 0x12
[0092.104] SetErrorMode (uMode=0x1) returned 0x0
[0092.104] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.104] GetLastError () returned 0x12
[0092.104] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.104] GetLastError () returned 0x12
[0092.104] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.104] GetLastError () returned 0x12
[0092.104] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.104] GetLastError () returned 0x12
[0092.104] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.104] SetErrorMode (uMode=0x0) returned 0x1
[0092.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x4c
[0092.104] GetLastError () returned 0x12
[0092.104] SetErrorMode (uMode=0x1) returned 0x0
[0092.104] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.105] GetLastError () returned 0x12
[0092.105] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.105] GetLastError () returned 0x12
[0092.105] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.105] GetLastError () returned 0x12
[0092.105] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.105] GetLastError () returned 0x12
[0092.105] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.105] SetErrorMode (uMode=0x0) returned 0x1
[0092.105] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x46
[0092.105] GetLastError () returned 0x12
[0092.105] SetErrorMode (uMode=0x1) returned 0x0
[0092.105] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.105] GetLastError () returned 0x12
[0092.105] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.105] GetLastError () returned 0x12
[0092.105] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.105] GetLastError () returned 0x12
[0092.105] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.105] GetLastError () returned 0x12
[0092.105] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.106] GetLastError () returned 0x12
[0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.106] GetLastError () returned 0x12
[0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.106] GetLastError () returned 0x12
[0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.106] GetLastError () returned 0x12
[0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.106] GetLastError () returned 0x12
[0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.106] GetLastError () returned 0x12
[0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.106] GetLastError () returned 0x12
[0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.106] GetLastError () returned 0x12
[0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.106] GetLastError () returned 0x12
[0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.106] GetLastError () returned 0x12
[0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.106] GetLastError () returned 0x12
[0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.106] GetLastError () returned 0x12
[0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.106] GetLastError () returned 0x12
[0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.106] GetLastError () returned 0x12
[0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.106] GetLastError () returned 0x12
[0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.106] GetLastError () returned 0x12
[0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.107] GetLastError () returned 0x12
[0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.107] GetLastError () returned 0x12
[0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.107] GetLastError () returned 0x12
[0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.107] GetLastError () returned 0x12
[0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.107] GetLastError () returned 0x12
[0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.107] GetLastError () returned 0x12
[0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.107] GetLastError () returned 0x12
[0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.107] GetLastError () returned 0x12
[0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.107] GetLastError () returned 0x12
[0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.107] GetLastError () returned 0x12
[0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.107] GetLastError () returned 0x12
[0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.107] GetLastError () returned 0x12
[0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.107] GetLastError () returned 0x12
[0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.107] GetLastError () returned 0x12
[0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.107] GetLastError () returned 0x12
[0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.108] GetLastError () returned 0x12
[0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.108] GetLastError () returned 0x12
[0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.108] GetLastError () returned 0x12
[0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.108] GetLastError () returned 0x12
[0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.108] GetLastError () returned 0x12
[0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.108] GetLastError () returned 0x12
[0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.108] GetLastError () returned 0x12
[0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.108] GetLastError () returned 0x12
[0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.108] GetLastError () returned 0x12
[0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.108] GetLastError () returned 0x12
[0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.108] GetLastError () returned 0x12
[0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.108] GetLastError () returned 0x12
[0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.108] GetLastError () returned 0x12
[0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.108] GetLastError () returned 0x12
[0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.109] GetLastError () returned 0x12
[0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.109] GetLastError () returned 0x12
[0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.109] GetLastError () returned 0x12
[0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.109] GetLastError () returned 0x12
[0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.109] GetLastError () returned 0x12
[0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.109] GetLastError () returned 0x12
[0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.109] GetLastError () returned 0x12
[0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.109] GetLastError () returned 0x12
[0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.109] GetLastError () returned 0x12
[0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.109] GetLastError () returned 0x12
[0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.109] GetLastError () returned 0x12
[0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.110] GetLastError () returned 0x12
[0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.110] GetLastError () returned 0x12
[0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.110] GetLastError () returned 0x12
[0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.110] GetLastError () returned 0x12
[0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.110] GetLastError () returned 0x12
[0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.110] GetLastError () returned 0x12
[0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.110] GetLastError () returned 0x12
[0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.110] GetLastError () returned 0x12
[0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.110] GetLastError () returned 0x12
[0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.110] GetLastError () returned 0x12
[0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.110] GetLastError () returned 0x12
[0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.111] GetLastError () returned 0x12
[0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.111] GetLastError () returned 0x12
[0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.111] GetLastError () returned 0x12
[0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.111] GetLastError () returned 0x12
[0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.111] GetLastError () returned 0x12
[0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.111] GetLastError () returned 0x12
[0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.111] GetLastError () returned 0x12
[0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.111] GetLastError () returned 0x12
[0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.111] GetLastError () returned 0x12
[0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.111] GetLastError () returned 0x12
[0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.111] GetLastError () returned 0x12
[0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.112] GetLastError () returned 0x12
[0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.112] GetLastError () returned 0x12
[0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.112] GetLastError () returned 0x12
[0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.112] GetLastError () returned 0x12
[0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.112] GetLastError () returned 0x12
[0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.112] GetLastError () returned 0x12
[0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.112] GetLastError () returned 0x12
[0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.112] GetLastError () returned 0x12
[0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.112] GetLastError () returned 0x12
[0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.112] GetLastError () returned 0x12
[0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.112] GetLastError () returned 0x12
[0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.113] GetLastError () returned 0x12
[0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.113] GetLastError () returned 0x12
[0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.113] GetLastError () returned 0x12
[0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.113] GetLastError () returned 0x12
[0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.113] GetLastError () returned 0x12
[0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.113] GetLastError () returned 0x12
[0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.113] GetLastError () returned 0x12
[0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.113] GetLastError () returned 0x12
[0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.113] GetLastError () returned 0x12
[0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.113] GetLastError () returned 0x12
[0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.114] GetLastError () returned 0x12
[0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.114] GetLastError () returned 0x12
[0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.114] GetLastError () returned 0x12
[0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.114] GetLastError () returned 0x12
[0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.114] GetLastError () returned 0x12
