# Flog Txt Version 1 # Analyzer Version: 2.3.0 # Analyzer Build Date: Apr 12 2018 14:32:59 # Log Creation Date: 01.07.2018 18:25:18.885 Process: id = "1" image_name = "kryptotrojaner.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe" page_root = "0x5121f000" os_pid = "0x964" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:000104d7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4 start_va = 0x1f0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5 start_va = 0x1330000 end_va = 0x136bfff entry_point = 0x1330000 region_type = mapped_file name = "kryptotrojaner.exe" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe") Region: id = 6 start_va = 0x77c50000 end_va = 0x77df8fff entry_point = 0x77c50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 8 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 9 start_va = 0x7fefff70000 end_va = 0x7fefff70fff entry_point = 0x7fefff70000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 10 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 11 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 12 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 145 start_va = 0x140000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 146 start_va = 0x77a30000 end_va = 0x77b4efff entry_point = 0x77a30000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 147 start_va = 0x7fef82a0000 end_va = 0x7fef830efff entry_point = 0x7fef82a0000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 148 start_va = 0x7fefde60000 end_va = 0x7fefdecafff entry_point = 0x7fefde60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 149 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 150 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 151 start_va = 0x120000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 152 start_va = 0x2f0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 153 start_va = 0x590000 end_va = 0x60ffff entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 154 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 155 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 156 start_va = 0x7fefefb0000 end_va = 0x7feff0dcfff entry_point = 0x7fefefb0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 157 start_va = 0x7feff210000 end_va = 0x7feff2aefff entry_point = 0x7feff210000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 158 start_va = 0x7feff2b0000 end_va = 0x7feff38afff entry_point = 0x7feff2b0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 159 start_va = 0x7feff390000 end_va = 0x7feff3aefff entry_point = 0x7feff390000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 160 start_va = 0x3f0000 end_va = 0x4effff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 161 start_va = 0x570000 end_va = 0x57ffff entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 162 start_va = 0x7fef4580000 end_va = 0x7fef4618fff entry_point = 0x7fef4580000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 163 start_va = 0x77b50000 end_va = 0x77c49fff entry_point = 0x77b50000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 164 start_va = 0x7feff3b0000 end_va = 0x7feff3bdfff entry_point = 0x7feff3b0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 165 start_va = 0x7feff910000 end_va = 0x7feff976fff entry_point = 0x7feff910000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 166 start_va = 0x7feff980000 end_va = 0x7feff9f0fff entry_point = 0x7feff980000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 167 start_va = 0x7feffe90000 end_va = 0x7fefff58fff entry_point = 0x7feffe90000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 168 start_va = 0x610000 end_va = 0x797fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 169 start_va = 0x7feff3c0000 end_va = 0x7feff3edfff entry_point = 0x7feff3c0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 170 start_va = 0x7feffa00000 end_va = 0x7feffb08fff entry_point = 0x7feffa00000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 171 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 172 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 173 start_va = 0x7a0000 end_va = 0x920fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 174 start_va = 0x1370000 end_va = 0x276ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001370000" filename = "" Region: id = 175 start_va = 0x7fefcd60000 end_va = 0x7fefcd6bfff entry_point = 0x7fefcd60000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 176 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 177 start_va = 0x9a0000 end_va = 0xa1ffff entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 178 start_va = 0x757b0000 end_va = 0x75878fff entry_point = 0x757b0000 region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\\msvcr80.dll") Region: id = 179 start_va = 0x7fef3890000 end_va = 0x7fef422cfff entry_point = 0x7fef3890000 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorwks.dll") Region: id = 180 start_va = 0xe0000 end_va = 0xe2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 181 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 182 start_va = 0x100000 end_va = 0x11ffff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 183 start_va = 0xb10000 end_va = 0xb1ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 184 start_va = 0xb20000 end_va = 0xc1ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 185 start_va = 0xde0000 end_va = 0xedffff entry_point = 0x0 region_type = private name = "private_0x0000000000de0000" filename = "" Region: id = 186 start_va = 0x7fefe180000 end_va = 0x7fefef07fff entry_point = 0x7fefe180000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 187 start_va = 0x7ff00030000 end_va = 0x7ff0003ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00030000" filename = "" Region: id = 188 start_va = 0x7ff00040000 end_va = 0x7ff0004ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00040000" filename = "" Region: id = 189 start_va = 0x7ff00050000 end_va = 0x7ff000effff entry_point = 0x0 region_type = private name = "private_0x000007ff00050000" filename = "" Region: id = 190 start_va = 0x7ff000f0000 end_va = 0x7ff000fffff entry_point = 0x0 region_type = private name = "private_0x000007ff000f0000" filename = "" Region: id = 191 start_va = 0x7ff00100000 end_va = 0x7ff0016ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00100000" filename = "" Region: id = 192 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 193 start_va = 0x130000 end_va = 0x130fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 194 start_va = 0x7fefdf70000 end_va = 0x7fefe172fff entry_point = 0x7fefdf70000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 195 start_va = 0xee0000 end_va = 0x11aefff entry_point = 0xee0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 196 start_va = 0x7fefdba0000 end_va = 0x7fefdbaefff entry_point = 0x7fefdba0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 197 start_va = 0x4f0000 end_va = 0x56cfff entry_point = 0x4f0000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 198 start_va = 0xc20000 end_va = 0xd20fff entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 199 start_va = 0x2770000 end_va = 0x1a76ffff entry_point = 0x0 region_type = private name = "private_0x0000000002770000" filename = "" Region: id = 200 start_va = 0x1a770000 end_va = 0x1ae3ffff entry_point = 0x0 region_type = private name = "private_0x000000001a770000" filename = "" Region: id = 201 start_va = 0x1ae50000 end_va = 0x1af4ffff entry_point = 0x0 region_type = private name = "private_0x000000001ae50000" filename = "" Region: id = 202 start_va = 0x7fef29b0000 end_va = 0x7fef388bfff entry_point = 0x7fef29b0000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll") Region: id = 203 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 204 start_va = 0x4f0000 end_va = 0x56cfff entry_point = 0x4f0000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 205 start_va = 0x7fefda90000 end_va = 0x7fefda9efff entry_point = 0x7fefda90000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 206 start_va = 0x7fefc4c0000 end_va = 0x7fefc515fff entry_point = 0x7fefc4c0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 207 start_va = 0x1af50000 end_va = 0x1b16ffff entry_point = 0x0 region_type = private name = "private_0x000000001af50000" filename = "" Region: id = 208 start_va = 0xa20000 end_va = 0xafefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 209 start_va = 0x1c0000 end_va = 0x1c2fff entry_point = 0x1c0000 region_type = mapped_file name = "l_intl.nls" filename = "\\Windows\\System32\\l_intl.nls" (normalized: "c:\\windows\\system32\\l_intl.nls") Region: id = 210 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 211 start_va = 0x1b1d0000 end_va = 0x1b2cffff entry_point = 0x0 region_type = private name = "private_0x000000001b1d0000" filename = "" Region: id = 212 start_va = 0x7fef1df0000 end_va = 0x7fef1f73fff entry_point = 0x7fef1df0000 region_type = mapped_file name = "mscorjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorjit.dll") Region: id = 213 start_va = 0x7fef1f80000 end_va = 0x7fef29a2fff entry_point = 0x7fef1f80000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system\\adff7dd9fe8e541775c46b6363401b22\\system.ni.dll") Region: id = 214 start_va = 0x7fef4370000 end_va = 0x7fef457cfff entry_point = 0x7fef4370000 region_type = mapped_file name = "microsoft.visualbasic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.VisualBas#\\684eae3bcd28cb6d1e6997e6497056e2\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.visualbas#\\684eae3bcd28cb6d1e6997e6497056e2\\microsoft.visualbasic.ni.dll") Region: id = 215 start_va = 0x7ff00170000 end_va = 0x7ff0017ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00170000" filename = "" Region: id = 216 start_va = 0x7fffff10000 end_va = 0x7fffff1ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 217 start_va = 0x7fffff20000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffff20000" filename = "" Region: id = 218 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 219 start_va = 0x1e0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 220 start_va = 0x4f0000 end_va = 0x4fffff entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 221 start_va = 0x500000 end_va = 0x50ffff entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 222 start_va = 0x510000 end_va = 0x514fff entry_point = 0x510000 region_type = mapped_file name = "sorttbls.nlp" filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") Region: id = 223 start_va = 0x520000 end_va = 0x560fff entry_point = 0x520000 region_type = mapped_file name = "sortkey.nlp" filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") Region: id = 224 start_va = 0x580000 end_va = 0x580fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 225 start_va = 0x11b0000 end_va = 0x12affff entry_point = 0x0 region_type = private name = "private_0x00000000011b0000" filename = "" Region: id = 226 start_va = 0x642ff4a0000 end_va = 0x642ff4a9fff entry_point = 0x642ff4a0000 region_type = mapped_file name = "culture.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\culture.dll") Region: id = 227 start_va = 0x580000 end_va = 0x58ffff entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 228 start_va = 0x930000 end_va = 0x983fff entry_point = 0x930000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorrc.dll") Region: id = 229 start_va = 0x7ff00180000 end_va = 0x7ff001bffff entry_point = 0x0 region_type = private name = "private_0x000007ff00180000" filename = "" Region: id = 230 start_va = 0x7fef0b10000 end_va = 0x7fef1ba5fff entry_point = 0x7fef0b10000 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Windows.Forms\\6c352ff9e3603b0e69d969ff7e7632f5\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.windows.forms\\6c352ff9e3603b0e69d969ff7e7632f5\\system.windows.forms.ni.dll") Region: id = 231 start_va = 0x7fef1bb0000 end_va = 0x7fef1de6fff entry_point = 0x7fef1bb0000 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Drawing\\5910828a337dbe848dc90c7ae0a7dee2\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.drawing\\5910828a337dbe848dc90c7ae0a7dee2\\system.drawing.ni.dll") Region: id = 232 start_va = 0x990000 end_va = 0x99ffff entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 233 start_va = 0x7ff001c0000 end_va = 0x7ff001cffff entry_point = 0x0 region_type = private name = "private_0x000007ff001c0000" filename = "" Region: id = 234 start_va = 0xd30000 end_va = 0xd40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d30000" filename = "" Region: id = 235 start_va = 0xb00000 end_va = 0xb0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 236 start_va = 0xd50000 end_va = 0xd5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d50000" filename = "" Region: id = 237 start_va = 0xd60000 end_va = 0xd61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d60000" filename = "" Region: id = 238 start_va = 0xd70000 end_va = 0xd7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d70000" filename = "" Region: id = 239 start_va = 0x7fef0a10000 end_va = 0x7fef0b0cfff entry_point = 0x7fef0a10000 region_type = mapped_file name = "system.runtime.remoting.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Runtime.Remo#\\0fde44651bdf14a3988b955dd94aa318\\System.Runtime.Remoting.