[0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.114] GetLastError () returned 0x12
[0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.114] GetLastError () returned 0x12
[0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.114] GetLastError () returned 0x12
[0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.114] GetLastError () returned 0x12
[0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.114] GetLastError () returned 0x12
[0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.114] GetLastError () returned 0x12
[0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.115] GetLastError () returned 0x12
[0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.115] GetLastError () returned 0x12
[0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.115] GetLastError () returned 0x12
[0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.115] GetLastError () returned 0x12
[0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.115] GetLastError () returned 0x12
[0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.115] GetLastError () returned 0x12
[0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.115] GetLastError () returned 0x12
[0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.115] GetLastError () returned 0x12
[0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.115] GetLastError () returned 0x12
[0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.115] GetLastError () returned 0x12
[0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.115] GetLastError () returned 0x12
[0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.115] GetLastError () returned 0x12
[0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.115] GetLastError () returned 0x12
[0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.115] GetLastError () returned 0x12
[0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.116] GetLastError () returned 0x12
[0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.116] GetLastError () returned 0x12
[0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.116] GetLastError () returned 0x12
[0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.116] GetLastError () returned 0x12
[0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.116] GetLastError () returned 0x12
[0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.116] GetLastError () returned 0x12
[0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.116] GetLastError () returned 0x12
[0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.116] GetLastError () returned 0x12
[0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.116] GetLastError () returned 0x12
[0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.116] GetLastError () returned 0x12
[0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.116] GetLastError () returned 0x12
[0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.116] GetLastError () returned 0x12
[0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.116] GetLastError () returned 0x12
[0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.116] GetLastError () returned 0x12
[0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.116] GetLastError () returned 0x12
[0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.116] GetLastError () returned 0x12
[0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.117] GetLastError () returned 0x12
[0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.117] GetLastError () returned 0x12
[0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.117] GetLastError () returned 0x12
[0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.117] GetLastError () returned 0x12
[0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.117] GetLastError () returned 0x12
[0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.117] GetLastError () returned 0x12
[0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.117] GetLastError () returned 0x12
[0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.117] GetLastError () returned 0x12
[0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.117] GetLastError () returned 0x12
[0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.117] GetLastError () returned 0x12
[0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0
[0092.117] GetLastError () returned 0x12
[0092.117] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.117] SetErrorMode (uMode=0x0) returned 0x1
[0092.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x46
[0092.118] GetLastError () returned 0x12
[0092.118] SetErrorMode (uMode=0x1) returned 0x0
[0092.118] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.118] GetLastError () returned 0x12
[0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.118] GetLastError () returned 0x12
[0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.118] GetLastError () returned 0x12
[0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.118] GetLastError () returned 0x12
[0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.118] GetLastError () returned 0x12
[0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.118] GetLastError () returned 0x12
[0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.118] GetLastError () returned 0x12
[0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.118] GetLastError () returned 0x12
[0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.118] GetLastError () returned 0x12
[0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.118] GetLastError () returned 0x12
[0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.118] GetLastError () returned 0x12
[0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.118] GetLastError () returned 0x12
[0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.119] GetLastError () returned 0x12
[0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.119] GetLastError () returned 0x12
[0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.119] GetLastError () returned 0x12
[0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.119] GetLastError () returned 0x12
[0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.119] GetLastError () returned 0x12
[0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.119] GetLastError () returned 0x12
[0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.119] GetLastError () returned 0x12
[0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.119] GetLastError () returned 0x12
[0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.119] GetLastError () returned 0x12
[0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.119] GetLastError () returned 0x12
[0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.119] GetLastError () returned 0x12
[0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.119] GetLastError () returned 0x12
[0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.119] GetLastError () returned 0x12
[0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.119] GetLastError () returned 0x12
[0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.119] GetLastError () returned 0x12
[0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.119] GetLastError () returned 0x12
[0092.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.120] GetLastError () returned 0x12
[0092.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.120] GetLastError () returned 0x12
[0092.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.120] GetLastError () returned 0x12
[0092.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.120] GetLastError () returned 0x12
[0092.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.120] GetLastError () returned 0x12
[0092.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.120] GetLastError () returned 0x12
[0092.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.120] GetLastError () returned 0x12
[0092.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1
[0092.120] GetLastError () returned 0x12
[0092.120] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.120] SetErrorMode (uMode=0x0) returned 0x1
[0092.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpFilePart=0x0) returned 0x5c
[0092.121] GetLastError () returned 0x12
[0092.121] SetErrorMode (uMode=0x1) returned 0x0
[0092.121] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.121] GetLastError () returned 0x12
[0092.121] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.121] SetErrorMode (uMode=0x0) returned 0x1
[0092.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpFilePart=0x0) returned 0x5c
[0092.121] GetLastError () returned 0x12
[0092.121] SetErrorMode (uMode=0x1) returned 0x0
[0092.121] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.121] GetLastError () returned 0x12
[0092.122] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.122] SetErrorMode (uMode=0x0) returned 0x1
[0092.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpFilePart=0x0) returned 0x59
[0092.122] GetLastError () returned 0x12
[0092.122] SetErrorMode (uMode=0x1) returned 0x0
[0092.122] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.122] GetLastError () returned 0x12
[0092.123] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.123] SetErrorMode (uMode=0x0) returned 0x1
[0092.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpFilePart=0x0) returned 0x59
[0092.123] GetLastError () returned 0x12
[0092.123] SetErrorMode (uMode=0x1) returned 0x0
[0092.123] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.124] GetLastError () returned 0x12
[0092.124] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.125] SetErrorMode (uMode=0x0) returned 0x1
[0092.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x46
[0092.125] GetLastError () returned 0x12
[0092.125] SetErrorMode (uMode=0x1) returned 0x0
[0092.125] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.125] GetLastError () returned 0x12
[0092.125] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.126] SetErrorMode (uMode=0x0) returned 0x1
[0092.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x46
[0092.126] GetLastError () returned 0x12
[0092.126] SetErrorMode (uMode=0x1) returned 0x0
[0092.126] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.127] GetLastError () returned 0x12
[0092.127] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.130] SetErrorMode (uMode=0x0) returned 0x1
[0092.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x4a
[0092.130] GetLastError () returned 0x12
[0092.130] SetErrorMode (uMode=0x1) returned 0x0
[0092.130] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.130] GetLastError () returned 0x12
[0092.130] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.130] SetErrorMode (uMode=0x0) returned 0x1
[0092.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x4a
[0092.130] GetLastError () returned 0x12
[0092.130] SetErrorMode (uMode=0x1) returned 0x0
[0092.130] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.130] GetLastError () returned 0x12
[0092.131] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.131] SetErrorMode (uMode=0x0) returned 0x1
[0092.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x53
[0092.131] GetLastError () returned 0x12
[0092.131] SetErrorMode (uMode=0x1) returned 0x0
[0092.131] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.131] GetLastError () returned 0x12