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.runtime.remo#\\0fde44651bdf14a3988b955dd94aa318\\system.runtime.remoting.ni.dll") Region: id = 240 start_va = 0x7ff001d0000 end_va = 0x7ff001dffff entry_point = 0x0 region_type = private name = "private_0x000007ff001d0000" filename = "" Region: id = 241 start_va = 0xd80000 end_va = 0xdbffff entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 242 start_va = 0x7fefc2a0000 end_va = 0x7fefc4b4fff entry_point = 0x7fefc2a0000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 245 start_va = 0x12b0000 end_va = 0x12fffff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 246 start_va = 0xdc0000 end_va = 0xddafff entry_point = 0xdc0000 region_type = mapped_file name = "gdipfontcachev1.dat" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat") Region: id = 247 start_va = 0x1b300000 end_va = 0x1b3fffff entry_point = 0x0 region_type = private name = "private_0x000000001b300000" filename = "" Region: id = 248 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 249 start_va = 0x1af50000 end_va = 0x1b04ffff entry_point = 0x0 region_type = private name = "private_0x000000001af50000" filename = "" Region: id = 250 start_va = 0x1b0f0000 end_va = 0x1b16ffff entry_point = 0x0 region_type = private name = "private_0x000000001b0f0000" filename = "" Region: id = 251 start_va = 0x1b400000 end_va = 0x1b4aafff entry_point = 0x1b400000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 252 start_va = 0x1b400000 end_va = 0x1b4aafff entry_point = 0x1b400000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 253 start_va = 0x1b400000 end_va = 0x1c8a8fff entry_point = 0x1b400000 region_type = mapped_file name = "msjh.ttf" filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf") Region: id = 254 start_va = 0x1b400000 end_va = 0x1c8a8fff entry_point = 0x1b400000 region_type = mapped_file name = "msjh.ttf" filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf") Region: id = 255 start_va = 0x1b400000 end_va = 0x1c8c2fff entry_point = 0x1b400000 region_type = mapped_file name = "msyh.ttf" filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf") Region: id = 256 start_va = 0x1b400000 end_va = 0x1c8c2fff entry_point = 0x1b400000 region_type = mapped_file name = "msyh.ttf" filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf") Region: id = 257 start_va = 0x1b400000 end_va = 0x1b822fff entry_point = 0x1b400000 region_type = mapped_file name = "malgun.ttf" filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf") Region: id = 258 start_va = 0x1b400000 end_va = 0x1b822fff entry_point = 0x1b400000 region_type = mapped_file name = "malgun.ttf" filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf") Region: id = 259 start_va = 0x1b830000 end_va = 0x1ba2ffff entry_point = 0x0 region_type = private name = "private_0x000000001b830000" filename = "" Region: id = 260 start_va = 0x1b050000 end_va = 0x1b0effff entry_point = 0x1b050000 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 261 start_va = 0x1b050000 end_va = 0x1b0effff entry_point = 0x1b050000 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 262 start_va = 0x1b050000 end_va = 0x1b0cefff entry_point = 0x1b050000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 263 start_va = 0x1b050000 end_va = 0x1b0cefff entry_point = 0x1b050000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 264 start_va = 0x12b0000 end_va = 0x12bffff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 265 start_va = 0x12c0000 end_va = 0x12e2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000012c0000" filename = "" Region: id = 266 start_va = 0x12f0000 end_va = 0x12fffff entry_point = 0x0 region_type = private name = "private_0x00000000012f0000" filename = "" Region: id = 267 start_va = 0x1b410000 end_va = 0x1b41ffff entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 268 start_va = 0x1b420000 end_va = 0x1b42ffff entry_point = 0x0 region_type = private name = "private_0x000000001b420000" filename = "" Region: id = 269 start_va = 0x1b430000 end_va = 0x1b43ffff entry_point = 0x0 region_type = private name = "private_0x000000001b430000" filename = "" Region: id = 270 start_va = 0x1b450000 end_va = 0x1b45ffff entry_point = 0x0 region_type = private name = "private_0x000000001b450000" filename = "" Region: id = 271 start_va = 0x1b530000 end_va = 0x1b72ffff entry_point = 0x0 region_type = private name = "private_0x000000001b530000" filename = "" Region: id = 272 start_va = 0x1b7d0000 end_va = 0x1b7dffff entry_point = 0x0 region_type = private name = "private_0x000000001b7d0000" filename = "" Region: id = 273 start_va = 0x1ba30000 end_va = 0x1bc2ffff entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 274 start_va = 0x7ff001e0000 end_va = 0x7ff001effff entry_point = 0x0 region_type = private name = "private_0x000007ff001e0000" filename = "" Region: id = 275 start_va = 0x7ff001f0000 end_va = 0x7ff001fffff entry_point = 0x0 region_type = private name = "private_0x000007ff001f0000" filename = "" Region: id = 276 start_va = 0x7fefc090000 end_va = 0x7fefc0a7fff entry_point = 0x7fefc090000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 277 start_va = 0x7fefc670000 end_va = 0x7fefc863fff entry_point = 0x7fefc670000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 278 start_va = 0x4f0000 end_va = 0x4f0fff entry_point = 0x4f0000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 279 start_va = 0x500000 end_va = 0x501fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 280 start_va = 0x1ba30000 end_va = 0x1bb2ffff entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 281 start_va = 0x1bbb0000 end_va = 0x1bc2ffff entry_point = 0x0 region_type = private name = "private_0x000000001bbb0000" filename = "" Region: id = 282 start_va = 0x7fefc520000 end_va = 0x7fefc64bfff entry_point = 0x7fefc520000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 283 start_va = 0x7feffb10000 end_va = 0x7feffbe6fff entry_point = 0x7feffb10000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 284 start_va = 0x4f0000 end_va = 0x4f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 285 start_va = 0x990000 end_va = 0x990fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 286 start_va = 0x7fefef10000 end_va = 0x7fefefa8fff entry_point = 0x7fefef10000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 287 start_va = 0xb00000 end_va = 0xb00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b00000" filename = "" Region: id = 288 start_va = 0x7fefcb60000 end_va = 0x7fefcb8cfff entry_point = 0x7fefcb60000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 289 start_va = 0x7feff730000 end_va = 0x7feff781fff entry_point = 0x7feff730000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 290 start_va = 0xd50000 end_va = 0xd53fff entry_point = 0xd50000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 291 start_va = 0xdc0000 end_va = 0xddefff entry_point = 0xdc0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db") Region: id = 292 start_va = 0xd70000 end_va = 0xd70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d70000" filename = "" Region: id = 293 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 294 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 295 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 296 start_va = 0xd50000 end_va = 0xd53fff entry_point = 0xd50000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 297 start_va = 0x1300000 end_va = 0x132ffff entry_point = 0x1300000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000012.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000012.db") Region: id = 298 start_va = 0x1ae40000 end_va = 0x1ae43fff entry_point = 0x1ae40000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 299 start_va = 0x1b050000 end_va = 0x1b0b5fff entry_point = 0x1b050000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 300 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 301 start_va = 0x1bd90000 end_va = 0x1be8ffff entry_point = 0x0 region_type = private name = "private_0x000000001bd90000" filename = "" Region: id = 302 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 303 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 304 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 305 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 306 start_va = 0x7fefdc90000 end_va = 0x7fefdca9fff entry_point = 0x7fefdc90000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 307 start_va = 0x7fefde20000 end_va = 0x7fefde55fff entry_point = 0x7fefde20000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 308 start_va = 0x7feffbf0000 end_va = 0x7feffdc6fff entry_point = 0x7feffbf0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 309 start_va = 0x1b0c0000 end_va = 0x1b0c6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b0c0000" filename = "" Region: id = 310 start_va = 0x1b0d0000 end_va = 0x1b0d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b0d0000" filename = "" Region: id = 311 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 312 start_va = 0x1be90000 end_va = 0x1c282fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001be90000" filename = "" Region: id = 313 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 314 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 315 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 316 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 317 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 318 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 319 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 320 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 321 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 322 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 323 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 324 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 325 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 326 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 327 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 328 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 329 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 330 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 331 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 332 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 333 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 334 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 335 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 336 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 337 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 338 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 339 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 340 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 341 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 342 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 343 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 344 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 345 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 346 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 347 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 348 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 349 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 350 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 351 start_va = 0x1bc30000 end_va = 0x1bd30fff entry_point = 0x0 region_type = private name = "private_0x000000001bc30000" filename = "" Region: id = 352 start_va = 0x7fefa4f0000 end_va = 0x7fefa546fff entry_point = 0x7fefa4f0000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 353 start_va = 0x7fef7870000 end_va = 0x7fef78a3fff entry_point = 0x7fef7870000 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 354 start_va = 0x1c3c0000 end_va = 0x1c4bffff entry_point = 0x0 region_type = private name = "private_0x000000001c3c0000" filename = "" Region: id = 355 start_va = 0x7feff790000 end_va = 0x7feff907fff entry_point = 0x7feff790000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 356 start_va = 0x7fffff0e000 end_va = 0x7fffff0ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff0e000" filename = "" Region: id = 357 start_va = 0x7feff0e0000 end_va = 0x7feff209fff entry_point = 0x7feff0e0000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 358 start_va = 0x7feff3f0000 end_va = 0x7feff648fff entry_point = 0x7feff3f0000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 359 start_va = 0x7fefdcb0000 end_va = 0x7fefde16fff entry_point = 0x7fefdcb0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 360 start_va = 0x7fefdc40000 end_va = 0x7fefdc4efff entry_point = 0x7fefdc40000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 361 start_va = 0x7fefda60000 end_va = 0x7fefda84fff entry_point = 0x7fefda60000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 362 start_va = 0x1b0e0000 end_va = 0x1b0e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b0e0000" filename = "" Region: id = 363 start_va = 0x1c5b0000 end_va = 0x1c6affff entry_point = 0x0 region_type = private name = "private_0x000000001c5b0000" filename = "" Region: id = 364 start_va = 0x7fffff0c000 end_va = 0x7fffff0dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff0c000" filename = "" Region: id = 392 start_va = 0x1b170000 end_va = 0x1b170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b170000" filename = "" Region: id = 474 start_va = 0x77e10000 end_va = 0x77e16fff entry_point = 0x77e10000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 475 start_va = 0x1bc50000 end_va = 0x1bd4ffff entry_point = 0x0 region_type = private name = "private_0x000000001bc50000" filename = "" Region: id = 476 start_va = 0x7fffff0a000 end_va = 0x7fffff0bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff0a000" filename = "" Region: id = 573 start_va = 0x1b180000 end_va = 0x1b180fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b180000" filename = "" Region: id = 574 start_va = 0x516f00000 end_va = 0x516fc5fff entry_point = 0x516f00000 region_type = mapped_file name = "diasymreader.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\diasymreader.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\diasymreader.dll") Region: id = 598 start_va = 0x748a0000 end_va = 0x74cfdfff entry_point = 0x748a0000 region_type = mapped_file name = "mscorlib.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorlib.dll") Region: id = 599 start_va = 0x72c70000 end_va = 0x730cdfff entry_point = 0x72c70000 region_type = mapped_file name = "mscorlib.