[0092.131] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.131] SetErrorMode (uMode=0x0) returned 0x1
[0092.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x53
[0092.131] GetLastError () returned 0x12
[0092.131] SetErrorMode (uMode=0x1) returned 0x0
[0092.131] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.131] GetLastError () returned 0x12
[0092.131] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.132] SetErrorMode (uMode=0x0) returned 0x1
[0092.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x5f
[0092.132] GetLastError () returned 0x12
[0092.132] SetErrorMode (uMode=0x1) returned 0x0
[0092.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.132] GetLastError () returned 0x12
[0092.132] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.132] SetErrorMode (uMode=0x0) returned 0x1
[0092.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x5f
[0092.132] GetLastError () returned 0x12
[0092.132] SetErrorMode (uMode=0x1) returned 0x0
[0092.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.132] GetLastError () returned 0x12
[0092.132] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.132] SetErrorMode (uMode=0x0) returned 0x1
[0092.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x39e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x6d
[0092.133] GetLastError () returned 0x12
[0092.133] SetErrorMode (uMode=0x1) returned 0x0
[0092.133] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.133] GetLastError () returned 0x12
[0092.133] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.133] SetErrorMode (uMode=0x0) returned 0x1
[0092.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x39e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x6d
[0092.133] GetLastError () returned 0x12
[0092.133] SetErrorMode (uMode=0x1) returned 0x0
[0092.133] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.133] GetLastError () returned 0x12
[0092.133] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.133] SetErrorMode (uMode=0x0) returned 0x1
[0092.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x39e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x6c
[0092.133] GetLastError () returned 0x12
[0092.133] SetErrorMode (uMode=0x1) returned 0x0
[0092.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.134] GetLastError () returned 0x12
[0092.134] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.134] SetErrorMode (uMode=0x0) returned 0x1
[0092.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x39e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x6c
[0092.134] GetLastError () returned 0x12
[0092.134] SetErrorMode (uMode=0x1) returned 0x0
[0092.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.134] GetLastError () returned 0x12
[0092.134] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.134] SetErrorMode (uMode=0x0) returned 0x1
[0092.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x68
[0092.134] GetLastError () returned 0x12
[0092.134] SetErrorMode (uMode=0x1) returned 0x0
[0092.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.134] GetLastError () returned 0x12
[0092.134] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.134] SetErrorMode (uMode=0x0) returned 0x1
[0092.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x68
[0092.135] GetLastError () returned 0x12
[0092.135] SetErrorMode (uMode=0x1) returned 0x0
[0092.135] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.135] GetLastError () returned 0x12
[0092.135] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.135] SetErrorMode (uMode=0x0) returned 0x1
[0092.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x5f
[0092.135] GetLastError () returned 0x12
[0092.135] SetErrorMode (uMode=0x1) returned 0x0
[0092.135] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.135] GetLastError () returned 0x12
[0092.135] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.135] SetErrorMode (uMode=0x0) returned 0x1
[0092.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x5f
[0092.135] GetLastError () returned 0x12
[0092.135] SetErrorMode (uMode=0x1) returned 0x0
[0092.135] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.135] GetLastError () returned 0x12
[0092.136] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.136] SetErrorMode (uMode=0x0) returned 0x1
[0092.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b
[0092.136] GetLastError () returned 0x12
[0092.136] SetErrorMode (uMode=0x1) returned 0x0
[0092.136] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.136] GetLastError () returned 0x12
[0092.136] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.136] SetErrorMode (uMode=0x0) returned 0x1
[0092.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b
[0092.136] GetLastError () returned 0x12
[0092.136] SetErrorMode (uMode=0x1) returned 0x0
[0092.136] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.136] GetLastError () returned 0x12
[0092.136] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.137] SetErrorMode (uMode=0x0) returned 0x1
[0092.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x49
[0092.137] GetLastError () returned 0x12
[0092.137] SetErrorMode (uMode=0x1) returned 0x0
[0092.137] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.137] GetLastError () returned 0x12
[0092.137] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.137] SetErrorMode (uMode=0x0) returned 0x1
[0092.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x49
[0092.137] GetLastError () returned 0x12
[0092.137] SetErrorMode (uMode=0x1) returned 0x0
[0092.138] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.138] GetLastError () returned 0x12
[0092.138] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.138] SetErrorMode (uMode=0x0) returned 0x1
[0092.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x46
[0092.138] GetLastError () returned 0x12
[0092.138] SetErrorMode (uMode=0x1) returned 0x0
[0092.138] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.138] GetLastError () returned 0x12
[0092.138] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.139] SetErrorMode (uMode=0x0) returned 0x1
[0092.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x46
[0092.139] GetLastError () returned 0x12
[0092.139] SetErrorMode (uMode=0x1) returned 0x0
[0092.139] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0
[0092.139] GetLastError () returned 0x12
[0092.139] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1
[0092.139] SetErrorMode (uMode=0x0) returned 0x1
[0092.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFilePart=0x0) returned 0x5e
[0092.139] GetLastError () returned 0x12
[0092.139] SetErrorMode (uMode=0x1) returned 0x0
[0092.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0092.139] GetLastError () returned 0x0
[0092.139] GetFileType (hFile=0x220) returned 0x1
[0092.139] SetErrorMode (uMode=0x0) returned 0x1
[0092.139] GetFileType (hFile=0x220) returned 0x1
[0092.141] ReadFile (in: hFile=0x220, lpBuffer=0x37b5e28, nNumberOfBytesToRead=0x9cfab, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x37b5e28*, lpNumberOfBytesRead=0x39eaf8*=0x9cfab, lpOverlapped=0x0) returned 1
[0092.148] GetLastError () returned 0x0
[0092.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFilePart=0x0) returned 0x5e
[0092.224] GetLastError () returned 0x0
[0092.224] SetErrorMode (uMode=0x1) returned 0x0
[0092.224] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0092.229] GetLastError () returned 0xb7
[0092.229] GetFileType (hFile=0x220) returned 0x1
[0092.229] SetErrorMode (uMode=0x0) returned 0x1
[0092.230] GetFileType (hFile=0x220) returned 0x1
[0092.242] CloseHandle (hObject=0x220) returned 1
[0092.244] GetLastError () returned 0xb7
[0092.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFilePart=0x0) returned 0x5e
[0092.244] GetLastError () returned 0xb7
[0092.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x6a
[0092.244] GetLastError () returned 0xb7
[0092.244] SetErrorMode (uMode=0x1) returned 0x0
[0092.244] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5d12d60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x9cfb0)) returned 1
[0092.244] GetLastError () returned 0xb7
[0092.244] SetErrorMode (uMode=0x0) returned 0x1
[0092.244] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.lanran2.0.5")) returned 1
[0092.245] GetLastError () returned 0xb7
[0092.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x3c
[0092.245] GetLastError () returned 0xb7
[0092.245] SetErrorMode (uMode=0x1) returned 0x0
[0092.245] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430
[0092.262] GetLastError () returned 0xb7
[0092.262] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1
[0092.262] SetErrorMode (uMode=0x0) returned 0x1
[0092.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x3c
[0092.262] GetLastError () returned 0x12
[0092.263] SetErrorMode (uMode=0x1) returned 0x0
[0092.263] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430
[0092.263] GetLastError () returned 0x12
[0092.263] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1
[0092.263] SetErrorMode (uMode=0x0) returned 0x1
[0092.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", lpFilePart=0x0) returned 0x44
[0092.264] GetLastError () returned 0x12
[0092.264] SetErrorMode (uMode=0x1) returned 0x0
[0092.264] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430
[0092.264] GetLastError () returned 0x12
[0092.265] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1
[0092.265] SetErrorMode (uMode=0x0) returned 0x1
[0092.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", lpFilePart=0x0) returned 0x44
[0092.265] GetLastError () returned 0x12
[0092.265] SetErrorMode (uMode=0x1) returned 0x0
[0092.265] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430
[0092.266] GetLastError () returned 0x12
[0092.266] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1
[0092.266] SetErrorMode (uMode=0x0) returned 0x1
[0092.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", lpFilePart=0x0) returned 0x35
[0092.266] GetLastError () returned 0x12
[0092.266] SetErrorMode (uMode=0x1) returned 0x0
[0092.266] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430
[0092.267] GetLastError () returned 0x12
[0092.268] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1
[0092.268] SetErrorMode (uMode=0x0) returned 0x1
[0092.268] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", lpFilePart=0x0) returned 0x35
[0092.268] GetLastError () returned 0x12
[0092.268] SetErrorMode (uMode=0x1) returned 0x0
[0092.268] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430
[0092.268] GetLastError () returned 0x12
[0092.269] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1
[0092.269] SetErrorMode (uMode=0x0) returned 0x1
[0092.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", lpFilePart=0x0) returned 0x40
[0092.269] GetLastError () returned 0x12
[0092.269] SetErrorMode (uMode=0x1) returned 0x0
[0092.269] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430
[0092.270] GetLastError () returned 0x12
[0092.270] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1
[0092.270] SetErrorMode (uMode=0x0) returned 0x1
[0092.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", lpFilePart=0x0) returned 0x40
[0092.270] GetLastError () returned 0x12
[0092.270] SetErrorMode (uMode=0x1) returned 0x0
[0092.271] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430
[0092.271] GetLastError () returned 0x12
[0092.271] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1
[0092.271] SetErrorMode (uMode=0x0) returned 0x1
[0092.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3d
[0092.271] GetLastError () returned 0x12
[0092.271] SetErrorMode (uMode=0x1) returned 0x0
[0092.272] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430
[0092.272] GetLastError () returned 0x12
[0092.273] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1
[0092.273] SetErrorMode (uMode=0x0) returned 0x1
[0092.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3d
[0092.273] GetLastError () returned 0x12
[0092.273] SetErrorMode (uMode=0x1) returned 0x0
[0092.273] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430
[0092.274] GetLastError () returned 0x12
[0092.274] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1
[0092.275] SetErrorMode (uMode=0x0) returned 0x1
[0092.275] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpFilePart=0x0) returned 0x4b
[0092.275] GetLastError () returned 0x12
[0092.275] SetErrorMode (uMode=0x1) returned 0x0
[0092.275] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430
[0092.276] GetLastError () returned 0x12
[0092.276] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1
[0092.276] SetErrorMode (uMode=0x0) returned 0x1
[0092.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpFilePart=0x0) returned 0x4b
[0092.277] GetLastError () returned 0x12
[0092.277] SetErrorMode (uMode=0x1) returned 0x0
[0092.277] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430
[0092.277] GetLastError () returned 0x12
[0092.278] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1
[0092.278] SetErrorMode (uMode=0x0) returned 0x1
[0092.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332", lpFilePart=0x0) returned 0x65
[0092.278] GetLastError () returned 0x12
[0092.278] SetErrorMode (uMode=0x1) returned 0x0
[0092.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0092.279] GetLastError () returned 0x0
[0092.279] GetFileType (hFile=0x220) returned 0x1
[0092.279] SetErrorMode (uMode=0x0) returned 0x1
[0092.279] GetFileType (hFile=0x220) returned 0x1
[0092.279] ReadFile (in: hFile=0x220, lpBuffer=0x24c31ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x24c31ac*, lpNumberOfBytesRead=0x39eaf8*=0xa, lpOverlapped=0x0) returned 1
[0092.280] GetLastError () returned 0x0
[0092.280] CloseHandle (hObject=0x220) returned 1
[0092.280] GetLastError () returned 0x0
[0092.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332", lpFilePart=0x0) returned 0x65
[0092.338] GetLastError () returned 0x0
[0092.338] SetErrorMode (uMode=0x1) returned 0x0
[0092.339] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220
[0092.339] GetLastError () returned 0xb7
[0092.339] GetFileType (hFile=0x220) returned 0x1
[0092.339] GetFileType (hFile=0x220) returned 0x1
[0092.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332", lpFilePart=0x0) returned 0x65
[0092.340] GetLastError () returned 0xb7
[0092.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332.LanRan2.0.5", lpFilePart=0x0) returned 0x71
[0092.340] GetLastError () returned 0xb7
[0092.340] SetErrorMode (uMode=0x1) returned 0x0
[0092.340] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5df75a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x10)) returned 1
[0092.340] GetLastError () returned 0xb7
[0092.340] SetErrorMode (uMode=0x0) returned 0x1
[0092.341] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332.lanran2.0.5")) returned 1
[0092.341] GetLastError () returned 0xb7
[0092.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x46
[0092.341] GetLastError () returned 0xb7
[0092.341] SetErrorMode (uMode=0x1) returned 0x0
[0092.341] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.342] GetLastError () returned 0xb7
[0092.342] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.342] SetErrorMode (uMode=0x0) returned 0x1
[0092.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x46
[0092.342] GetLastError () returned 0x12
[0092.342] SetErrorMode (uMode=0x1) returned 0x0
[0092.342] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.343] GetLastError () returned 0x12
[0092.343] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.343] SetErrorMode (uMode=0x0) returned 0x1
[0092.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x57
[0092.343] GetLastError () returned 0x12
[0092.343] SetErrorMode (uMode=0x1) returned 0x0
[0092.343] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.371] GetLastError () returned 0x12
[0092.372] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.373] SetErrorMode (uMode=0x0) returned 0x1
[0092.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x57
[0092.373] GetLastError () returned 0x12
[0092.373] SetErrorMode (uMode=0x1) returned 0x0
[0092.373] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.373] GetLastError () returned 0x12
[0092.373] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.374] SetErrorMode (uMode=0x0) returned 0x1
[0092.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", lpFilePart=0x0) returned 0x67
[0092.374] GetLastError () returned 0x12
[0092.374] SetErrorMode (uMode=0x1) returned 0x0
[0092.374] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.385] GetLastError () returned 0x12
[0092.385] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.386] SetErrorMode (uMode=0x0) returned 0x1
[0092.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", lpFilePart=0x0) returned 0x67
[0092.386] GetLastError () returned 0x12
[0092.386] SetErrorMode (uMode=0x1) returned 0x0
[0092.386] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.387] GetLastError () returned 0x12
[0092.387] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.387] SetErrorMode (uMode=0x0) returned 0x1
[0092.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", lpFilePart=0x0) returned 0x61
[0092.387] GetLastError () returned 0x12
[0092.387] SetErrorMode (uMode=0x1) returned 0x0
[0092.387] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.388] GetLastError () returned 0x12
[0092.388] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.388] SetErrorMode (uMode=0x0) returned 0x1
[0092.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", lpFilePart=0x0) returned 0x61
[0092.388] GetLastError () returned 0x12
[0092.388] SetErrorMode (uMode=0x1) returned 0x0
[0092.388] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.388] GetLastError () returned 0x12
[0092.389] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.389] SetErrorMode (uMode=0x0) returned 0x1
[0092.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", nBufferLength=0x105, lpBuffer=0x39e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", lpFilePart=0x0) returned 0x75
[0092.389] GetLastError () returned 0x12
[0092.389] SetErrorMode (uMode=0x1) returned 0x0
[0092.389] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.389] GetLastError () returned 0x12
[0092.389] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.389] SetErrorMode (uMode=0x0) returned 0x1
[0092.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", nBufferLength=0x105, lpBuffer=0x39e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", lpFilePart=0x0) returned 0x75
[0092.389] GetLastError () returned 0x12
[0092.389] SetErrorMode (uMode=0x1) returned 0x0
[0092.389] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.390] GetLastError () returned 0x12
[0092.390] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.390] SetErrorMode (uMode=0x0) returned 0x1
[0092.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", nBufferLength=0x105, lpBuffer=0x39e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", lpFilePart=0x0) returned 0x79
[0092.390] GetLastError () returned 0x12
[0092.390] SetErrorMode (uMode=0x1) returned 0x0
[0092.390] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.411] GetLastError () returned 0x12
[0092.411] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.411] SetErrorMode (uMode=0x0) returned 0x1
[0092.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", nBufferLength=0x105, lpBuffer=0x39e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", lpFilePart=0x0) returned 0x79
[0092.412] GetLastError () returned 0x12
[0092.412] SetErrorMode (uMode=0x1) returned 0x0
[0092.412] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.412] GetLastError () returned 0x12
[0092.413] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.413] SetErrorMode (uMode=0x0) returned 0x1
[0092.414] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", nBufferLength=0x105, lpBuffer=0x39e450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpFilePart=0x0) returned 0x8c
[0092.414] GetLastError () returned 0x12
[0092.414] SetErrorMode (uMode=0x1) returned 0x0
[0092.414] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.415] GetLastError () returned 0x12
[0092.415] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.415] SetErrorMode (uMode=0x0) returned 0x1
[0092.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", nBufferLength=0x105, lpBuffer=0x39e450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpFilePart=0x0) returned 0x8c
[0092.416] GetLastError () returned 0x12
[0092.416] SetErrorMode (uMode=0x1) returned 0x0
[0092.416] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.416] GetLastError () returned 0x12
[0092.416] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.416] SetErrorMode (uMode=0x0) returned 0x1
[0092.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", lpFilePart=0x0) returned 0x61
[0092.416] GetLastError () returned 0x12
[0092.416] SetErrorMode (uMode=0x1) returned 0x0
[0092.416] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.417] GetLastError () returned 0x12
[0092.417] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.417] SetErrorMode (uMode=0x0) returned 0x1
[0092.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", lpFilePart=0x0) returned 0x61
[0092.417] GetLastError () returned 0x12
[0092.417] SetErrorMode (uMode=0x1) returned 0x0
[0092.417] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.417] GetLastError () returned 0x12
[0092.417] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.417] SetErrorMode (uMode=0x0) returned 0x1
[0092.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", lpFilePart=0x0) returned 0x5f
[0092.417] GetLastError () returned 0x12
[0092.418] SetErrorMode (uMode=0x1) returned 0x0
[0092.418] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.418] GetLastError () returned 0x12
[0092.418] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.418] SetErrorMode (uMode=0x0) returned 0x1
[0092.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", lpFilePart=0x0) returned 0x5f
[0092.418] GetLastError () returned 0x12
[0092.419] SetErrorMode (uMode=0x1) returned 0x0
[0092.419] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.419] GetLastError () returned 0x12
[0092.419] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.419] SetErrorMode (uMode=0x0) returned 0x1
[0092.419] SHGetFolderPathW (in: hwnd=0x0, csidl=6, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned 0x0
[0092.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", lpFilePart=0x0) returned 0x27
[0092.420] GetLastError () returned 0x3f0