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorlib.dll") Region: id = 600 start_va = 0x1b460000 end_va = 0x1b51ffff entry_point = 0x1b460000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 620 start_va = 0x7fef02c0000 end_va = 0x7fef0964fff entry_point = 0x7fef02c0000 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml\\ee795155543768ea67eecddc686a1e9e\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.xml\\ee795155543768ea67eecddc686a1e9e\\system.xml.ni.dll") Region: id = 631 start_va = 0x7ff00200000 end_va = 0x7ff0020ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00200000" filename = "" Region: id = 632 start_va = 0x1b190000 end_va = 0x1b19ffff entry_point = 0x0 region_type = private name = "private_0x000000001b190000" filename = "" Region: id = 633 start_va = 0x7fefbf20000 end_va = 0x7fefc049fff entry_point = 0x7fefbf20000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 634 start_va = 0x1b1a0000 end_va = 0x1b1a0fff entry_point = 0x0 region_type = private name = "private_0x000000001b1a0000" filename = "" Region: id = 635 start_va = 0x1b1b0000 end_va = 0x1b1b0fff entry_point = 0x0 region_type = private name = "private_0x000000001b1b0000" filename = "" Region: id = 636 start_va = 0x1c6b0000 end_va = 0x1cfdffff entry_point = 0x1c6b0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 637 start_va = 0x1b1c0000 end_va = 0x1b1c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b1c0000" filename = "" Region: id = 638 start_va = 0x1b1c0000 end_va = 0x1b1c0fff entry_point = 0x1b1c0000 region_type = mapped_file name = "msctf.dll.mui" filename = "\\Windows\\System32\\en-US\\msctf.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\msctf.dll.mui") Region: id = 639 start_va = 0x1b2d0000 end_va = 0x1b2d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b2d0000" filename = "" Region: id = 640 start_va = 0x1b2d0000 end_va = 0x1b2d2fff entry_point = 0x0 region_type = private name = "private_0x000000001b2d0000" filename = "" Region: id = 644 start_va = 0x1b2d0000 end_va = 0x1b2d3fff entry_point = 0x0 region_type = private name = "private_0x000000001b2d0000" filename = "" Region: id = 645 start_va = 0x1b2e0000 end_va = 0x1b2e0fff entry_point = 0x0 region_type = private name = "private_0x000000001b2e0000" filename = "" Region: id = 646 start_va = 0x1b730000 end_va = 0x1b74cfff entry_point = 0x0 region_type = private name = "private_0x000000001b730000" filename = "" Region: id = 647 start_va = 0x1b2f0000 end_va = 0x1b2f0fff entry_point = 0x0 region_type = private name = "private_0x000000001b2f0000" filename = "" Region: id = 648 start_va = 0x1b2d0000 end_va = 0x1b2d6fff entry_point = 0x0 region_type = private name = "private_0x000000001b2d0000" filename = "" Thread: id = 1 os_tid = 0x968 [0041.705] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0043.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38 [0043.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x2edd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38 [0043.717] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2edc20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0043.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0043.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2edd10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0043.758] GetVersionExW (in: lpVersionInformation=0x2edd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2edd70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0043.789] GetVersionExW (in: lpVersionInformation=0x2edd70*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2edd70*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0047.994] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc13e [0047.995] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc140 [0048.385] GetVersionExW (in: lpVersionInformation=0x2edb70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2edb70*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0048.388] GetCurrentProcess () returned 0xffffffffffffffff [0048.409] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x2edc08 | out: TokenHandle=0x2edc08*=0x190) returned 1 [0048.631] GetCurrentProcess () returned 0xffffffffffffffff [0048.631] GetCurrentThread () returned 0xfffffffffffffffe [0048.631] GetCurrentProcess () returned 0xffffffffffffffff [0048.656] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x2edb40, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x2edb40*=0x18c) returned 1 [0048.675] GetCurrentThreadId () returned 0x968 [0048.800] GetSystemMetrics (nIndex=75) returned 1 [0049.103] lstrlenW (lpString="䅁") returned 1 [0049.193] GetModuleHandleW (lpModuleName="user32.dll") returned 0x77b50000 [0049.195] GetACP () returned 0x4e4 [0049.275] CoTaskMemAlloc (cb=0x10) returned 0x1ac490 [0049.275] GetProcAddress (hModule=0x77b50000, lpProcName="DefWindowProcW") returned 0x77c7b0ac [0049.276] CoTaskMemFree (pv=0x1ac490) [0049.289] GetStockObject (i=5) returned 0x1900015 [0049.291] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000 [0049.293] CoTaskMemAlloc (cb=0x4c) returned 0x18bbc0 [0049.293] RegisterClassW (lpWndClass=0x2ed830) returned 0xc136 [0049.293] CoTaskMemFree (pv=0x18bbc0) [0049.293] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000 [0049.294] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffffffffffd, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x700f4 [0049.344] SetWindowLongPtrW (hWnd=0x700f4, nIndex=-4, dwNewLong=0x77c7b0ac) returned 0x9a150c [0049.393] GetWindowLongPtrW (hWnd=0x700f4, nIndex=-4) returned 0x77c7b0ac [0049.401] lstrlenW (lpString="䅁") returned 1 [0049.410] GetVersionExW (in: lpVersionInformation=0x2eba10*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2eba10*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0049.418] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x2ecac8 | out: phkResult=0x2ecac8*=0x198) returned 0x0 [0049.422] RegQueryValueExW (in: hKey=0x198, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x2eca4c, lpData=0x0, lpcbData=0x2eca48*=0x0 | out: lpType=0x2eca4c*=0x0, lpData=0x0, lpcbData=0x2eca48*=0x0) returned 0x2 [0049.424] RegQueryValueExW (in: hKey=0x198, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x2eca4c, lpData=0x0, lpcbData=0x2eca48*=0x0 | out: lpType=0x2eca4c*=0x0, lpData=0x0, lpcbData=0x2eca48*=0x0) returned 0x2 [0049.426] RegCloseKey (hKey=0x198) returned 0x0 [0049.428] SetWindowLongPtrW (hWnd=0x700f4, nIndex=-4, dwNewLong=0x9a155c) returned 0x77c7b0ac [0049.429] GetWindowLongPtrW (hWnd=0x700f4, nIndex=-4) returned 0x9a155c [0049.429] GetWindowLongPtrW (hWnd=0x700f4, nIndex=-16) returned 0x6c10000 [0049.432] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc137 [0049.434] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x700f4, Msg=0x24, wParam=0x0, lParam=0x2ed270) returned 0x0 [0049.434] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc138 [0049.434] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x700f4, Msg=0x81, wParam=0x0, lParam=0x2ed1f0) returned 0x1 [0049.434] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x700f4, Msg=0x83, wParam=0x0, lParam=0x2ed290) returned 0x0 [0049.435] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x700f4, Msg=0x1, wParam=0x0, lParam=0x2ed1f0) returned 0x0 [0049.441] GetClientRect (in: hWnd=0x700f4, lpRect=0x2eca40 | out: lpRect=0x2eca40) returned 1 [0049.441] GetWindowRect (in: hWnd=0x700f4, lpRect=0x2eca40 | out: lpRect=0x2eca40) returned 1 [0049.449] GetParent (hWnd=0x700f4) returned 0x0 [0050.065] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x2ee090, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x64 [0050.089] IsAppThemed () returned 0x1 [0050.092] CoTaskMemAlloc (cb=0xca) returned 0x1b1960 [0050.092] CreateActCtxA (pActCtx=0x2ee528) returned 0x1a4cd8 [0050.183] CoTaskMemFree (pv=0x1b1960) [0051.262] AdjustWindowRectEx (in: lpRect=0x2ed8d0, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2ed8d0) returned 1 [0051.688] GetSystemDefaultLCID () returned 0x409 [0051.689] GetStockObject (i=17) returned 0x18a0025 [0051.706] GetObjectW (in: h=0x18a0025, c=92, pv=0x2ed440 | out: pv=0x2ed440) returned 92 [0051.708] GetDC (hWnd=0x0) returned 0xb010833 [0051.793] GetCurrentProcessId () returned 0x964 [0051.804] FindAtomW (lpString="GDI+Atom_2404_1") returned 0x0 [0051.806] AddAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0051.905] GdiplusStartup (in: token=0x2ec388, input=0x2ec3a0, output=0x2ec378 | out: token=0x2ec388, output=0x2ec378) returned 0x0 [0051.910] GdipCreateFontFromLogfontW (hdc=0xb010833, logfont=0x1b7a30, font=0x2ed458) returned 0x0 [0052.542] GdipGetFontUnit (font=0x12f41a0, unit=0x2ed360) returned 0x0 [0052.543] GdipGetFontSize (font=0x12f41a0, size=0x2ed360) returned 0x0 [0052.544] GdipGetFontStyle (font=0x12f41a0, style=0x2ed360) returned 0x0 [0052.544] GdipGetFamily (font=0x12f41a0, family=0x2ed360) returned 0x0 [0052.656] GdipGetFontSize (font=0x12f41a0, size=0x2ed2c0) returned 0x0 [0052.656] ReleaseDC (hWnd=0x0, hDC=0xb010833) returned 1 [0052.660] GetDC (hWnd=0x0) returned 0x1701082e [0052.661] GdipCreateFromHDC (hdc=0x1701082e, graphics=0x2ed420) returned 0x0 [0052.665] GdipGetDpiY (graphics=0x1afad3c0, dpi=0x27a2db0) returned 0x0 [0052.666] GdipGetFontHeight (font=0x12f41a0, graphics=0x1afad3c0, height=0x2ed3f0) returned 0x0 [0052.689] GdipGetEmHeight (family=0x12fc5e0, style=0, EmHeight=0x2ed410) returned 0x0 [0052.691] GdipGetLineSpacing (family=0x12fc5e0, style=0, LineSpacing=0x2ed410) returned 0x0 [0052.715] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0052.716] GdipDeleteGraphics (graphics=0x1afad3c0) returned 0x0 [0052.716] ReleaseDC (hWnd=0x0, hDC=0x1701082e) returned 1 [0052.720] GdipCreateFont (fontFamily=0x12fc5e0, emSize=0x0, style=0, unit=0x3, font=0x2ed4b0) returned 0x0 [0052.720] GdipGetFontSize (font=0x1b013a40, size=0x2ed540) returned 0x0 [0052.731] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0052.731] GdipDeleteFont (font=0x12f41a0) returned 0x0 [0052.733] GetDC (hWnd=0x0) returned 0x1701082e [0052.733] GdipCreateFromHDC (hdc=0x1701082e, graphics=0x2ed570) returned 0x0 [0052.733] GdipGetFontHeight (font=0x1b013a40, graphics=0x1afad3c0, height=0x2ed540) returned 0x0 [0052.733] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0052.733] GdipDeleteGraphics (graphics=0x1afad3c0) returned 0x0 [0052.733] ReleaseDC (hWnd=0x0, hDC=0x1701082e) returned 1 [0052.734] GetSystemMetrics (nIndex=5) returned 1 [0052.734] GetSystemMetrics (nIndex=6) returned 1 [0052.746] AdjustWindowRectEx (in: lpRect=0x2ed8b0, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2ed8b0) returned 1 [0052.800] GetSystemMetrics (nIndex=5) returned 1 [0052.800] GetSystemMetrics (nIndex=6) returned 1 [0052.802] AdjustWindowRectEx (in: lpRect=0x2ed7f0, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2ed7f0) returned 1 [0053.726] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x2ec3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38 [0053.913] AdjustWindowRectEx (in: lpRect=0x2ed860, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed860) returned 1 [0053.914] GetSystemMetrics (nIndex=59) returned 1460 [0053.914] GetSystemMetrics (nIndex=60) returned 920 [0053.914] GetSystemMetrics (nIndex=34) returned 132 [0053.914] GetSystemMetrics (nIndex=35) returned 38 [0053.915] AdjustWindowRectEx (in: lpRect=0x2ed4e0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed4e0) returned 1 [0053.929] GetCurrentThreadId () returned 0x968 [0053.929] GetCurrentThreadId () returned 0x968 [0053.976] AdjustWindowRectEx (in: lpRect=0x2ed600, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed600) returned 1 [0053.976] AdjustWindowRectEx (in: lpRect=0x2ed7d0, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed7d0) returned 1 [0053.976] GetSystemMetrics (nIndex=59) returned 1460 [0053.976] GetSystemMetrics (nIndex=60) returned 920 [0053.976] AdjustWindowRectEx (in: lpRect=0x2ed280, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed280) returned 1 [0053.976] AdjustWindowRectEx (in: lpRect=0x2ed450, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed450) returned 1 [0054.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", nBufferLength=0x105, lpBuffer=0x2ed3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", lpFilePart=0x0) returned 0x3b [0054.115] SetErrorMode (uMode=0x1) returned 0x0 [0054.116] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.config"), fInfoLevelId=0x0, lpFileInformation=0x2ed630 | out: lpFileInformation=0x2ed630*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0054.117] SetErrorMode (uMode=0x0) returned 0x1 [0055.644] GetSystemMetrics (nIndex=11) returned 32 [0055.644] GetSystemMetrics (nIndex=12) returned 32 [0055.644] GetDC (hWnd=0x0) returned 0x1701082e [0055.644] GetDeviceCaps (hdc=0x1701082e, index=12) returned 32 [0055.645] GetDeviceCaps (hdc=0x1701082e, index=14) returned 1 [0055.645] ReleaseDC (hWnd=0x0, hDC=0x1701082e) returned 1 [0055.647] CreateIconFromResourceEx (presbits=0x27fd9d0, dwResSize=0x2e8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x110189 [0055.650] CreateCompatibleDC (hdc=0x0) returned 0x31010818 [0055.653] GetDC (hWnd=0x0) returned 0x1701082e [0055.653] GdipCreateFromHDC (hdc=0x1701082e, graphics=0x2ed410) returned 0x0 [0055.654] GdipGetLogFontW (font=0x1b013a40, graphics=0x1afad3c0, logfontW=0x1b7a30) returned 0x0 [0055.654] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0055.654] GdipDeleteGraphics (graphics=0x1afad3c0) returned 0x0 [0055.654] ReleaseDC (hWnd=0x0, hDC=0x1701082e) returned 1 [0055.659] CreateFontIndirectW (lplf=0x1b7a30) returned 0x2e0a0218 [0055.668] SelectObject (hdc=0x31010818, h=0x2e0a0218) returned 0x18a002e [0055.680] GetTextMetricsW (in: hdc=0x31010818, lptm=0x2ed5b0 | out: lptm=0x2ed5b0) returned 1 [0055.681] GetTextExtentPoint32W (in: hdc=0x31010818, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x27fe248 | out: psizl=0x27fe248) returned 1 [0055.683] SelectObject (hdc=0x31010818, h=0x18a002e) returned 0x2e0a0218 [0055.684] DeleteDC (hdc=0x31010818) returned 1 [0055.715] AdjustWindowRectEx (in: lpRect=0x2ed3f0, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed3f0) returned 1 [0055.715] AdjustWindowRectEx (in: lpRect=0x2ed5c0, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed5c0) returned 1 [0055.737] AdjustWindowRectEx (in: lpRect=0x2ed280, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed280) returned 1 [0055.737] AdjustWindowRectEx (in: lpRect=0x2ed450, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ed450) returned 1 [0055.739] AdjustWindowRectEx (in: lpRect=0x2ed560, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2ed560) returned 1 [0055.739] AdjustWindowRectEx (in: lpRect=0x2ed480, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2ed480) returned 