[0092.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28
[0092.420] GetLastError () returned 0x3f0
[0092.420] SetErrorMode (uMode=0x1) returned 0x0
[0092.420] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.420] GetLastError () returned 0x3f0
[0092.421] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.421] SetErrorMode (uMode=0x0) returned 0x1
[0092.421] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28
[0092.421] GetLastError () returned 0x12
[0092.421] SetErrorMode (uMode=0x1) returned 0x0
[0092.421] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.421] GetLastError () returned 0x12
[0092.421] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.421] SetErrorMode (uMode=0x0) returned 0x1
[0092.421] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d
[0092.421] GetLastError () returned 0x12
[0092.421] SetErrorMode (uMode=0x1) returned 0x0
[0092.421] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.422] GetLastError () returned 0x12
[0092.422] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.422] SetErrorMode (uMode=0x0) returned 0x1
[0092.422] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d
[0092.422] GetLastError () returned 0x12
[0092.422] SetErrorMode (uMode=0x1) returned 0x0
[0092.422] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.422] GetLastError () returned 0x12
[0092.422] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.422] SetErrorMode (uMode=0x0) returned 0x1
[0092.422] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a
[0092.422] GetLastError () returned 0x12
[0092.422] SetErrorMode (uMode=0x1) returned 0x0
[0092.428] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.458] GetLastError () returned 0x12
[0092.458] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.459] SetErrorMode (uMode=0x0) returned 0x1
[0092.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a
[0092.459] GetLastError () returned 0x12
[0092.459] SetErrorMode (uMode=0x1) returned 0x0
[0092.459] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.460] GetLastError () returned 0x12
[0092.460] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.460] SetErrorMode (uMode=0x0) returned 0x1
[0092.460] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34
[0092.460] GetLastError () returned 0x12
[0092.461] SetErrorMode (uMode=0x1) returned 0x0
[0092.461] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.469] GetLastError () returned 0x12
[0092.469] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.470] SetErrorMode (uMode=0x0) returned 0x1
[0092.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34
[0092.470] GetLastError () returned 0x12
[0092.470] SetErrorMode (uMode=0x1) returned 0x0
[0092.470] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.471] GetLastError () returned 0x12
[0092.471] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.471] SetErrorMode (uMode=0x0) returned 0x1
[0092.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x34
[0092.471] GetLastError () returned 0x12
[0092.471] SetErrorMode (uMode=0x1) returned 0x0
[0092.472] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.473] GetLastError () returned 0x12
[0092.473] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.473] SetErrorMode (uMode=0x0) returned 0x1
[0092.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x34
[0092.474] GetLastError () returned 0x12
[0092.474] SetErrorMode (uMode=0x1) returned 0x0
[0092.474] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.474] GetLastError () returned 0x12
[0092.474] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.475] SetErrorMode (uMode=0x0) returned 0x1
[0092.475] SHGetFolderPathW (in: hwnd=0x0, csidl=6, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned 0x0
[0092.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", lpFilePart=0x0) returned 0x27
[0092.475] GetLastError () returned 0x3f0
[0092.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28
[0092.475] GetLastError () returned 0x3f0
[0092.475] SetErrorMode (uMode=0x1) returned 0x0
[0092.476] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.476] GetLastError () returned 0x3f0
[0092.476] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.476] SetErrorMode (uMode=0x0) returned 0x1
[0092.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28
[0092.476] GetLastError () returned 0x12
[0092.476] SetErrorMode (uMode=0x1) returned 0x0
[0092.476] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.476] GetLastError () returned 0x12
[0092.476] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.476] SetErrorMode (uMode=0x0) returned 0x1
[0092.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d
[0092.477] GetLastError () returned 0x12
[0092.477] SetErrorMode (uMode=0x1) returned 0x0
[0092.477] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.477] GetLastError () returned 0x12
[0092.477] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.477] SetErrorMode (uMode=0x0) returned 0x1
[0092.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d
[0092.477] GetLastError () returned 0x12
[0092.477] SetErrorMode (uMode=0x1) returned 0x0
[0092.477] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.477] GetLastError () returned 0x12
[0092.478] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.478] SetErrorMode (uMode=0x0) returned 0x1
[0092.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a
[0092.478] GetLastError () returned 0x12
[0092.478] SetErrorMode (uMode=0x1) returned 0x0
[0092.478] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.479] GetLastError () returned 0x12
[0092.479] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.479] SetErrorMode (uMode=0x0) returned 0x1
[0092.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a
[0092.479] GetLastError () returned 0x12
[0092.479] SetErrorMode (uMode=0x1) returned 0x0
[0092.479] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.480] GetLastError () returned 0x12
[0092.480] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.481] SetErrorMode (uMode=0x0) returned 0x1
[0092.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34
[0092.481] GetLastError () returned 0x12
[0092.481] SetErrorMode (uMode=0x1) returned 0x0
[0092.481] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.482] GetLastError () returned 0x12
[0092.482] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.482] SetErrorMode (uMode=0x0) returned 0x1
[0092.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34
[0092.482] GetLastError () returned 0x12
[0092.482] SetErrorMode (uMode=0x1) returned 0x0
[0092.483] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.483] GetLastError () returned 0x12
[0092.483] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.484] SetErrorMode (uMode=0x0) returned 0x1
[0092.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x34
[0092.484] GetLastError () returned 0x12
[0092.484] SetErrorMode (uMode=0x1) returned 0x0
[0092.484] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.485] GetLastError () returned 0x12
[0092.485] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.486] SetErrorMode (uMode=0x0) returned 0x1
[0092.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x34
[0092.486] GetLastError () returned 0x12
[0092.486] SetErrorMode (uMode=0x1) returned 0x0
[0092.486] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630
[0092.489] GetLastError () returned 0x12
[0092.489] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1
[0092.490] SetErrorMode (uMode=0x0) returned 0x1
[0092.511] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0
[0092.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x39e7dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d
[0092.511] GetLastError () returned 0x3f0
[0092.523] GdipGetImageRawFormat (image=0x682230, format=0x39ecf4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0
[0092.523] GetLastError () returned 0x3f0
[0092.532] GdipGetImageEncodersSize (numEncoders=0x39eca4, size=0x39eca0) returned 0x0
[0092.532] GetLastError () returned 0x3f0
[0092.533] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x451b30
[0092.534] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x451b30 | out: encoders=0x451b30) returned 0x0
[0092.534] GetLastError () returned 0x3f0
[0092.550] lstrlenW (lpString="Built-in BMP Codec") returned 18
[0092.551] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451cac, Length=0x26 | out: Destination=0x42ee78)
[0092.551] lstrlenW (lpString="BMP") returned 3
[0092.551] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451cd2, Length=0x8 | out: Destination=0x42ee78)
[0092.551] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17
[0092.551] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451cda, Length=0x24 | out: Destination=0x42ee78)
[0092.551] lstrlenW (lpString="image/bmp") returned 9
[0092.551] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451cfe, Length=0x14 | out: Destination=0x42ee78)
[0092.551] lstrlenW (lpString="Built-in JPEG Codec") returned 19
[0092.551] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451d16, Length=0x28 | out: Destination=0x42ee78)
[0092.552] lstrlenW (lpString="JPEG") returned 4
[0092.552] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451d3e, Length=0xa | out: Destination=0x42ee78)
[0092.552] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25
[0092.552] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451d48, Length=0x34 | out: Destination=0x42ee78)
[0092.552] lstrlenW (lpString="image/jpeg") returned 10
[0092.552] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451d7c, Length=0x16 | out: Destination=0x42ee78)
[0092.552] lstrlenW (lpString="Built-in GIF Codec") returned 18
[0092.552] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451d96, Length=0x26 | out: Destination=0x42ee78)
[0092.552] lstrlenW (lpString="GIF") returned 3
[0092.552] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451dbc, Length=0x8 | out: Destination=0x42ee78)
[0092.552] lstrlenW (lpString="*.GIF") returned 5
[0092.552] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451dc4, Length=0xc | out: Destination=0x42ee78)
[0092.552] lstrlenW (lpString="image/gif") returned 9
[0092.552] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451dd0, Length=0x14 | out: Destination=0x42ee78)
[0092.552] lstrlenW (lpString="Built-in TIFF Codec") returned 19
[0092.552] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451dfc, Length=0x28 | out: Destination=0x42ee78)
[0092.552] lstrlenW (lpString="TIFF") returned 4
[0092.553] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451e24, Length=0xa | out: Destination=0x42ee78)
[0092.553] lstrlenW (lpString="*.TIF;*.TIFF") returned 12
[0092.553] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451e2e, Length=0x1a | out: Destination=0x42ee78)
[0092.553] lstrlenW (lpString="image/tiff") returned 10
[0092.553] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451e48, Length=0x16 | out: Destination=0x42ee78)
[0092.553] lstrlenW (lpString="Built-in PNG Codec") returned 18
[0092.553] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451e66, Length=0x26 | out: Destination=0x42ee78)
[0092.553] lstrlenW (lpString="PNG") returned 3
[0092.553] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451e8c, Length=0x8 | out: Destination=0x42ee78)
[0092.553] lstrlenW (lpString="*.PNG") returned 5
[0092.553] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451e94, Length=0xc | out: Destination=0x42ee78)
[0092.553] lstrlenW (lpString="image/png") returned 9
[0092.553] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451ea0, Length=0x14 | out: Destination=0x42ee78)
[0092.553] LocalFree (hMem=0x451b30) returned 0x0
[0092.554] GetLastError () returned 0x7f
[0092.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\img.jpg", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\img.jpg", lpFilePart=0x0) returned 0x35
[0092.555] GetLastError () returned 0x7f
[0092.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\img.jpg", nBufferLength=0x105, lpBuffer=0x39e75c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\img.jpg", lpFilePart=0x0) returned 0x35
[0092.555] GetLastError () returned 0x7f
[0092.556] GdipSaveImageToFile (image=0x682230, filename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\img.jpg", clsidEncoder=0x39ecb8*(Data1=0x557cf401, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0
[0094.010] GetLastError () returned 0x0
[0094.015] SystemParametersInfoA (in: uiAction=0x14, uiParam=0x0, pvParam=0x39ea84, fWinIni=0x1 | out: pvParam=0x39ea84) returned 1
[0094.337] GetLastError () returned 0x6
[0094.365] CLSIDFromProgIDEx (in: lpszProgID="sapi.spvoice", lpclsid=0x39eb6c | out: lpclsid=0x39eb6c*(Data1=0x96749377, Data2=0x3391, Data3=0x11d2, Data4=([0]=0x9e, [1]=0xe3, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x79, [6]=0x73, [7]=0x96))) returned 0x0
[0094.570] CoGetClassObject (in: rclsid=0x44dca4*(Data1=0x96749377, Data2=0x3391, Data3=0x11d2, Data4=([0]=0x9e, [1]=0xe3, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x79, [6]=0x73, [7]=0x96)), dwClsContext=0x15, pvReserved=0x0, riid=0x74dca3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x39e9dc | out: ppv=0x39e9dc*=0x56609f0) returned 0x0
[0095.432] SpVoice:IUnknown:QueryInterface (in: This=0x56609f0, riid=0x74eb7ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x39e80c | out: ppvObject=0x39e80c*=0x0) returned 0x80004002
[0095.433] SpVoice:IClassFactory:CreateInstance (in: This=0x56609f0, pUnkOuter=0x0, riid=0x74e47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x39e844 | out: ppvObject=0x39e844*=0x5660a20) returned 0x0
[0096.310] IUnknown:QueryInterface (in: This=0x5660a20, riid=0x74e47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x39e5e8 | out: ppvObject=0x39e5e8*=0x5660a20) returned 0x0
[0096.310] IUnknown:QueryInterface (in: This=0x5660a20, riid=0x74e64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x39e5a4 | out: ppvObject=0x39e5a4*=0x0) returned 0x80004002
[0098.872] IUnknown:QueryInterface (in: This=0x5660a20, riid=0x74d90b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x39e498 | out: ppvObject=0x39e498*=0x5660a48) returned 0x0
[0098.872] IProvideClassInfo:GetClassInfo (in: This=0x5660a48, ppTI=0x39e490 | out: ppTI=0x39e490*=0x4c98ec) returned 0x0
[0098.876] ITypeInfo:RemoteGetTypeAttr (in: This=0x4c98ec, ppTypeAttr=0x39e4a4, pDummy=0xe4f2e4a1 | out: ppTypeAttr=0x39e4a4, pDummy=0xe4f2e4a1) returned 0x0
[0098.877] ITypeInfo:LocalReleaseTypeAttr (This=0x4c98ec) returned 0x439d30
[0098.877] IUnknown:Release (This=0x5660a48) returned 0x2
[0098.877] IUnknown:Release (This=0x4c98ec) returned 0x1
[0098.877] IUnknown:AddRef (This=0x5660a20) returned 0x3
[0098.877] CoGetContextToken (in: pToken=0x39e430 | out: pToken=0x39e430) returned 0x0
[0098.877] CoGetContextToken (in: pToken=0x39e3f4 | out: pToken=0x39e3f4) returned 0x0
[0098.877] CObjectContext::QueryInterface () returned 0x0
[0098.891] CObjectContext::GetCurrentApartmentType () returned 0x0
[0098.891] Release () returned 0x0
[0098.891] CoGetObjectContext (in: riid=0x74e47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aca3c | out: ppv=0x4aca3c*=0x419488) returned 0x0
[0098.891] IUnknown:QueryInterface (in: This=0x5660a20, riid=0x74d423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x39e418 | out: ppvObject=0x39e418*=0x44f868) returned 0x0
[0098.891] IMarshal:GetUnmarshalClass (in: This=0x44f868, riid=0x74e47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x39e420 | out: pCid=0x39e420*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
[0098.892] IUnknown:Release (This=0x44f868) returned 0x3
[0098.892] CoGetContextToken (in: pToken=0x39e428 | out: pToken=0x39e428) returned 0x0
[0098.892] IUnknown:AddRef (This=0x5660a20) returned 0x4
[0098.892] IUnknown:QueryInterface (in: This=0x5660a20, riid=0x74d9767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x39e49c | out: ppvObject=0x39e49c*=0x0) returned 0x80004002
[0098.892] IUnknown:Release (This=0x5660a20) returned 0x3
[0098.892] IUnknown:Release (This=0x5660a20) returned 0x2
[0098.892] SpVoice:IUnknown:Release (This=0x56609f0) returned 0x1
[0098.892] IUnknown:Release (This=0x5660a20) returned 0x1
[0098.934] CoGetContextToken (in: pToken=0x39e868 | out: pToken=0x39e868) returned 0x0
[0098.934] IUnknown:AddRef (This=0x5660a20) returned 0x2
[0098.934] IUnknown:QueryInterface (in: This=0x5660a20, riid=0x74dbf5fc*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x39e8c4 | out: ppvObject=0x39e8c4*=0x5660a38) returned 0x0
[0098.934] IUnknown:Release (This=0x5660a20) returned 0x2
[0098.934] IDispatch:GetIDsOfNames (in: This=0x5660a38, riid=0x74dbf910*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x39e8c0*="speak", cNames=0x1, lcid=0x409, rgDispId=0x39e8b0 | out: rgDispId=0x39e8b0*=12) returned 0x0
[0098.940] IDispatch:Invoke (in: This=0x5660a38, dispIdMember=12, riid=0x74dbf910*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x39e950*(rgvarg=([0]=0x39e8d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Your documents, photos, databases and other important files have been encrypted !, Your documents, photos, databases and other important files have been encrypted , Your documents, photos, databases and other important files have been encrypted !, Your documents, photos, databases and other important files have been encrypted !, Your documents, photos, databases and other important files have been encrypted ! ", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x39e7a8, puArgErr=0x39e848 | out: pDispParams=0x39e950*(rgvarg=([0]=0x39e8d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Your documents, photos, databases and other important files have been encrypted !, Your documents, photos, databases and other important files have been encrypted , Your documents, photos, databases and other important files have been encrypted !, Your documents, photos, databases and other important files have been encrypted !, Your documents, photos, databases and other important files have been encrypted ! ", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x39e7a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x39e848*=0x39e884) returned 0x0
[0114.664] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1
[0114.787] NtdllDefWindowProc_W () returned 0x1
[0125.657] IUnknown:Release (This=0x5660a38) returned 0x1
[0125.684] GetUserNameW (in: lpBuffer=0x42ee78, pcbBuffer=0x39ed14 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x39ed14) returned 1
[0125.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", nBufferLength=0x105, lpBuffer=0x39e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", lpFilePart=0x0) returned 0x38
[0125.686] GetLastError () returned 0x0
[0125.686] SetErrorMode (uMode=0x1) returned 0x0
[0125.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\@___readme___@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x48c
[0125.687] GetLastError () returned 0x0
[0125.687] GetFileType (hFile=0x48c) returned 0x1
[0125.687] SetErrorMode (uMode=0x0) returned 0x1
[0125.688] GetFileType (hFile=0x48c) returned 0x1
[0125.692] WriteFile (in: hFile=0x48c, lpBuffer=0x2582ee0*, nNumberOfBytesToWrite=0x697, lpNumberOfBytesWritten=0x39ec34, lpOverlapped=0x0 | out: lpBuffer=0x2582ee0*, lpNumberOfBytesWritten=0x39ec34*=0x697, lpOverlapped=0x0) returned 1
[0125.692] GetLastError () returned 0x0
[0125.692] CloseHandle (hObject=0x48c) returned 1
[0125.693] GetLastError () returned 0x0
[0125.693] SendMessageW (hWnd=0x301ce, Msg=0x10, wParam=0x0, lParam=0x0) returned 0x0
[0125.716] DestroyCursor (hCursor=0x700f9) returned 1
[0125.716] GetLastError () returned 0x0
[0125.716] GetWindowLongW (hWnd=0x301ce, nIndex=-20) returned 327680
[0125.717] DestroyWindow (hWnd=0x301ce) returned 1
[0125.717] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0
[0125.730] PostThreadMessageW (idThread=0xa50, Msg=0x12, wParam=0x0, lParam=0x0) returned 1
[0125.730] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0125.731] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0125.731] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0125.731] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0125.738] OleInitialize (pvReserved=0x0) returned 0x0
[0125.738] GetLastError () returned 0x7f
[0125.738] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x39f1ac | out: lplpMessageFilter=0x39f1ac*=0x0) returned 0x0
[0125.739] PeekMessageW (in: lpMsg=0x39f184, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x39f184) returned 1
[0125.739] GetMessageA (in: lpMsg=0x39f184, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x39f184) returned 0
[0125.739] GetCurrentThreadId () returned 0xa50
[0125.739] EnumThreadWindows (dwThreadId=0xa50, lpfn=0x921952, lParam=0x0) returned 1
[0125.744] IsWindowVisible (hWnd=0x301ca) returned 0
[0125.744] IsWindowVisible (hWnd=0x301c8) returned 0
[0125.744] GetCurrentThreadId () returned 0xa50
[0125.746] GetCurrentThreadId () returned 0xa50
[0125.746] EnumThreadWindows (dwThreadId=0xa50, lpfn=0x921a6a, lParam=0x0) returned 1
[0125.746] IsWindowVisible (hWnd=0x301ca) returned 0
[0125.746] IsWindowVisible (hWnd=0x301c8) returned 0
[0125.746] OleUninitialize ()
[0125.746] GetLastError () returned 0x7f
[0125.746] CloseHandle (hObject=0x198) returned 1
[0125.746] GetLastError () returned 0x7f
[0125.747] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1ba00001) returned 1
[0125.748] CoGetContextToken (in: pToken=0x39fd3c | out: pToken=0x39fd3c) returned 0x0
[0125.748] IUnknown:QueryInterface (in: This=0x419488, riid=0x74e63ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x39fd70 | out: ppvObject=0x39fd70*=0x419494) returned 0x0
[0125.748] IComThreadingInfo:GetCurrentThreadType (in: This=0x419494, pThreadType=0x39fde0 | out: pThreadType=0x39fde0*=1) returned 0x0
[0125.748] IUnknown:Release (This=0x419494) returned 0x1
[0125.749] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x3fc120*=0x98, lpdwindex=0x39fba8 | out: lpdwindex=0x39fba8) returned 0x0
[0125.764] CoGetContextToken (in: pToken=0x39f130 | out: pToken=0x39f130) returned 0x0
[0125.764] CoGetContextToken (in: pToken=0x39f100 | out: pToken=0x39f100) returned 0x0
[0125.764] CoGetContextToken (in: pToken=0x39f090 | out: pToken=0x39f090) returned 0x0
[0125.764] IUnknown:Release (This=0x5660a20) returned 0x0
Thread:
id = 13
os_tid = 0xa8c
Thread:
id = 15
os_tid = 0xa94
[0071.827] CoGetContextToken (in: pToken=0xc4f588 | out: pToken=0xc4f588) returned 0x800401f0
[0071.827] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0125.751] SetWindowLongW (hWnd=0x201d4, nIndex=-4, dwNewLong=2011571677) returned 9570954