1 [0055.739] GetSystemMetrics (nIndex=5) returned 1 [0055.739] GetSystemMetrics (nIndex=6) returned 1 [0055.768] GetCurrentActCtx (in: lphActCtx=0x2ee590 | out: lphActCtx=0x2ee590*=0x0) returned 1 [0055.769] ActivateActCtx (in: hActCtx=0x1a4cd8, lpCookie=0x2ee5d0 | out: hActCtx=0x1a4cd8, lpCookie=0x2ee5d0) returned 1 [0055.779] GetCurrentActCtx (in: lphActCtx=0x2edff0 | out: lphActCtx=0x2edff0*=0x1a4cd8) returned 1 [0055.779] AdjustWindowRectEx (in: lpRect=0x2edea0, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2edea0) returned 1 [0055.779] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000 [0055.779] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x2010000, X=-2147483648, Y=-2147483648, nWidth=10, nHeight=10, hWndParent=0x0, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x301b8 [0055.779] SetWindowLongPtrW (hWnd=0x301b8, nIndex=-4, dwNewLong=0x77c7b0ac) returned 0x9a150c [0055.779] GetWindowLongPtrW (hWnd=0x301b8, nIndex=-4) returned 0x77c7b0ac [0055.779] SetWindowLongPtrW (hWnd=0x301b8, nIndex=-4, dwNewLong=0x9a15ac) returned 0x77c7b0ac [0055.779] GetWindowLongPtrW (hWnd=0x301b8, nIndex=-4) returned 0x9a15ac [0055.779] GetWindowLongPtrW (hWnd=0x301b8, nIndex=-16) returned 0x6c10000 [0055.780] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x81, wParam=0x0, lParam=0x2ed690) returned 0x1 [0055.781] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x83, wParam=0x0, lParam=0x2ed730) returned 0x0 [0055.930] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x1, wParam=0x0, lParam=0x2ed690) returned 0x0 [0055.931] GetClientRect (in: hWnd=0x301b8, lpRect=0x2ecea0 | out: lpRect=0x2ecea0) returned 1 [0055.931] GetWindowRect (in: hWnd=0x301b8, lpRect=0x2ecea0 | out: lpRect=0x2ecea0) returned 1 [0055.931] GetWindowTextLengthW (hWnd=0x301b8) returned 0 [0055.931] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0055.931] GetSystemMetrics (nIndex=42) returned 0 [0055.954] CoTaskMemAlloc (cb=0x6) returned 0x15d570 [0055.954] GetWindowTextW (in: hWnd=0x301b8, lpString=0x15d570, nMaxCount=1 | out: lpString="") returned 0 [0055.954] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xd, wParam=0x1, lParam=0x15d570) returned 0x0 [0055.954] CoTaskMemFree (pv=0x15d570) [0056.007] GetProcessWindowStation () returned 0x44 [0056.013] GetUserObjectInformationA (in: hObj=0x44, nIndex=1, pvInfo=0x27fee00, nLength=0xc, lpnLengthNeeded=0x2ecb90 | out: pvInfo=0x27fee00, lpnLengthNeeded=0x2ecb90) returned 1 [0056.015] SetConsoleCtrlHandler (HandlerRoutine=0x9a163c, Add=1) returned 1 [0056.015] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000 [0056.016] GetClassInfoW (in: hInstance=0x1330000, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0", lpWndClass=0x27fee88 | out: lpWndClass=0x27fee88) returned 0 [0056.017] CoTaskMemAlloc (cb=0x58) returned 0x18c4c0 [0056.017] RegisterClassW (lpWndClass=0x2ecab0) returned 0xc13a [0056.017] CoTaskMemFree (pv=0x18c4c0) [0056.018] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0", lpWindowName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x301ae [0056.018] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x81, wParam=0x0, lParam=0x2ec2f0) returned 0x1 [0056.018] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x83, wParam=0x0, lParam=0x2ec3a0) returned 0x0 [0056.019] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x1, wParam=0x0, lParam=0x2ec290) returned 0x0 [0056.019] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0056.019] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0056.022] GetStartupInfoW (in: lpStartupInfo=0x27ff488 | out: lpStartupInfo=0x27ff488*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0056.022] GetParent (hWnd=0x301b8) returned 0x0 [0056.024] SetWindowLongPtrW (hWnd=0x301b8, nIndex=-8, dwNewLong=0x0) returned 0x0 [0056.025] GetSystemMetrics (nIndex=49) returned 16 [0056.025] GetSystemMetrics (nIndex=50) returned 16 [0056.033] CreateIconFromResourceEx (presbits=0x27ff548, dwResSize=0x2e8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x601a1 [0056.035] SendMessageW (hWnd=0x301b8, Msg=0x80, wParam=0x0, lParam=0x601a1) returned 0x0 [0056.036] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x80, wParam=0x0, lParam=0x601a1) returned 0x0 [0056.036] SendMessageW (hWnd=0x301b8, Msg=0x80, wParam=0x1, lParam=0x110189) returned 0x0 [0056.036] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x80, wParam=0x1, lParam=0x110189) returned 0x0 [0056.036] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xd, wParam=0x104, lParam=0x1b104310) returned 0x0 [0056.036] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xd, wParam=0x104, lParam=0x1b104310) returned 0x0 [0056.037] GetSystemMenu (hWnd=0x301b8, bRevert=0) returned 0x0 [0056.038] GetWindowPlacement (in: hWnd=0x301b8, lpwndpl=0x2edeb0 | out: lpwndpl=0x2edeb0) returned 1 [0056.038] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0056.039] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0056.039] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1 [0056.039] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0056.039] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0056.055] GetClientRect (in: hWnd=0x301b8, lpRect=0x2edfd0 | out: lpRect=0x2edfd0) returned 1 [0056.055] GetClientRect (in: hWnd=0x301b8, lpRect=0x2edeb0 | out: lpRect=0x2edeb0) returned 1 [0056.055] GetWindowRect (in: hWnd=0x301b8, lpRect=0x2edeb0 | out: lpRect=0x2edeb0) returned 1 [0056.056] GetWindowLongPtrW (hWnd=0x301b8, nIndex=-16) returned 0x6c10000 [0056.056] GetWindowLongPtrW (hWnd=0x301b8, nIndex=-16) returned 0x6c10000 [0056.056] GetWindowLongPtrW (hWnd=0x301b8, nIndex=-20) returned 0x50100 [0056.057] SetWindowLongPtrW (hWnd=0x301b8, nIndex=-16, dwNewLong=0x2010000) returned 0x6c10000 [0056.057] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x2edef0) returned 0x0 [0056.057] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x2edef0) returned 0x0 [0056.076] SetWindowLongPtrW (hWnd=0x301b8, nIndex=-20, dwNewLong=0x50000) returned 0x50000 [0056.076] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x2edef0) returned 0x0 [0056.076] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x2edef0) returned 0x0 [0056.077] SetWindowPos (hWnd=0x301b8, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0056.077] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x46, wParam=0x0, lParam=0x2edf90) returned 0x0 [0056.077] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x83, wParam=0x1, lParam=0x2edf60) returned 0x0 [0056.078] GetWindowPlacement (in: hWnd=0x301b8, lpwndpl=0x2ed9f0 | out: lpwndpl=0x2ed9f0) returned 1 [0056.079] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x47, wParam=0x0, lParam=0x2edf90) returned 0x0 [0056.093] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x3, wParam=0x0, lParam=0xc800c8) returned 0x0 [0056.093] GetClientRect (in: hWnd=0x301b8, lpRect=0x2ecca0 | out: lpRect=0x2ecca0) returned 1 [0056.093] GetWindowRect (in: hWnd=0x301b8, lpRect=0x2ecca0 | out: lpRect=0x2ecca0) returned 1 [0056.094] GetWindowTextLengthW (hWnd=0x301b8) returned 0 [0056.094] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0056.094] GetSystemMetrics (nIndex=42) returned 0 [0056.094] CoTaskMemAlloc (cb=0x6) returned 0x15d570 [0056.094] GetWindowTextW (in: hWnd=0x301b8, lpString=0x15d570, nMaxCount=1 | out: lpString="") returned 0 [0056.094] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xd, wParam=0x1, lParam=0x15d570) returned 0x0 [0056.094] CoTaskMemFree (pv=0x15d570) [0056.094] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x5, wParam=0x0, lParam=0x260084) returned 0x0 [0056.095] GetClientRect (in: hWnd=0x301b8, lpRect=0x2ed790 | out: lpRect=0x2ed790) returned 1 [0056.095] GetWindowRect (in: hWnd=0x301b8, lpRect=0x2ed790 | out: lpRect=0x2ed790) returned 1 [0056.096] RedrawWindow (hWnd=0x301b8, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0056.097] GetSystemMenu (hWnd=0x301b8, bRevert=0) returned 0x0 [0056.097] GetWindowPlacement (in: hWnd=0x301b8, lpwndpl=0x2edeb0 | out: lpwndpl=0x2edeb0) returned 1 [0056.097] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0056.099] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0056.099] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1 [0056.099] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0056.099] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0056.099] ShowWindow (hWnd=0x301b8, nCmdShow=5) returned 1 [0056.100] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0056.100] GetCurrentActCtx (in: lphActCtx=0x2ed840 | out: lphActCtx=0x2ed840*=0x1a4cd8) returned 1 [0056.101] GetClassInfoW (in: hInstance=0x0, lpClassName="EDIT", lpWndClass=0x27ffa38 | out: lpWndClass=0x27ffa38) returned 1 [0056.969] CoTaskMemAlloc (cb=0x44) returned 0x11c7a60 [0056.969] RegisterClassW (lpWndClass=0x2ed520) returned 0xc13f [0056.969] CoTaskMemFree (pv=0x11c7a60) [0056.969] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000 [0056.969] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x560100c0, X=12, Y=239, nWidth=100, nHeight=20, hWndParent=0x301b8, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x301b6 [0056.969] SetWindowLongPtrW (hWnd=0x301b6, nIndex=-4, dwNewLong=0x7fefc71975c) returned 0x9b202c [0056.969] GetWindowLongPtrW (hWnd=0x301b6, nIndex=-4) returned 0x7fefc71975c [0056.970] SetWindowLongPtrW (hWnd=0x301b6, nIndex=-4, dwNewLong=0x9b207c) returned 0x7fefc71975c [0056.970] GetWindowLongPtrW (hWnd=0x301b6, nIndex=-4) returned 0x9b207c [0056.970] GetWindowLongPtrW (hWnd=0x301b6, nIndex=-16) returned 0x460100c0 [0056.970] GetWindowLongPtrW (hWnd=0x301b6, nIndex=-12) returned 0x0 [0056.970] SetWindowLongPtrW (hWnd=0x301b6, nIndex=-12, dwNewLong=0x301b6) returned 0x0 [0056.970] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0x81, wParam=0x0, lParam=0x2ecee0) returned 0x1 [0056.971] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0x83, wParam=0x0, lParam=0x2ecf80) returned 0x0 [0056.971] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0x1, wParam=0x0, lParam=0x2ecee0) returned 0x1 [0056.974] SendMessageW (hWnd=0x301b6, Msg=0x2055, wParam=0x301b6, lParam=0x3) returned 0x2 [0056.986] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0056.987] GetWindow (hWnd=0x301b6, uCmd=0x3) returned 0x0 [0056.987] GetClientRect (in: hWnd=0x301b6, lpRect=0x2ec730 | out: lpRect=0x2ec730) returned 1 [0056.987] GetWindowRect (in: hWnd=0x301b6, lpRect=0x2ec730 | out: lpRect=0x2ec730) returned 1 [0056.987] GetParent (hWnd=0x301b6) returned 0x301b8 [0056.987] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x301b8, lpPoints=0x2ec720, cPoints=0x2 | out: lpPoints=0x2ec720) returned -13041864 [0056.988] SendMessageW (hWnd=0x301b6, Msg=0x30, wParam=0x2e0a0218, lParam=0x0) returned 0x1 [0056.989] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0x30, wParam=0x2e0a0218, lParam=0x0) returned 0x1 [0056.990] SendMessageW (hWnd=0x301b6, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0056.990] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0xd3, wParam=0x3, lParam=0x0) returned 0x0 [0056.991] GetSystemMetrics (nIndex=5) returned 1 [0056.991] GetSystemMetrics (nIndex=6) returned 1 [0056.992] SendMessageW (hWnd=0x301b6, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0056.992] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0056.994] SendMessageW (hWnd=0x301b6, Msg=0xd2, wParam=0x0, lParam=0x0) returned 0x0 [0056.994] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0xd2, wParam=0x0, lParam=0x0) returned 0x0 [0057.000] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0x5, wParam=0x0, lParam=0x100060) returned 0x0 [0057.000] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0x3, wParam=0x0, lParam=0xf1000e) returned 0x0 [0057.000] GetClientRect (in: hWnd=0x301b6, lpRect=0x2ec830 | out: lpRect=0x2ec830) returned 1 [0057.000] GetWindowRect (in: hWnd=0x301b6, lpRect=0x2ec830 | out: lpRect=0x2ec830) returned 1 [0057.000] GetParent (hWnd=0x301b6) returned 0x301b8 [0057.000] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x301b8, lpPoints=0x2ec820, cPoints=0x2 | out: lpPoints=0x2ec820) returned -13041864 [0057.001] SendMessageW (hWnd=0x301b6, Msg=0x2210, wParam=0x1b60001, lParam=0x301b6) returned 0x0 [0057.001] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0x2210, wParam=0x1b60001, lParam=0x301b6) returned 0x0 [0057.001] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0057.001] GetParent (hWnd=0x301b6) returned 0x301b8 [0057.004] GetWindowTextLengthW (hWnd=0x301b8) returned 0 [0057.004] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0057.004] GetSystemMetrics (nIndex=42) returned 0 [0057.004] CoTaskMemAlloc (cb=0x6) returned 0x15d570 [0057.004] GetWindowTextW (in: hWnd=0x301b8, lpString=0x15d570, nMaxCount=1 | out: lpString="") returned 0 [0057.004] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xd, wParam=0x1, lParam=0x15d570) returned 0x0 [0057.004] CoTaskMemFree (pv=0x15d570) [0057.249] CoTaskMemAlloc (cb=0x20c) returned 0x1a6710 [0057.249] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1a6710 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0057.249] CoTaskMemFree (pv=0x1a6710) [0057.250] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x2ed2e0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0057.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed360, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0057.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0057.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ed250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0057.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x2ed290, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b [0057.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ed280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0057.280] SetErrorMode (uMode=0x1) returned 0x0 [0057.280] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x2ed490 | out: lpFileInformation=0x2ed490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xed83fc60, ftLastAccessTime.dwHighDateTime=0x1d41168, ftLastWriteTime.dwLowDateTime=0xed83fc60, ftLastWriteTime.dwHighDateTime=0x1d41168, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0057.280] SetErrorMode (uMode=0x0) returned 0x1 [0057.