[0125.753] SetClassLongW (hWnd=0x201d4, nIndex=-24, dwNewLong=2011571677) returned 0x92094a
[0125.753] PostMessageW (hWnd=0x201d4, Msg=0x10, wParam=0x0, lParam=0x0) returned 1
[0125.753] GetModuleHandleW (lpModuleName=0x0) returned 0xc80000
[0125.754] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.378734a", hInstance=0xc80000) returned 0
[0125.754] GetLastError () returned 0x584
[0125.755] DeleteAtom (nAtom=0xc000) returned 0x0
[0125.755] GetLastError () returned 0x584
[0125.755] FindAtomW (lpString="GDI+Atom_2636_1") returned 0x0
[0125.755] GetLastError () returned 0x2
[0125.756] IsWindow (hWnd=0x301ca) returned 1
[0125.756] GetModuleHandleW (lpModuleName="user32.dll") returned 0x763e0000
[0125.757] GetProcAddress (hModule=0x763e0000, lpProcName="DefWindowProcW") returned 0x77e625dd
[0125.758] SetWindowLongW (hWnd=0x301ca, nIndex=-4, dwNewLong=2011571677) returned 9573482
[0125.758] SetClassLongW (hWnd=0x301ca, nIndex=-24, dwNewLong=2011571677) returned 0x92146a
[0125.758] IsWindow (hWnd=0x301ca) returned 1
[0125.758] DestroyWindow (hWnd=0x301ca) returned 0
[0125.759] PostMessageW (hWnd=0x301ca, Msg=0x10, wParam=0x0, lParam=0x0) returned 1
[0125.759] SetConsoleCtrlHandler (HandlerRoutine=0x92143a, Add=0) returned 1
[0125.760] FindAtomW (lpString="GDI+Atom_2636_1") returned 0x0
[0125.760] GetLastError () returned 0x2
[0125.760] FindAtomW (lpString="GDI+Atom_2636_1") returned 0x0
[0125.760] GetLastError () returned 0x2
[0125.761] DeleteObject (ho=0xe0a0284) returned 1
[0125.761] GetLastError () returned 0x2
[0125.761] DestroyCursor (hCursor=0x11019f) returned 1
[0125.761] GetLastError () returned 0x2
[0125.762] RegCloseKey (hKey=0x80000004) returned 0x0
[0125.762] CloseHandle (hObject=0x194) returned 1
[0125.762] GetLastError () returned 0x2
[0125.763] CoGetContextToken (in: pToken=0xc4dfbc | out: pToken=0xc4dfbc) returned 0x0
[0125.763] IUnknown:QueryInterface (in: This=0x419488, riid=0x74efbeb4*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xc4df90 | out: ppvObject=0xc4df90*=0x419498) returned 0x0
[0125.764] CObjectContext::ContextCallback () returned 0x0
[0125.875] IUnknown:Release (This=0x419498) returned 0x1
[0125.875] IUnknown:Release (This=0x419488) returned 0x0
Thread:
id = 22
os_tid = 0xae4
Thread:
id = 23
os_tid = 0xb24
Thread:
id = 24
os_tid = 0xb28
Thread:
id = 25
os_tid = 0xb2c
Thread:
id = 26
os_tid = 0xb30
Thread:
id = 27
os_tid = 0xb34
Thread:
id = 28
os_tid = 0xb38
Thread:
id = 36
os_tid = 0xb64
Thread:
id = 37
os_tid = 0xb68
Thread:
id = 38
os_tid = 0xb84
Thread:
id = 39
os_tid = 0x5c4
Process:
id = "4"
image_name = "notepad.exe"
filename = "c:\\windows\\system32\\notepad.exe"
page_root = "0x32add000"
os_pid = "0xa58"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "1"
os_parent_pid = "0x964"
cmd_line = "\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt"
cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:000104d7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 477
start_va = 0x10000
end_va = 0x2ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 478
start_va = 0x30000
end_va = 0x33fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 479
start_va = 0x40000
end_va = 0x41fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 480
start_va = 0xd0000
end_va = 0x14ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000000d0000"
filename = ""
Region:
id = 481
start_va = 0x77c50000
end_va = 0x77df8fff
entry_point = 0x77c50000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 482
start_va = 0x7efe0000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007efe0000"
filename = ""
Region:
id = 483
start_va = 0x7ffe0000
end_va = 0x7ffeffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 484
start_va = 0xffc90000
end_va = 0xffcc4fff
entry_point = 0xffc90000
region_type = mapped_file
name = "notepad.exe"
filename = "\\Windows\\System32\\notepad.exe" (normalized: "c:\\windows\\system32\\notepad.exe")
Region:
id = 485
start_va = 0x7fefff70000
end_va = 0x7fefff70fff
entry_point = 0x7fefff70000
region_type = mapped_file
name = "apisetschema.dll"
filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")
Region:
id = 486
start_va = 0x7fffffb0000
end_va = 0x7fffffd2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000007fffffb0000"
filename = ""
Region:
id = 487
start_va = 0x7fffffdc000
end_va = 0x7fffffddfff
entry_point = 0x0
region_type = private
name = "private_0x000007fffffdc000"
filename = ""
Region:
id = 488
start_va = 0x7fffffde000
end_va = 0x7fffffdefff
entry_point = 0x0
region_type = private
name = "private_0x000007fffffde000"
filename = ""
Region:
id = 489
start_va = 0x340000
end_va = 0x43ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000340000"
filename = ""
Region:
id = 490
start_va = 0x77a30000
end_va = 0x77b4efff
entry_point = 0x77a30000
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 491
start_va = 0x7fefde60000
end_va = 0x7fefdecafff
entry_point = 0x7fefde60000
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 492
start_va = 0x10000
end_va = 0x1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 493
start_va = 0x50000
end_va = 0xb6fff
entry_point = 0x50000
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 494
start_va = 0x77b50000
end_va = 0x77c49fff
entry_point = 0x77b50000
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 495
start_va = 0x7efe0000
end_va = 0x7f0dffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007efe0000"
filename = ""
Region:
id = 496
start_va = 0x7f0e0000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007f0e0000"
filename = ""
Region:
id = 497
start_va = 0x7fef7db0000
end_va = 0x7fef7e20fff
entry_point = 0x7fef7db0000
region_type = mapped_file
name = "winspool.drv"
filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv")
Region:
id = 498
start_va = 0x7fefc670000
end_va = 0x7fefc863fff
entry_point = 0x7fefc670000
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll")
Region:
id = 499
start_va = 0x7fefcd60000
end_va = 0x7fefcd6bfff
entry_point = 0x7fefcd60000
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")
Region:
id = 500
start_va = 0x7fefdf70000
end_va = 0x7fefe172fff
entry_point = 0x7fefdf70000
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 501
start_va = 0x7fefe180000
end_va = 0x7fefef07fff
entry_point = 0x7fefe180000
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 502
start_va = 0x7fefefb0000
end_va = 0x7feff0dcfff
entry_point = 0x7fefefb0000
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 503
start_va = 0x7feff210000
end_va = 0x7feff2aefff
entry_point = 0x7feff210000
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 504
start_va = 0x7feff2b0000
end_va = 0x7feff38afff
entry_point = 0x7feff2b0000
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 505
start_va = 0x7feff390000
end_va = 0x7feff3aefff
entry_point = 0x7feff390000
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 506
start_va = 0x7feff3b0000
end_va = 0x7feff3bdfff
entry_point = 0x7feff3b0000
region_type = mapped_file
name = "lpk.dll"
filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll")
Region:
id = 507
start_va = 0x7feff910000
end_va = 0x7feff976fff
entry_point = 0x7feff910000
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 508
start_va = 0x7feff980000
end_va = 0x7feff9f0fff
entry_point = 0x7feff980000
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 509
start_va = 0x7feffb10000
end_va = 0x7feffbe6fff
entry_point = 0x7feffb10000
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 510
start_va = 0x7feffdd0000
end_va = 0x7feffe66fff
entry_point = 0x7feffdd0000
region_type = mapped_file
name = "comdlg32.dll"
filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll")
Region:
id = 511
start_va = 0x7feffe90000
end_va = 0x7fefff58fff
entry_point = 0x7feffe90000
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll")
Region:
id = 512
start_va = 0x20000
end_va = 0x26fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000020000"
filename = ""
Region:
id = 513
start_va = 0xc0000
end_va = 0xc1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000c0000"
filename = ""
Region:
id = 514
start_va = 0x150000
end_va = 0x152fff
entry_point = 0x150000
region_type = mapped_file
name = "notepad.exe.mui"
filename = "\\Windows\\System32\\en-US\\notepad.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\notepad.exe.mui")
Region:
id = 515
start_va = 0x160000
end_va = 0x160fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000160000"
filename = ""
Region:
id = 516
start_va = 0x170000
end_va = 0x17ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000170000"
filename = ""
Region:
id = 517
start_va = 0x180000
end_va = 0x27ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000180000"
filename = ""
Region:
id = 518
start_va = 0x280000
end_va = 0x280fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000280000"
filename = ""
Region:
id = 519
start_va = 0x2a0000
end_va = 0x2a1fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000002a0000"
filename = ""
Region:
id = 520
start_va = 0x440000
end_va = 0x5c7fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000440000"
filename = ""
Region:
id = 521
start_va = 0x5d0000
end_va = 0x750fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000005d0000"
filename = ""
Region:
id = 522
start_va = 0x760000
end_va = 0x1b5ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000760000"
filename = ""
Region:
id = 523
start_va = 0x1b90000
end_va = 0x1c0ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001b90000"
filename = ""
Region:
id = 524
start_va = 0x1c10000
end_va = 0x1ceefff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001c10000"
filename = ""
Region:
id = 525
start_va = 0x1cf0000
end_va = 0x1cfffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001cf0000"
filename = ""
Region:
id = 526
start_va = 0x7fefc090000
end_va = 0x7fefc0a7fff
entry_point = 0x7fefc090000
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")
Region:
id = 527
start_va = 0x7fefc4c0000
end_va = 0x7fefc515fff
entry_point = 0x7fefc4c0000
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 528
start_va = 0x7fefda90000
end_va = 0x7fefda9efff
entry_point = 0x7fefda90000
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")
Region:
id = 529
start_va = 0x7feff3c0000
end_va = 0x7feff3edfff
entry_point = 0x7feff3c0000
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 530
start_va = 0x7feffa00000
end_va = 0x7feffb08fff
entry_point = 0x7feffa00000
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Thread:
id = 12
os_tid = 0xa5c
Process:
id = "5"
image_name = "dllhost.exe"
filename = "c:\\windows\\syswow64\\dllhost.exe"
page_root = "0x1c8fd000"
os_pid = "0xb3c"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "rpc_server"
parent_id = "3"
os_parent_pid = "0xa4c"
cmd_line = "C:\\Windows\\SysWOW64\\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}"
cur_dir = "C:\\Windows\\system32\\"
os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:000104d7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 769
start_va = 0x10000
end_va = 0x1ffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 770
start_va = 0x20000
end_va = 0x20fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 771
start_va = 0x30000
end_va = 0x30fff
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 772
start_va = 0x40000
end_va = 0x40fff
entry_point = 0x40000
region_type = mapped_file
name = "apisetschema.dll"
filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll")
Region:
id = 773
start_va = 0x50000
end_va = 0x53fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000050000"
filename = ""
Region:
id = 774
start_va = 0x60000
end_va = 0xc6fff
entry_point = 0x60000
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 775
start_va = 0xd0000
end_va = 0xd0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000d0000"
filename = ""
Region:
id = 776
start_va = 0xe0000
end_va = 0xe0fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000e0000"
filename = ""
Region:
id = 777
start_va = 0xf0000
end_va = 0x12ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000000f0000"
filename = ""
Region:
id = 778
start_va = 0x130000
end_va = 0x16ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000130000"
filename = ""
Region:
id = 779
start_va = 0x190000
end_va = 0x1cffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000190000"
filename = ""
Region:
id = 780
start_va = 0x1f0000
end_va = 0x1fffff
entry_point = 0x0
region_type = private
name = "private_0x00000000001f0000"
filename = ""
Region:
id = 781
start_va = 0x200000
end_va = 0x23ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 782
start_va = 0x240000
end_va = 0x27ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000240000"
filename = ""
Region:
id = 783
start_va = 0x2a0000
end_va = 0x2dffff
entry_point = 0x0
region_type = private
name = "private_0x00000000002a0000"
filename = ""
Region:
id = 784
start_va = 0x2e0000
end_va = 0x35ffff
entry_point = 0x0
region_type = private
name = "private_0x00000000002e0000"
filename = ""
Region:
id = 785
start_va = 0x3b0000
end_va = 0x3effff
entry_point = 0x0
region_type = private
name = "private_0x00000000003b0000"
filename = ""
Region:
id = 786
start_va = 0x400000
end_va = 0x4fffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 787
start_va = 0x500000
end_va = 0x687fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000500000"
filename = ""
Region:
id = 788
start_va = 0x690000
end_va = 0x810fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000690000"
filename = ""
Region:
id = 789
start_va = 0x820000
end_va = 0x85ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000000820000"
filename = ""
Region:
id = 790
start_va = 0x860000
end_va = 0xb2efff
entry_point = 0x860000
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 791
start_va = 0xbb0000
end_va = 0xbb4fff
entry_point = 0xbb0000
region_type = mapped_file
name = "dllhost.exe"
filename = "\\Windows\\SysWOW64\\dllhost.exe" (normalized: "c:\\windows\\syswow64\\dllhost.exe")
Region:
id = 792
start_va = 0xbc0000
end_va = 0x1fbffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000bc0000"
filename = ""
Region:
id = 793
start_va = 0x1fd0000
end_va = 0x200ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000001fd0000"
filename = ""
Region:
id = 794
start_va = 0x2030000
end_va = 0x206ffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002030000"
filename = ""
Region:
id = 795
start_va = 0x20c0000
end_va = 0x20fffff
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 796
start_va = 0x21b0000
end_va = 0x21effff
entry_point = 0x0
region_type = private
name = "private_0x00000000021b0000"
filename = ""
Region:
id = 797
start_va = 0x2290000
end_va = 0x22cffff
entry_point = 0x0
region_type = private
name = "private_0x0000000002290000"
filename = ""
Region:
id = 798
start_va = 0x22d0000
end_va = 0x23aefff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000022d0000"
filename = ""
Region:
id = 799
start_va = 0x74430000
end_va = 0x7443dfff
entry_point = 0x74430000
region_type = mapped_file
name = "msttsdecwrp.dll"
filename = "\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSDecWrp.dll" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\msttsdecwrp.dll")
Region:
id = 800
start_va = 0x746d0000
end_va = 0x7472efff
entry_point = 0x746d0000
region_type = mapped_file
name = "sxs.dll"
filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")
Region:
id = 801
start_va = 0x74ca0000
end_va = 0x74cdafff
entry_point = 0x74ca0000
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 802
start_va = 0x74ce0000
end_va = 0x74cf5fff
entry_point = 0x74ce0000
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")
Region:
id = 803
start_va = 0x752d0000
end_va = 0x7534ffff
entry_point = 0x752d0000
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")
Region:
id = 804
start_va = 0x75360000
end_va = 0x75367fff
entry_point = 0x75360000
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 805
start_va = 0x75370000
end_va = 0x753cbfff
entry_point = 0x75370000
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 806
start_va = 0x753d0000
end_va = 0x7540efff
entry_point = 0x753d0000
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 807
start_va = 0x75410000
end_va = 0x7541dfff
entry_point = 0x75410000
region_type = mapped_file
name = "rpcrtremote.dll"
filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll")
Region:
id = 808
start_va = 0x75980000
end_va = 0x7598bfff
entry_point = 0x75980000
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 809
start_va = 0x75990000
end_va = 0x759effff
entry_point = 0x75990000
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 810
start_va = 0x75a30000
end_va = 0x75a48fff
entry_point = 0x75a30000
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 811
start_va = 0x75bb0000
end_va = 0x75bf5fff
entry_point = 0x75bb0000
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 812
start_va = 0x75fd0000
end_va = 0x760dffff
entry_point = 0x75fd0000
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 813
start_va = 0x760e0000
end_va = 0x7617ffff
entry_point = 0x760e0000
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")
Region:
id = 814
start_va = 0x763c0000
end_va = 0x763c9fff
entry_point = 0x763c0000
region_type = mapped_file
name = "lpk.dll"
filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")
Region:
id = 815
start_va = 0x763e0000
end_va = 0x764dffff
entry_point = 0x763e0000
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 816
start_va = 0x764e0000
end_va = 0x7656efff
entry_point = 0x764e0000
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 817
start_va = 0x76670000
end_va = 0x7671bfff
entry_point = 0x76670000
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 818
start_va = 0x76720000
end_va = 0x767ebfff
entry_point = 0x76720000
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")
Region:
id = 819
start_va = 0x76890000
end_va = 0x76912fff
entry_point = 0x76890000
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")
Region:
id = 820
start_va = 0x77570000
end_va = 0x775cffff
entry_point = 0x77570000
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 821
start_va = 0x775d0000
end_va = 0x776bffff
entry_point = 0x775d0000
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 822
start_va = 0x776c0000
end_va = 0x7781bfff
entry_point = 0x776c0000
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 823
start_va = 0x77820000
end_va = 0x778affff
entry_point = 0x77820000
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 824
start_va = 0x77990000
end_va = 0x77a2cfff
entry_point = 0x77990000
region_type = mapped_file
name = "usp10.dll"
filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")
Region:
id = 825
start_va = 0x77a30000
end_va = 0x77b4efff
entry_point = 0x0
region_type = private
name = "private_0x0000000077a30000"
filename = ""
Region:
id = 826
start_va = 0x77b50000
end_va = 0x77c49fff
entry_point = 0x0
region_type = private
name = "private_0x0000000077b50000"
filename = ""
Region:
id = 827
start_va = 0x77c50000
end_va = 0x77df8fff
entry_point = 0x77c50000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 828
start_va = 0x77e30000
end_va = 0x77faffff
entry_point = 0x77e30000
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 829
start_va = 0x7efa7000
end_va = 0x7efa9fff
entry_point = 0x0
region_type = private
name = "private_0x000000007efa7000"
filename = ""
Region:
id = 830
start_va = 0x7efaa000
end_va = 0x7efacfff
entry_point = 0x0
region_type = private
name = "private_0x000000007efaa000"
filename = ""
Region:
id = 831
start_va = 0x7efad000
end_va = 0x7efaffff
entry_point = 0x0
region_type = private
name = "private_0x000000007efad000"
filename = ""
Region:
id = 832
start_va = 0x7efb0000
end_va = 0x7efd2fff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007efb0000"
filename = ""
Region:
id = 833
start_va = 0x7efd5000
end_va = 0x7efd7fff
entry_point = 0x0
region_type = private
name = "private_0x000000007efd5000"
filename = ""
Region:
id = 834
start_va = 0x7efd8000
end_va = 0x7efdafff
entry_point = 0x0
region_type = private
name = "private_0x000000007efd8000"
filename = ""
Region:
id = 835
start_va = 0x7efdb000
end_va = 0x7efddfff
entry_point = 0x0
region_type = private
name = "private_0x000000007efdb000"
filename = ""
Region:
id = 836
start_va = 0x7efde000
end_va = 0x7efdefff
entry_point = 0x0
region_type = private
name = "private_0x000000007efde000"
filename = ""
Region:
id = 837
start_va = 0x7efdf000
end_va = 0x7efdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007efdf000"
filename = ""
Region:
id = 838
start_va = 0x7efe0000
end_va = 0x7f0dffff
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007efe0000"
filename = ""
Region:
id = 839
start_va = 0x7f0e0000
end_va = 0x7ffdffff
entry_point = 0x0
region_type = private
name = "private_0x000000007f0e0000"
filename = ""
Region:
id = 840
start_va = 0x7ffe0000
end_va = 0x7ffeffff
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 841
start_va = 0x7fff0000
end_va = 0x7fffffeffff
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 842
start_va = 0x72070000
end_va = 0x72127fff
entry_point = 0x72070000
region_type = mapped_file
name = "wmspdmod.dll"
filename = "\\Windows\\SysWOW64\\WMSPDMOD.DLL" (normalized: "c:\\windows\\syswow64\\wmspdmod.dll")
Region:
id = 843
start_va = 0x74660000
end_va = 0x7466afff
entry_point = 0x74660000
region_type = mapped_file
name = "msdmo.dll"
filename = "\\Windows\\SysWOW64\\msdmo.dll" (normalized: "c:\\windows\\syswow64\\msdmo.dll")
Region:
id = 844
start_va = 0x75a50000
end_va = 0x75a55fff
entry_point = 0x75a50000
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")
Region:
id = 845
start_va = 0x76380000
end_va = 0x763b4fff
entry_point = 0x76380000
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")
Region:
id = 846
start_va = 0x72010000
end_va = 0x72068fff
entry_point = 0x72010000
region_type = mapped_file
name = "mfplat.dll"
filename = "\\Windows\\SysWOW64\\mfplat.dll" (normalized: "c:\\windows\\syswow64\\mfplat.dll")
Region:
id = 847
start_va = 0x74390000
end_va = 0x74396fff
entry_point = 0x74390000
region_type = mapped_file
name = "avrt.dll"
filename = "\\Windows\\SysWOW64\\avrt.dll" (normalized: "c:\\windows\\syswow64\\avrt.dll")
Region:
id = 848
start_va = 0x76180000
end_va = 0x761d6fff
entry_point = 0x76180000
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Thread:
id = 29
os_tid = 0xb58
Thread:
id = 30
os_tid = 0xb54
Thread:
id = 31
os_tid = 0xb50
Thread:
id = 32
os_tid = 0xb4c
Thread:
id = 33
os_tid = 0xb48
Thread:
id = 34
os_tid = 0xb44
Thread:
id = 35
os_tid = 0xb40