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ed280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0057.280] SetErrorMode (uMode=0x1) returned 0x0 [0057.280] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x2ed490 | out: lpFileInformation=0x2ed490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xed83fc60, ftLastAccessTime.dwHighDateTime=0x1d41168, ftLastWriteTime.dwLowDateTime=0xed83fc60, ftLastWriteTime.dwHighDateTime=0x1d41168, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0057.280] SetErrorMode (uMode=0x0) returned 0x1 [0057.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x2ed080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b [0057.284] SetErrorMode (uMode=0x1) returned 0x0 [0057.286] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFindFileData=0x2ed220 | out: lpFindFileData=0x2ed220) returned 0x18c4c0 [0057.289] FindNextFileW (in: hFindFile=0x18c4c0, lpFindFileData=0x2ed230 | out: lpFindFileData=0x2ed230) returned 0 [0057.289] FindClose (in: hFindFile=0x18c4c0 | out: hFindFile=0x18c4c0) returned 1 [0057.289] SetErrorMode (uMode=0x0) returned 0x1 [0057.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\.", nBufferLength=0x105, lpBuffer=0x2ed140, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0057.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe", nBufferLength=0x105, lpBuffer=0x2ed090, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe", lpFilePart=0x0) returned 0x3a [0057.526] SetErrorMode (uMode=0x1) returned 0x0 [0057.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\templanran.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x1cc [0057.529] GetFileType (hFile=0x1cc) returned 0x1 [0057.529] SetErrorMode (uMode=0x0) returned 0x1 [0057.529] GetFileType (hFile=0x1cc) returned 0x1 [0057.531] WriteFile (in: hFile=0x1cc, lpBuffer=0x280eee8*, nNumberOfBytesToWrite=0x7400, lpNumberOfBytesWritten=0x2ed648, lpOverlapped=0x0 | out: lpBuffer=0x280eee8*, lpNumberOfBytesWritten=0x2ed648*=0x7400, lpOverlapped=0x0) returned 1 [0057.532] CloseHandle (hObject=0x1cc) returned 1 [0057.627] LocalAlloc (uFlags=0x0, uBytes=0x76) returned 0x1b87b0 [0057.746] ShellExecuteExW (in: pExecInfo=0x2816988*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2816988*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x360)) returned 1 [0062.685] LocalFree (hMem=0x1b87b0) returned 0x0 [0062.957] CoTaskMemAlloc (cb=0x20c) returned 0x1a6b70 [0062.957] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1a6b70 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25 [0062.957] CoTaskMemFree (pv=0x1a6b70) [0062.957] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5P5NRG~1\\", lpszLongPath=0x2ed2e0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned 0x1e [0062.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed360, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0062.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed310, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0062.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ed250, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0062.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x2ed290, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b [0062.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ed280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0062.958] SetErrorMode (uMode=0x1) returned 0x0 [0062.958] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x2ed490 | out: lpFileInformation=0x2ed490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xed83fc60, ftLastAccessTime.dwHighDateTime=0x1d41168, ftLastWriteTime.dwLowDateTime=0xed83fc60, ftLastWriteTime.dwHighDateTime=0x1d41168, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0062.958] SetErrorMode (uMode=0x0) returned 0x1 [0062.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ed280, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0062.958] SetErrorMode (uMode=0x1) returned 0x0 [0062.958] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x2ed490 | out: lpFileInformation=0x2ed490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xed83fc60, ftLastAccessTime.dwHighDateTime=0x1d41168, ftLastWriteTime.dwLowDateTime=0xed83fc60, ftLastWriteTime.dwHighDateTime=0x1d41168, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0062.958] SetErrorMode (uMode=0x0) returned 0x1 [0062.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x2ed080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b [0062.958] SetErrorMode (uMode=0x1) returned 0x0 [0062.958] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFindFileData=0x2ed220 | out: lpFindFileData=0x2ed220) returned 0x18c4c0 [0062.959] FindNextFileW (in: hFindFile=0x18c4c0, lpFindFileData=0x2ed230 | out: lpFindFileData=0x2ed230) returned 0 [0062.959] FindClose (in: hFindFile=0x18c4c0 | out: hFindFile=0x18c4c0) returned 1 [0062.959] SetErrorMode (uMode=0x0) returned 0x1 [0062.959] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\.", nBufferLength=0x105, lpBuffer=0x2ed140, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0062.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", nBufferLength=0x105, lpBuffer=0x2ed090, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", lpFilePart=0x0) returned 0x3a [0062.966] SetErrorMode (uMode=0x1) returned 0x0 [0062.966] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temprunsom.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2d8 [0062.967] GetFileType (hFile=0x2d8) returned 0x1 [0062.967] SetErrorMode (uMode=0x0) returned 0x1 [0062.967] GetFileType (hFile=0x2d8) returned 0x1 [0062.967] WriteFile (in: hFile=0x2d8, lpBuffer=0x127a0d98*, nNumberOfBytesToWrite=0x17e00, lpNumberOfBytesWritten=0x2ed648, lpOverlapped=0x0 | out: lpBuffer=0x127a0d98*, lpNumberOfBytesWritten=0x2ed648*=0x17e00, lpOverlapped=0x0) returned 1 [0063.419] CloseHandle (hObject=0x2d8) returned 1 [0063.421] LocalAlloc (uFlags=0x0, uBytes=0x76) returned 0x1b87b0 [0063.421] RtlMoveMemory (in: Destination=0x1b87b0, Source=0x2819648, Length=0x76 | out: Destination=0x1b87b0) [0063.422] ShellExecuteExW (in: pExecInfo=0x2819d50*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2819d50*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x364)) returned 1 [0063.485] LocalFree (hMem=0x1b87b0) returned 0x0 [0066.576] CoTaskMemAlloc (cb=0x204) returned 0x11c8760 [0066.576] GetUserNameW (in: lpBuffer=0x11c8760, pcbBuffer=0x2ed598 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x2ed598) returned 1 [0066.577] CoTaskMemFree (pv=0x11c8760) [0066.578] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0066.579] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x0, lpConsoleScreenBufferInfo=0x2ed4e0 | out: lpConsoleScreenBufferInfo=0x2ed4e0) returned 0 [0066.579] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0066.579] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x0, lpConsoleScreenBufferInfo=0x2ed4e0 | out: lpConsoleScreenBufferInfo=0x2ed4e0) returned 0 [0066.579] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0066.579] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x0, lpConsoleScreenBufferInfo=0x2ed4e0 | out: lpConsoleScreenBufferInfo=0x2ed4e0) returned 0 [0066.853] GetCurrentProcessId () returned 0x964 [0066.942] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x2ec410 | out: lpLuid=0x2ec410*(LowPart=0x14, HighPart=0)) returned 1 [0066.943] GetCurrentProcess () returned 0xffffffffffffffff [0066.943] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x20, TokenHandle=0x2ec430 | out: TokenHandle=0x2ec430*=0x2d0) returned 1 [0066.944] AdjustTokenPrivileges (in: TokenHandle=0x2d0, DisableAllPrivileges=0, NewState=0x281b520*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0066.970] CloseHandle (hObject=0x2d0) returned 1 [0066.978] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x964) returned 0x2d0 [0067.118] EnumProcessModules (in: hProcess=0x2d0, lphModule=0x281b588, cb=0x200, lpcbNeeded=0x2ed448 | out: lphModule=0x281b588, lpcbNeeded=0x2ed448) returned 1 [0067.120] GetModuleInformation (in: hProcess=0x2d0, hModule=0x1330000, lpmodinfo=0x281b7f8, cb=0x18 | out: lpmodinfo=0x281b7f8*(lpBaseOfDll=0x1330000, SizeOfImage=0x3c000, EntryPoint=0x1356ffe)) returned 1 [0067.121] CoTaskMemAlloc (cb=0x804) returned 0x11d06d0 [0067.121] GetModuleBaseNameW (in: hProcess=0x2d0, hModule=0x1330000, lpBaseName=0x11d06d0, nSize=0x800 | out: lpBaseName="KryptoTrojaner.exe") returned 0x12 [0067.121] CoTaskMemFree (pv=0x11d06d0) [0067.122] CoTaskMemAlloc (cb=0x804) returned 0x11d06d0 [0067.122] GetModuleFileNameExW (in: hProcess=0x2d0, hModule=0x1330000, lpFilename=0x11d06d0, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe")) returned 0x38 [0067.122] CoTaskMemFree (pv=0x11d06d0) [0067.122] CloseHandle (hObject=0x2d0) returned 1 [0067.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", nBufferLength=0x105, lpBuffer=0x2ece10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", lpFilePart=0x0) returned 0x38 [0067.128] SetErrorMode (uMode=0x1) returned 0x0 [0067.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\@___readme___@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2d0 [0067.129] GetFileType (hFile=0x2d0) returned 0x1 [0067.129] SetErrorMode (uMode=0x0) returned 0x1 [0067.129] GetFileType (hFile=0x2d0) returned 0x1 [0067.145] WriteFile (in: hFile=0x2d0, lpBuffer=0x2820398*, nNumberOfBytesToWrite=0x696, lpNumberOfBytesWritten=0x2ed378, lpOverlapped=0x0 | out: lpBuffer=0x2820398*, lpNumberOfBytesWritten=0x2ed378*=0x696, lpOverlapped=0x0) returned 1 [0067.147] LocalAlloc (uFlags=0x0, uBytes=0x72) returned 0x1b87b0 [0067.148] RtlMoveMemory (in: Destination=0x1b87b0, Source=0x281dbe8, Length=0x72 | out: Destination=0x1b87b0) [0067.148] ShellExecuteExW (in: pExecInfo=0x2821b68*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2821b68*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x378)) returned 1 [0067.245] LocalFree (hMem=0x1b87b0) returned 0x0 [0067.739] CoTaskMemAlloc (cb=0x204) returned 0x11c8760 [0067.739] GetUserNameW (in: lpBuffer=0x11c8760, pcbBuffer=0x2ed7b8 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x2ed7b8) returned 1 [0067.739] CoTaskMemFree (pv=0x11c8760) [0067.815] GetWindowTextLengthW (hWnd=0x301b6) returned 0 [0067.815] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0067.815] GetSystemMetrics (nIndex=42) returned 0 [0067.815] CoTaskMemAlloc (cb=0x6) returned 0x1b57ea80 [0067.815] GetWindowTextW (in: hWnd=0x301b6, lpString=0x1b57ea80, nMaxCount=1 | out: lpString="") returned 0 [0067.815] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x301b6, Msg=0xd, wParam=0x1, lParam=0x1b57ea80) returned 0x0 [0067.815] CoTaskMemFree (pv=0x1b57ea80) [0067.815] GetFullPathNameW (in: lpFileName="C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html", nBufferLength=0x105, lpBuffer=0x2ed030, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html", lpFilePart=0x0) returned 0x2b [0067.815] SetErrorMode (uMode=0x1) returned 0x0 [0067.816] CreateFileW (lpFileName="C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html" (normalized: "c:\\users\\cerberos\\desktop\\instructions.html"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0068.643] SetErrorMode (uMode=0x0) returned 0x1 [0068.772] GetProcessWindowStation () returned 0x44 [0068.850] GetUserObjectInformationA (in: hObj=0x44, nIndex=1, pvInfo=0x2823f88, nLength=0xc, lpnLengthNeeded=0x2eaf10 | out: pvInfo=0x2823f88, lpnLengthNeeded=0x2eaf10) returned 1 [0069.164] AdjustWindowRectEx (in: lpRect=0x2ead50, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ead50) returned 1 [0071.003] AdjustWindowRectEx (in: lpRect=0x2ead60, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ead60) returned 1 [0071.051] AdjustWindowRectEx (in: lpRect=0x2ead20, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ead20) returned 1 [0071.052] AdjustWindowRectEx (in: lpRect=0x2ead20, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ead20) returned 1 [0071.052] AdjustWindowRectEx (in: lpRect=0x2ead20, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ead20) returned 1 [0071.052] AdjustWindowRectEx (in: lpRect=0x2ead20, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2ead20) returned 1 [0071.053] GetDC (hWnd=0x0) returned 0x1701082e [0071.053] GdipCreateFromHDC (hdc=0x1701082e, graphics=0x2eaa20) returned 0x0 [0071.053] GdipGetFontHeight (font=0x1b013a40, graphics=0x1afad3c0, height=0x2ea9f0) returned 0x0 [0071.053] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0071.053] GdipDeleteGraphics (graphics=0x1afad3c0) returned 0x0 [0071.053] ReleaseDC (hWnd=0x0, hDC=0x1701082e) returned 1 [0071.053] GetSystemMetrics (nIndex=5) returned 1 [0071.053] GetSystemMetrics (nIndex=6) returned 1 [0071.053] AdjustWindowRectEx (in: lpRect=0x2ead60, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2ead60) returned 1 [0071.054] AdjustWindowRectEx (in: lpRect=0x2eac60, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2eac60) returned 1 [0072.499] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x2ea870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3c [0072.701] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x2ea9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3c [0072.701] SetErrorMode (uMode=0x1) returned 0x0 [0072.701] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorlib.dll"), fInfoLevelId=0x0, lpFileInformation=0x2eac00 | out: lpFileInformation=0x2eac00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e4cf0e8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8e4cf0e8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8e541509, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x45b000)) returned 1 [0072.701] SetErrorMode (uMode=0x0) returned 0x1 [0072.703] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", lpdwHandle=0x2eae70 | out: lpdwHandle=0x2eae70) returned 0x7dc [0072.902] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", dwHandle=0x0, dwLen=0x7dc, lpData=0x28455e8 | out: lpData=0x28455e8) returned 1 [0072.919] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2eade8, puLen=0x2eade0 | out: lplpBuffer=0x2eade8*=0x28459d0, puLen=0x2eade0) returned 1 [0072.922] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28456a0, puLen=0x2ead50) returned 1 [0072.926] lstrlenW (lpString="Microsoft Corporation") returned 21 [0072.931] CoTaskMemAlloc (cb=0x2e) returned 0x1b57a9e0 [0072.931] lstrcpyW (in: lpString1=0x1b57a9e0, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0072.931] CoTaskMemFree (pv=0x1b57a9e0) [0072.932] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28456f4, puLen=0x2ead50) returned 1 [0072.932] lstrlenW (lpString="Microsoft Common Language Runtime Class Library") returned 47 [0072.932] CoTaskMemAlloc (cb=0x62) returned 0x1b54a9d0 [0072.932] lstrcpyW (in: lpString1=0x1b54a9d0, lpString2="Microsoft Common Language Runtime Class Library" | out: lpString1="Microsoft Common Language Runtime Class Library") returned="Microsoft Common Language Runtime Class Library" [0072.932] CoTaskMemFree (pv=0x1b54a9d0) [0072.933] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2845774, puLen=0x2ead50) returned 1 [0072.933] lstrlenW (lpString="2.0.50727.5420 (Win7SP1.050727-5400)") returned 36 [0072.933] CoTaskMemAlloc (cb=0x4c) returned 0x1b553920 [0072.933] lstrcpyW (in: lpString1=0x1b553920, lpString2="2.0.50727.5420 (Win7SP1.050727-5400)" | out: lpString1="2.0.50727.5420 (Win7SP1.050727-5400)") returned="2.0.50727.5420 (Win7SP1.050727-5400)" [0072.934] CoTaskMemFree (pv=0x1b553920) [0072.934] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28457e0, puLen=0x2ead50) returned 1 [0072.934] lstrlenW (lpString="mscorlib.dll") returned 12 [0072.934] CoTaskMemAlloc (cb=0x1c) returned 0x1b56fce0 [0072.934] lstrcpyW (in: lpString1=0x1b56fce0, lpString2="mscorlib.dll" | out: lpString1="mscorlib.dll") returned="mscorlib.dll" [0072.934] CoTaskMemFree (pv=0x1b56fce0) [0072.935] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2845820, puLen=0x2ead50) returned 1 [0072.935] lstrlenW (lpString="© Microsoft Corporation. All rights reserved.") returned 46 [0072.935] CoTaskMemAlloc (cb=0x60) returned 0x1b54a9d0 [0072.935] lstrcpyW (in: lpString1=0x1b54a9d0, lpString2="© Microsoft Corporation. All rights reserved." | out: lpString1="© Microsoft Corporation. All rights reserved.") returned="© Microsoft Corporation. All rights reserved." [0072.935] CoTaskMemFree (pv=0x1b54a9d0) [0072.936] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28458a8, puLen=0x2ead50) returned 1 [0072.957] lstrlenW (lpString="mscorlib.dll") returned 12 [0072.957] CoTaskMemAlloc (cb=0x1c) returned 0x1b56fce0 [0072.957] lstrcpyW (in: lpString1=0x1b56fce0, lpString2="mscorlib.dll" | out: lpString1="mscorlib.dll") returned="mscorlib.dll" [0072.957] CoTaskMemFree (pv=0x1b56fce0) [0072.957] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28458e4, puLen=0x2ead50) returned 1 [0072.957] lstrlenW (lpString="Microsoft® .NET Framework") returned 25 [0072.957] CoTaskMemAlloc (cb=0x36) returned 0x1b57a9e0 [0072.957] lstrcpyW (in: lpString1=0x1b57a9e0, lpString2="Microsoft® .NET Framework" | out: lpString1="Microsoft® .NET Framework") returned="Microsoft® .NET Framework" [0072.957] CoTaskMemFree (pv=0x1b57a9e0) [0072.957] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x284593c, puLen=0x2ead50) returned 1 [0072.957] lstrlenW (lpString="2.0.50727.5420") returned 14 [0072.957] CoTaskMemAlloc (cb=0x20) returned 0x1b56fce0 [0072.957] lstrcpyW (in: lpString1=0x1b56fce0, lpString2="2.0.50727.5420" | out: lpString1="2.0.50727.5420") returned="2.0.50727.5420" [0072.958] CoTaskMemFree (pv=0x1b56fce0) [0072.958] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2845974, puLen=0x2ead50) returned 1 [0072.958] lstrlenW (lpString="Flavor=Retail") returned 13 [0072.958] CoTaskMemAlloc (cb=0x1e) returned 0x1b56fce0 [0072.958] lstrcpyW (in: lpString1=0x1b56fce0, lpString2="Flavor=Retail" | out: lpString1="Flavor=Retail") returned="Flavor=Retail" [0072.958] CoTaskMemFree (pv=0x1b56fce0) [0072.958] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0072.958] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0072.958] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0072.958] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ead28, puLen=0x2ead20 | out: lplpBuffer=0x2ead28*=0x28459d0, puLen=0x2ead20) returned 1 [0072.959] CoTaskMemAlloc (cb=0x204) returned 0x1b57b350 [0072.959] VerLanguageNameW (in: wLang=0x409, szLang=0x1b57b350, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0073.002] CoTaskMemFree (pv=0x1b57b350) [0073.002] VerQueryValueW (in: pBlock=0x28455e8, lpSubBlock="\\", lplpBuffer=0x2ead78, puLen=0x2ead70 | out: lplpBuffer=0x2ead78*=0x2845610, puLen=0x2ead70) returned 1 [0073.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x2ea870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38 [0073.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", nBufferLength=0x105, lpBuffer=0x2ea8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", lpFilePart=0x0) returned 0x3b [0073.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", nBufferLength=0x105, lpBuffer=0x2ea7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", lpFilePart=0x0) returned 0x3b [0073.006] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x2ea7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\", lpFilePart=0x0) returned 0x30 [0073.800] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x2ea780, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0073.801] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x2ea610, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0073.801] SetErrorMode (uMode=0x1) returned 0x0 [0073.801] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x374 [0073.802] GetFileType (hFile=0x374) returned 0x1 [0073.802] SetErrorMode (uMode=0x0) returned 0x1 [0073.802] GetFileType (hFile=0x374) returned 0x1 [0073.878] GetFileSize (in: hFile=0x374, lpFileSizeHigh=0x2eaa88 | out: lpFileSizeHigh=0x2eaa88*=0x0) returned 0x622a [0073.886] ReadFile (in: hFile=0x374, lpBuffer=0x284aef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ea9a8, lpOverlapped=0x0 | out: lpBuffer=0x284aef8*, lpNumberOfBytesRead=0x2ea9a8*=0x1000, lpOverlapped=0x0) returned 1 [0073.910] ReadFile (in: hFile=0x374, lpBuffer=0x284aef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ea8e8, lpOverlapped=0x0 | out: lpBuffer=0x284aef8*, lpNumberOfBytesRead=0x2ea8e8*=0x1000, lpOverlapped=0x0) returned 1 [0073.910] ReadFile (in: hFile=0x374, lpBuffer=0x284aef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ea8e8, lpOverlapped=0x0 | out: lpBuffer=0x284aef8*, lpNumberOfBytesRead=0x2ea8e8*=0x1000, lpOverlapped=0x0) returned 1 [0073.910] ReadFile (in: hFile=0x374, lpBuffer=0x284aef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ea8e8, lpOverlapped=0x0 | out: lpBuffer=0x284aef8*, lpNumberOfBytesRead=0x2ea8e8*=0x1000, lpOverlapped=0x0) returned 1 [0073.910] ReadFile (in: hFile=0x374, lpBuffer=0x284aef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ea8e8, lpOverlapped=0x0 | out: lpBuffer=0x284aef8*, lpNumberOfBytesRead=0x2ea8e8*=0x1000, lpOverlapped=0x0) returned 1 [0073.910] ReadFile (in: hFile=0x374, lpBuffer=0x284aef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ea8e8, lpOverlapped=0x0 | out: lpBuffer=0x284aef8*, lpNumberOfBytesRead=0x2ea8e8*=0x1000, lpOverlapped=0x0) returned 1 [0073.910] ReadFile (in: hFile=0x374, lpBuffer=0x284aef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ea948, lpOverlapped=0x0 | out: lpBuffer=0x284aef8*, lpNumberOfBytesRead=0x2ea948*=0x22a, lpOverlapped=0x0) returned 1 [0073.910] ReadFile (in: hFile=0x374, lpBuffer=0x284aef8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ea9a8, lpOverlapped=0x0 | out: lpBuffer=0x284aef8*, lpNumberOfBytesRead=0x2ea9a8*=0x0, lpOverlapped=0x0) returned 1 [0073.911] CloseHandle (hObject=0x374) returned 1 [0073.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", nBufferLength=0x105, lpBuffer=0x2ea780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", lpFilePart=0x0) returned 0x3b [0073.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", nBufferLength=0x105, lpBuffer=0x2ea610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config", lpFilePart=0x0) returned 0x3b [0073.937] SetErrorMode (uMode=0x1) returned 0x0 [0073.937] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0074.180] SetErrorMode (uMode=0x0) returned 0x1 [0074.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x2ea9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38 [0074.182] SetErrorMode (uMode=0x1) returned 0x0 [0074.182] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe"), fInfoLevelId=0x0, lpFileInformation=0x2eac00 | out: lpFileInformation=0x2eac00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f30a660, ftCreationTime.dwHighDateTime=0x1d3b054, ftLastAccessTime.dwLowDateTime=0x8f30a660, ftLastAccessTime.dwHighDateTime=0x1d3b054, ftLastWriteTime.dwLowDateTime=0xd9447400, ftLastWriteTime.dwHighDateTime=0x1d41168, nFileSizeHigh=0x0, nFileSizeLow=0x34400)) returned 1 [0074.182] SetErrorMode (uMode=0x0) returned 0x1 [0074.182] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpdwHandle=0x2eae70 | out: lpdwHandle=0x2eae70) returned 0x504 [0074.183] GetFileVersionInfoW (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", dwHandle=0x0, dwLen=0x504, lpData=0x28536e8 | out: lpData=0x28536e8) returned 1 [0074.183] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2eade8, puLen=0x2eade0 | out: lplpBuffer=0x2eade8*=0x2853784, puLen=0x2eade0) returned 1 [0074.183] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.183] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28537ec, puLen=0x2ead50) returned 1 [0074.183] lstrlenW (lpString="get") returned 3 [0074.183] CoTaskMemAlloc (cb=0xa) returned 0x1b56f3c0 [0074.183] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="get" | out: lpString1="get") returned="get" [0074.183] CoTaskMemFree (pv=0x1b56f3c0) [0074.183] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2853814, puLen=0x2ead50) returned 1 [0074.183] lstrlenW (lpString="1.0.0.0") returned 7 [0074.183] CoTaskMemAlloc (cb=0x12) returned 0x1b56f3c0 [0074.183] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="1.0.0.0" | out: lpString1="1.0.0.0") returned="1.0.0.0" [0074.183] CoTaskMemFree (pv=0x1b56f3c0) [0074.183] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2853844, puLen=0x2ead50) returned 1 [0074.183] lstrlenW (lpString="get.exe") returned 7 [0074.183] CoTaskMemAlloc (cb=0x12) returned 0x1b56f3c0 [0074.183] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="get.exe" | out: lpString1="get.exe") returned="get.exe" [0074.184] CoTaskMemFree (pv=0x1b56f3c0) [0074.184] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2853878, puLen=0x2ead50) returned 1 [0074.184] lstrlenW (lpString="Copyright © 2017") returned 17 [0074.184] CoTaskMemAlloc (cb=0x26) returned 0x1b570250 [0074.184] lstrcpyW (in: lpString1=0x1b570250, lpString2="Copyright © 2017" | out: lpString1="Copyright © 2017") returned="Copyright © 2017" [0074.184] CoTaskMemFree (pv=0x1b570250) [0074.184] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28538c4, puLen=0x2ead50) returned 1 [0074.184] lstrlenW (lpString="get.exe") returned 7 [0074.184] CoTaskMemAlloc (cb=0x12) returned 0x1b56f3c0 [0074.184] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="get.exe" | out: lpString1="get.exe") returned="get.exe" [0074.184] CoTaskMemFree (pv=0x1b56f3c0) [0074.184] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28538f4, puLen=0x2ead50) returned 1 [0074.184] lstrlenW (lpString="get") returned 3 [0074.184] CoTaskMemAlloc (cb=0xa) returned 0x1b56f3c0 [0074.184] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="get" | out: lpString1="get") returned="get" [0074.184] CoTaskMemFree (pv=0x1b56f3c0) [0074.184] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2853920, puLen=0x2ead50) returned 1 [0074.184] lstrlenW (lpString="1.0.0.0") returned 7 [0074.184] CoTaskMemAlloc (cb=0x12) returned 0x1b56f3c0 [0074.184] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="1.0.0.0" | out: lpString1="1.0.0.0") returned="1.0.0.0" [0074.184] CoTaskMemFree (pv=0x1b56f3c0) [0074.184] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.185] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.185] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.185] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.185] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ead28, puLen=0x2ead20 | out: lplpBuffer=0x2ead28*=0x2853784, puLen=0x2ead20) returned 1 [0074.185] CoTaskMemAlloc (cb=0x204) returned 0x1b57b350 [0074.185] VerLanguageNameW (in: wLang=0x0, szLang=0x1b57b350, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0074.185] CoTaskMemFree (pv=0x1b57b350) [0074.185] VerQueryValueW (in: pBlock=0x28536e8, lpSubBlock="\\", lplpBuffer=0x2ead78, puLen=0x2ead70 | out: lplpBuffer=0x2ead78*=0x2853710, puLen=0x2ead70) returned 1 [0074.185] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll", nBufferLength=0x105, lpBuffer=0x2ea870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll", lpFilePart=0x0) returned 0x66 [0074.186] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll", nBufferLength=0x105, lpBuffer=0x2ea9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll", lpFilePart=0x0) returned 0x66 [0074.186] SetErrorMode (uMode=0x1) returned 0x0 [0074.186] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.visualbasic\\8.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll"), fInfoLevelId=0x0, lpFileInformation=0x2eac00 | out: lpFileInformation=0x2eac00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97baa43e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97baa43e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x97bf66ff, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x95000)) returned 1 [0074.187] SetErrorMode (uMode=0x0) returned 0x1 [0074.187] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll", lpdwHandle=0x2eae70 | out: lpdwHandle=0x2eae70) returned 0x79c [0074.327] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\8.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll", dwHandle=0x0, dwLen=0x79c, lpData=0x28573d0 | out: lpData=0x28573d0) returned 1 [0074.328] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2eade8, puLen=0x2eade0 | out: lplpBuffer=0x2eade8*=0x2857798, puLen=0x2eade0) returned 1 [0074.328] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2857488, puLen=0x2ead50) returned 1 [0074.328] lstrlenW (lpString="Microsoft Corporation") returned 21 [0074.328] CoTaskMemAlloc (cb=0x2e) returned 0x1b579b60 [0074.328] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0074.328] CoTaskMemFree (pv=0x1b579b60) [0074.328] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28574dc, puLen=0x2ead50) returned 1 [0074.328] lstrlenW (lpString="Visual Basic Runtime Library") returned 28 [0074.328] CoTaskMemAlloc (cb=0x3c) returned 0x1b56d6e0 [0074.329] lstrcpyW (in: lpString1=0x1b56d6e0, lpString2="Visual Basic Runtime Library" | out: lpString1="Visual Basic Runtime Library") returned="Visual Basic Runtime Library" [0074.329] CoTaskMemFree (pv=0x1b56d6e0) [0074.329] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2857538, puLen=0x2ead50) returned 1 [0074.329] lstrlenW (lpString="8.0.50727.5420 (Win7SP1.050727-5400)") returned 36 [0074.329] CoTaskMemAlloc (cb=0x4c) returned 0x1b553920 [0074.329] lstrcpyW (in: lpString1=0x1b553920, lpString2="8.0.50727.5420 (Win7SP1.050727-5400)" | out: lpString1="8.0.50727.5420 (Win7SP1.050727-5400)") returned="8.0.50727.5420 (Win7SP1.050727-5400)" [0074.329] CoTaskMemFree (pv=0x1b553920) [0074.329] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28575a4, puLen=0x2ead50) returned 1 [0074.329] lstrlenW (lpString="Microsoft.VisualBasic.DLL") returned 25 [0074.329] CoTaskMemAlloc (cb=0x36) returned 0x1b579b60 [0074.329] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft.VisualBasic.DLL" | out: lpString1="Microsoft.VisualBasic.DLL") returned="Microsoft.VisualBasic.DLL" [0074.329] CoTaskMemFree (pv=0x1b579b60) [0074.329] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28575fc, puLen=0x2ead50) returned 1 [0074.329] lstrlenW (lpString="© Microsoft Corporation. All rights reserved.") returned 45 [0074.329] CoTaskMemAlloc (cb=0x5e) returned 0x1b591710 [0074.329] lstrcpyW (in: lpString1=0x1b591710, lpString2="© Microsoft Corporation. All rights reserved." | out: lpString1="© Microsoft Corporation. All rights reserved.") returned="© Microsoft Corporation. All rights reserved." [0074.329] CoTaskMemFree (pv=0x1b591710) [0074.329] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2857680, puLen=0x2ead50) returned 1 [0074.329] lstrlenW (lpString="Microsoft.VisualBasic.DLL") returned 25 [0074.329] CoTaskMemAlloc (cb=0x36) returned 0x1b579b60 [0074.329] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft.VisualBasic.DLL" | out: lpString1="Microsoft.VisualBasic.DLL") returned="Microsoft.VisualBasic.DLL" [0074.329] CoTaskMemFree (pv=0x1b579b60) [0074.329] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28576d4, puLen=0x2ead50) returned 1 [0074.330] lstrlenW (lpString="Microsoft® Visual Studio® 2005") returned 30 [0074.330] CoTaskMemAlloc (cb=0x40) returned 0x1b56d6e0 [0074.330] lstrcpyW (in: lpString1=0x1b56d6e0, lpString2="Microsoft® Visual Studio® 2005" | out: lpString1="Microsoft® Visual Studio® 2005") returned="Microsoft® Visual Studio® 2005" [0074.330] CoTaskMemFree (pv=0x1b56d6e0) [0074.330] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2857738, puLen=0x2ead50) returned 1 [0074.330] lstrlenW (lpString="8.0.50727.5420") returned 14 [0074.330] CoTaskMemAlloc (cb=0x20) returned 0x1b570250 [0074.330] lstrcpyW (in: lpString1=0x1b570250, lpString2="8.0.50727.5420" | out: lpString1="8.0.50727.5420") returned="8.0.50727.5420" [0074.330] CoTaskMemFree (pv=0x1b570250) [0074.330] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.330] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.330] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.330] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.330] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ead28, puLen=0x2ead20 | out: lplpBuffer=0x2ead28*=0x2857798, puLen=0x2ead20) returned 1 [0074.330] CoTaskMemAlloc (cb=0x204) returned 0x1b57b350 [0074.330] VerLanguageNameW (in: wLang=0x409, szLang=0x1b57b350, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0074.330] CoTaskMemFree (pv=0x1b57b350) [0074.330] VerQueryValueW (in: pBlock=0x28573d0, lpSubBlock="\\", lplpBuffer=0x2ead78, puLen=0x2ead70 | out: lplpBuffer=0x2ead78*=0x28573f8, puLen=0x2ead70) returned 1 [0074.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x2ea870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0074.331] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x2ea9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0074.331] SetErrorMode (uMode=0x1) returned 0x0 [0074.331] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system\\2.0.0.0__b77a5c561934e089\\system.dll"), fInfoLevelId=0x0, lpFileInformation=0x2eac00 | out: lpFileInformation=0x2eac00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x850a1657, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x850a1657, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x853e749d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x30b000)) returned 1 [0074.332] SetErrorMode (uMode=0x0) returned 0x1 [0074.332] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpdwHandle=0x2eae70 | out: lpdwHandle=0x2eae70) returned 0x74c [0074.590] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", dwHandle=0x0, dwLen=0x74c, lpData=0x285b3b8 | out: lpData=0x285b3b8) returned 1 [0074.591] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2eade8, puLen=0x2eade0 | out: lplpBuffer=0x2eade8*=0x285b758, puLen=0x2eade0) returned 1 [0074.591] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b470, puLen=0x2ead50) returned 1 [0074.591] lstrlenW (lpString="Microsoft Corporation") returned 21 [0074.591] CoTaskMemAlloc (cb=0x2e) returned 0x1b579b60 [0074.591] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0074.591] CoTaskMemFree (pv=0x1b579b60) [0074.591] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b4c4, puLen=0x2ead50) returned 1 [0074.591] lstrlenW (lpString=".NET Framework") returned 14 [0074.591] CoTaskMemAlloc (cb=0x20) returned 0x1b570250 [0074.591] lstrcpyW (in: lpString1=0x1b570250, lpString2=".NET Framework" | out: lpString1=".NET Framework") returned=".NET Framework" [0074.591] CoTaskMemFree (pv=0x1b570250) [0074.591] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b504, puLen=0x2ead50) returned 1 [0074.591] lstrlenW (lpString="2.0.50727.5420 (Win7SP1.050727-5400)") returned 36 [0074.591] CoTaskMemAlloc (cb=0x4c) returned 0x1b553920 [0074.591] lstrcpyW (in: lpString1=0x1b553920, lpString2="2.0.50727.5420 (Win7SP1.050727-5400)" | out: lpString1="2.0.50727.5420 (Win7SP1.050727-5400)") returned="2.0.50727.5420 (Win7SP1.050727-5400)" [0074.591] CoTaskMemFree (pv=0x1b553920) [0074.591] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b570, puLen=0x2ead50) returned 1 [0074.591] lstrlenW (lpString="System.dll") returned 10 [0074.592] CoTaskMemAlloc (cb=0x18) returned 0x1b56f3c0 [0074.592] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="System.dll" | out: lpString1="System.dll") returned="System.dll" [0074.592] CoTaskMemFree (pv=0x1b56f3c0) [0074.592] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b5ac, puLen=0x2ead50) returned 1 [0074.592] lstrlenW (lpString="© Microsoft Corporation. All rights reserved.") returned 46 [0074.592] CoTaskMemAlloc (cb=0x60) returned 0x1b591710 [0074.592] lstrcpyW (in: lpString1=0x1b591710, lpString2="© Microsoft Corporation. All rights reserved." | out: lpString1="© Microsoft Corporation. All rights reserved.") returned="© Microsoft Corporation. All rights reserved." [0074.592] CoTaskMemFree (pv=0x1b591710) [0074.592] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b634, puLen=0x2ead50) returned 1 [0074.592] lstrlenW (lpString="System.dll") returned 10 [0074.592] CoTaskMemAlloc (cb=0x18) returned 0x1b56f3c0 [0074.592] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="System.dll" | out: lpString1="System.dll") returned="System.dll" [0074.592] CoTaskMemFree (pv=0x1b56f3c0) [0074.592] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b66c, puLen=0x2ead50) returned 1 [0074.592] lstrlenW (lpString="Microsoft® .NET Framework") returned 25 [0074.592] CoTaskMemAlloc (cb=0x36) returned 0x1b579b60 [0074.592] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft® .NET Framework" | out: lpString1="Microsoft® .NET Framework") returned="Microsoft® .NET Framework" [0074.592] CoTaskMemFree (pv=0x1b579b60) [0074.592] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b6c4, puLen=0x2ead50) returned 1 [0074.592] lstrlenW (lpString="2.0.50727.5420") returned 14 [0074.592] CoTaskMemAlloc (cb=0x20) returned 0x1b570250 [0074.592] lstrcpyW (in: lpString1=0x1b570250, lpString2="2.0.50727.5420" | out: lpString1="2.0.50727.5420") returned="2.0.50727.5420" [0074.592] CoTaskMemFree (pv=0x1b570250) [0074.592] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285b6fc, puLen=0x2ead50) returned 1 [0074.592] lstrlenW (lpString="Flavor=Retail") returned 13 [0074.592] CoTaskMemAlloc (cb=0x1e) returned 0x1b570250 [0074.592] lstrcpyW (in: lpString1=0x1b570250, lpString2="Flavor=Retail" | out: lpString1="Flavor=Retail") returned="Flavor=Retail" [0074.593] CoTaskMemFree (pv=0x1b570250) [0074.593] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.593] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.593] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.593] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ead28, puLen=0x2ead20 | out: lplpBuffer=0x2ead28*=0x285b758, puLen=0x2ead20) returned 1 [0074.593] CoTaskMemAlloc (cb=0x204) returned 0x1b57b350 [0074.593] VerLanguageNameW (in: wLang=0x409, szLang=0x1b57b350, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0074.593] CoTaskMemFree (pv=0x1b57b350) [0074.593] VerQueryValueW (in: pBlock=0x285b3b8, lpSubBlock="\\", lplpBuffer=0x2ead78, puLen=0x2ead70 | out: lplpBuffer=0x2ead78*=0x285b3e0, puLen=0x2ead70) returned 1 [0074.593] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x2ea870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x64 [0074.594] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x2ea9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x64 [0074.594] SetErrorMode (uMode=0x1) returned 0x0 [0074.594] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.windows.forms\\2.0.0.0__b77a5c561934e089\\system.windows.forms.dll"), fInfoLevelId=0x0, lpFileInformation=0x2eac00 | out: lpFileInformation=0x2eac00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82f9a4db, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x82f9a4db, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8300c8fb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4cb000)) returned 1 [0074.594] SetErrorMode (uMode=0x0) returned 0x1 [0074.594] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpdwHandle=0x2eae70 | out: lpdwHandle=0x2eae70) returned 0x7bc [0074.595] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", dwHandle=0x0, dwLen=0x7bc, lpData=0x285f340 | out: lpData=0x285f340) returned 1 [0074.595] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2eade8, puLen=0x2eade0 | out: lplpBuffer=0x2eade8*=0x285f718, puLen=0x2eade0) returned 1 [0074.595] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f3f8, puLen=0x2ead50) returned 1 [0074.595] lstrlenW (lpString="Microsoft Corporation") returned 21 [0074.595] CoTaskMemAlloc (cb=0x2e) returned 0x1b579b60 [0074.595] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0074.596] CoTaskMemFree (pv=0x1b579b60) [0074.596] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f44c, puLen=0x2ead50) returned 1 [0074.596] lstrlenW (lpString=".NET Framework") returned 14 [0074.596] CoTaskMemAlloc (cb=0x20) returned 0x1b570250 [0074.596] lstrcpyW (in: lpString1=0x1b570250, lpString2=".NET Framework" | out: lpString1=".NET Framework") returned=".NET Framework" [0074.596] CoTaskMemFree (pv=0x1b570250) [0074.596] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f48c, puLen=0x2ead50) returned 1 [0074.596] lstrlenW (lpString="2.0.50727.5420 (Win7SP1.050727-5400)") returned 36 [0074.596] CoTaskMemAlloc (cb=0x4c) returned 0x1b553920 [0074.596] lstrcpyW (in: lpString1=0x1b553920, lpString2="2.0.50727.5420 (Win7SP1.050727-5400)" | out: lpString1="2.0.50727.5420 (Win7SP1.050727-5400)") returned="2.0.50727.5420 (Win7SP1.050727-5400)" [0074.596] CoTaskMemFree (pv=0x1b553920) [0074.596] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f4f8, puLen=0x2ead50) returned 1 [0074.596] lstrlenW (lpString="System.Windows.Forms.dll") returned 24 [0074.596] CoTaskMemAlloc (cb=0x34) returned 0x1b579b60 [0074.596] lstrcpyW (in: lpString1=0x1b579b60, lpString2="System.Windows.Forms.dll" | out: lpString1="System.Windows.Forms.dll") returned="System.Windows.Forms.dll" [0074.596] CoTaskMemFree (pv=0x1b579b60) [0074.596] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f550, puLen=0x2ead50) returned 1 [0074.596] lstrlenW (lpString="© Microsoft Corporation. All rights reserved.") returned 46 [0074.596] CoTaskMemAlloc (cb=0x60) returned 0x1b591710 [0074.596] lstrcpyW (in: lpString1=0x1b591710, lpString2="© Microsoft Corporation. All rights reserved." | out: lpString1="© Microsoft Corporation. All rights reserved.") returned="© Microsoft Corporation. All rights reserved." [0074.596] CoTaskMemFree (pv=0x1b591710) [0074.597] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f5d8, puLen=0x2ead50) returned 1 [0074.597] lstrlenW (lpString="System.Windows.Forms.dll") returned 24 [0074.597] CoTaskMemAlloc (cb=0x34) returned 0x1b579b60 [0074.597] lstrcpyW (in: lpString1=0x1b579b60, lpString2="System.Windows.Forms.dll" | out: lpString1="System.Windows.Forms.dll") returned="System.Windows.Forms.dll" [0074.597] CoTaskMemFree (pv=0x1b579b60) [0074.597] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f62c, puLen=0x2ead50) returned 1 [0074.597] lstrlenW (lpString="Microsoft® .NET Framework") returned 25 [0074.597] CoTaskMemAlloc (cb=0x36) returned 0x1b579b60 [0074.597] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft® .NET Framework" | out: lpString1="Microsoft® .NET Framework") returned="Microsoft® .NET Framework" [0074.597] CoTaskMemFree (pv=0x1b579b60) [0074.597] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f684, puLen=0x2ead50) returned 1 [0074.597] lstrlenW (lpString="2.0.50727.5420") returned 14 [0074.597] CoTaskMemAlloc (cb=0x20) returned 0x1b570250 [0074.597] lstrcpyW (in: lpString1=0x1b570250, lpString2="2.0.50727.5420" | out: lpString1="2.0.50727.5420") returned="2.0.50727.5420" [0074.597] CoTaskMemFree (pv=0x1b570250) [0074.597] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x285f6bc, puLen=0x2ead50) returned 1 [0074.597] lstrlenW (lpString="Flavor=Retail") returned 13 [0074.597] CoTaskMemAlloc (cb=0x1e) returned 0x1b570250 [0074.597] lstrcpyW (in: lpString1=0x1b570250, lpString2="Flavor=Retail" | out: lpString1="Flavor=Retail") returned="Flavor=Retail" [0074.597] CoTaskMemFree (pv=0x1b570250) [0074.597] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.597] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.598] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.598] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ead28, puLen=0x2ead20 | out: lplpBuffer=0x2ead28*=0x285f718, puLen=0x2ead20) returned 1 [0074.598] CoTaskMemAlloc (cb=0x204) returned 0x1b57b350 [0074.598] VerLanguageNameW (in: wLang=0x409, szLang=0x1b57b350, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0074.598] CoTaskMemFree (pv=0x1b57b350) [0074.598] VerQueryValueW (in: pBlock=0x285f340, lpSubBlock="\\", lplpBuffer=0x2ead78, puLen=0x2ead70 | out: lplpBuffer=0x2ead78*=0x285f368, puLen=0x2ead70) returned 1 [0074.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", nBufferLength=0x105, lpBuffer=0x2ea870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", lpFilePart=0x0) returned 0x58 [0074.599] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", nBufferLength=0x105, lpBuffer=0x2ea9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", lpFilePart=0x0) returned 0x58 [0074.599] SetErrorMode (uMode=0x1) returned 0x0 [0074.599] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.drawing\\2.0.0.0__b03f5f7f11d50a3a\\system.drawing.dll"), fInfoLevelId=0x0, lpFileInformation=0x2eac00 | out: lpFileInformation=0x2eac00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93975fe4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93975fe4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9399c144, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x99000)) returned 1 [0074.600] SetErrorMode (uMode=0x0) returned 0x1 [0074.600] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", lpdwHandle=0x2eae70 | out: lpdwHandle=0x2eae70) returned 0x78c [0074.780] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Drawing\\2.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", dwHandle=0x0, dwLen=0x78c, lpData=0x28636b0 | out: lpData=0x28636b0) returned 1 [0074.781] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2eade8, puLen=0x2eade0 | out: lplpBuffer=0x2eade8*=0x2863a70, puLen=0x2eade0) returned 1 [0074.781] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2863768, puLen=0x2ead50) returned 1 [0074.781] lstrlenW (lpString="Microsoft Corporation") returned 21 [0074.781] CoTaskMemAlloc (cb=0x2e) returned 0x1b579b60 [0074.781] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0074.781] CoTaskMemFree (pv=0x1b579b60) [0074.781] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28637bc, puLen=0x2ead50) returned 1 [0074.781] lstrlenW (lpString=".NET Framework") returned 14 [0074.781] CoTaskMemAlloc (cb=0x20) returned 0x1b570250 [0074.781] lstrcpyW (in: lpString1=0x1b570250, lpString2=".NET Framework" | out: lpString1=".NET Framework") returned=".NET Framework" [0074.781] CoTaskMemFree (pv=0x1b570250) [0074.781] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28637fc, puLen=0x2ead50) returned 1 [0074.782] lstrlenW (lpString="2.0.50727.5420 (Win7SP1.050727-5400)") returned 36 [0074.782] CoTaskMemAlloc (cb=0x4c) returned 0x1b553920 [0074.782] lstrcpyW (in: lpString1=0x1b553920, lpString2="2.0.50727.5420 (Win7SP1.050727-5400)" | out: lpString1="2.0.50727.5420 (Win7SP1.050727-5400)") returned="2.0.50727.5420 (Win7SP1.050727-5400)" [0074.782] CoTaskMemFree (pv=0x1b553920) [0074.782] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2863868, puLen=0x2ead50) returned 1 [0074.782] lstrlenW (lpString="System.Drawing.dll") returned 18 [0074.782] CoTaskMemAlloc (cb=0x28) returned 0x1b570250 [0074.782] lstrcpyW (in: lpString1=0x1b570250, lpString2="System.Drawing.dll" | out: lpString1="System.Drawing.dll") returned="System.Drawing.dll" [0074.782] CoTaskMemFree (pv=0x1b570250) [0074.782] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28638b4, puLen=0x2ead50) returned 1 [0074.782] lstrlenW (lpString="© Microsoft Corporation. All rights reserved.") returned 46 [0074.782] CoTaskMemAlloc (cb=0x60) returned 0x1b591710 [0074.782] lstrcpyW (in: lpString1=0x1b591710, lpString2="© Microsoft Corporation. All rights reserved." | out: lpString1="© Microsoft Corporation. All rights reserved.") returned="© Microsoft Corporation. All rights reserved." [0074.782] CoTaskMemFree (pv=0x1b591710) [0074.782] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x286393c, puLen=0x2ead50) returned 1 [0074.782] lstrlenW (lpString="System.Drawing.dll") returned 18 [0074.782] CoTaskMemAlloc (cb=0x28) returned 0x1b570250 [0074.782] lstrcpyW (in: lpString1=0x1b570250, lpString2="System.Drawing.dll" | out: lpString1="System.Drawing.dll") returned="System.Drawing.dll" [0074.782] CoTaskMemFree (pv=0x1b570250) [0074.782] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2863984, puLen=0x2ead50) returned 1 [0074.782] lstrlenW (lpString="Microsoft® .NET Framework") returned 25 [0074.782] CoTaskMemAlloc (cb=0x36) returned 0x1b579b60 [0074.782] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft® .NET Framework" | out: lpString1="Microsoft® .NET Framework") returned="Microsoft® .NET Framework" [0074.782] CoTaskMemFree (pv=0x1b579b60) [0074.782] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x28639dc, puLen=0x2ead50) returned 1 [0074.782] lstrlenW (lpString="2.0.50727.5420") returned 14 [0074.782] CoTaskMemAlloc (cb=0x20) returned 0x1b570250 [0074.782] lstrcpyW (in: lpString1=0x1b570250, lpString2="2.0.50727.5420" | out: lpString1="2.0.50727.5420") returned="2.0.50727.5420" [0074.782] CoTaskMemFree (pv=0x1b570250) [0074.795] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2863a14, puLen=0x2ead50) returned 1 [0074.795] lstrlenW (lpString="Flavor=Retail") returned 13 [0074.795] CoTaskMemAlloc (cb=0x1e) returned 0x1b570250 [0074.795] lstrcpyW (in: lpString1=0x1b570250, lpString2="Flavor=Retail" | out: lpString1="Flavor=Retail") returned="Flavor=Retail" [0074.795] CoTaskMemFree (pv=0x1b570250) [0074.795] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.795] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.795] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.795] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ead28, puLen=0x2ead20 | out: lplpBuffer=0x2ead28*=0x2863a70, puLen=0x2ead20) returned 1 [0074.795] CoTaskMemAlloc (cb=0x204) returned 0x1b57b350 [0074.795] VerLanguageNameW (in: wLang=0x409, szLang=0x1b57b350, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0074.795] CoTaskMemFree (pv=0x1b57b350) [0074.795] VerQueryValueW (in: pBlock=0x28636b0, lpSubBlock="\\", lplpBuffer=0x2ead78, puLen=0x2ead70 | out: lplpBuffer=0x2ead78*=0x28636d8, puLen=0x2ead70) returned 1 [0074.796] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll", nBufferLength=0x105, lpBuffer=0x2ea870, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll", lpFilePart=0x0) returned 0x6a [0074.875] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll", nBufferLength=0x105, lpBuffer=0x2ea9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll", lpFilePart=0x0) returned 0x6a [0074.876] SetErrorMode (uMode=0x1) returned 0x0 [0074.876] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.runtime.remoting\\2.0.0.0__b77a5c561934e089\\system.runtime.remoting.dll"), fInfoLevelId=0x0, lpFileInformation=0x2eac00 | out: lpFileInformation=0x2eac00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830cafdd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830cafdd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830f113d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000)) returned 1 [0074.879] SetErrorMode (uMode=0x0) returned 0x1 [0074.879] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll", lpdwHandle=0x2eae70 | out: lpdwHandle=0x2eae70) returned 0x82c [0074.941] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\2.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll", dwHandle=0x0, dwLen=0x82c, lpData=0x2867b18 | out: lpData=0x2867b18) returned 1 [0074.947] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2eade8, puLen=0x2eade0 | out: lplpBuffer=0x2eade8*=0x2867f28, puLen=0x2eade0) returned 1 [0074.947] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867bd0, puLen=0x2ead50) returned 1 [0074.947] lstrlenW (lpString="Microsoft Corporation") returned 21 [0074.947] CoTaskMemAlloc (cb=0x2e) returned 0x1b579b60 [0074.947] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0074.947] CoTaskMemFree (pv=0x1b579b60) [0074.947] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867c24, puLen=0x2ead50) returned 1 [0074.947] lstrlenW (lpString="Microsoft .NET Runtime Object Remoting") returned 38 [0074.947] CoTaskMemAlloc (cb=0x50) returned 0x1b553920 [0074.947] lstrcpyW (in: lpString1=0x1b553920, lpString2="Microsoft .NET Runtime Object Remoting" | out: lpString1="Microsoft .NET Runtime Object Remoting") returned="Microsoft .NET Runtime Object Remoting" [0074.947] CoTaskMemFree (pv=0x1b553920) [0074.947] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867c94, puLen=0x2ead50) returned 1 [0074.947] lstrlenW (lpString="2.0.50727.5420 (Win7SP1.050727-5400)") returned 36 [0074.947] CoTaskMemAlloc (cb=0x4c) returned 0x1b553920 [0074.947] lstrcpyW (in: lpString1=0x1b553920, lpString2="2.0.50727.5420 (Win7SP1.050727-5400)" | out: lpString1="2.0.50727.5420 (Win7SP1.050727-5400)") returned="2.0.50727.5420 (Win7SP1.050727-5400)" [0074.947] CoTaskMemFree (pv=0x1b553920) [0074.948] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867d00, puLen=0x2ead50) returned 1 [0074.948] lstrlenW (lpString="System.Runtime.Remoting.dll") returned 27 [0074.948] CoTaskMemAlloc (cb=0x3a) returned 0x1b56d6e0 [0074.948] lstrcpyW (in: lpString1=0x1b56d6e0, lpString2="System.Runtime.Remoting.dll" | out: lpString1="System.Runtime.Remoting.dll") returned="System.Runtime.Remoting.dll" [0074.948] CoTaskMemFree (pv=0x1b56d6e0) [0074.948] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867d5c, puLen=0x2ead50) returned 1 [0074.948] lstrlenW (lpString="© Microsoft Corporation. All rights reserved.") returned 46 [0074.948] CoTaskMemAlloc (cb=0x60) returned 0x1b591710 [0074.948] lstrcpyW (in: lpString1=0x1b591710, lpString2="© Microsoft Corporation. All rights reserved." | out: lpString1="© Microsoft Corporation. All rights reserved.") returned="© Microsoft Corporation. All rights reserved." [0074.948] CoTaskMemFree (pv=0x1b591710) [0074.948] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867de4, puLen=0x2ead50) returned 1 [0074.948] lstrlenW (lpString="System.Runtime.Remoting.dll") returned 27 [0074.948] CoTaskMemAlloc (cb=0x3a) returned 0x1b56d6e0 [0074.948] lstrcpyW (in: lpString1=0x1b56d6e0, lpString2="System.Runtime.Remoting.dll" | out: lpString1="System.Runtime.Remoting.dll") returned="System.Runtime.Remoting.dll" [0074.948] CoTaskMemFree (pv=0x1b56d6e0) [0074.948] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867e3c, puLen=0x2ead50) returned 1 [0074.948] lstrlenW (lpString="Microsoft® .NET Framework") returned 25 [0074.948] CoTaskMemAlloc (cb=0x36) returned 0x1b579b60 [0074.948] lstrcpyW (in: lpString1=0x1b579b60, lpString2="Microsoft® .NET Framework" | out: lpString1="Microsoft® .NET Framework") returned="Microsoft® .NET Framework" [0074.948] CoTaskMemFree (pv=0x1b579b60) [0074.948] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867e94, puLen=0x2ead50) returned 1 [0074.948] lstrlenW (lpString="2.0.50727.5420") returned 14 [0074.948] CoTaskMemAlloc (cb=0x20) returned 0x1b570250 [0074.949] lstrcpyW (in: lpString1=0x1b570250, lpString2="2.0.50727.5420" | out: lpString1="2.0.50727.5420") returned="2.0.50727.5420" [0074.949] CoTaskMemFree (pv=0x1b570250) [0074.949] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x2867ecc, puLen=0x2ead50) returned 1 [0074.949] lstrlenW (lpString="Flavor=Retail") returned 13 [0074.949] CoTaskMemAlloc (cb=0x1e) returned 0x1b570250 [0074.949] lstrcpyW (in: lpString1=0x1b570250, lpString2="Flavor=Retail" | out: lpString1="Flavor=Retail") returned="Flavor=Retail" [0074.949] CoTaskMemFree (pv=0x1b570250) [0074.949] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.949] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.949] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.949] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ead28, puLen=0x2ead20 | out: lplpBuffer=0x2ead28*=0x2867f28, puLen=0x2ead20) returned 1 [0074.949] CoTaskMemAlloc (cb=0x204) returned 0x1b57b350 [0074.949] VerLanguageNameW (in: wLang=0x409, szLang=0x1b57b350, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0074.950] CoTaskMemFree (pv=0x1b57b350) [0074.950] VerQueryValueW (in: pBlock=0x2867b18, lpSubBlock="\\", lplpBuffer=0x2ead78, puLen=0x2ead70 | out: lplpBuffer=0x2ead78*=0x2867b40, puLen=0x2ead70) returned 1 [0074.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x2ea870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38 [0074.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x2ea9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38 [0074.951] SetErrorMode (uMode=0x1) returned 0x0 [0074.951] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe"), fInfoLevelId=0x0, lpFileInformation=0x2eac00 | out: lpFileInformation=0x2eac00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f30a660, ftCreationTime.dwHighDateTime=0x1d3b054, ftLastAccessTime.dwLowDateTime=0x8f30a660, ftLastAccessTime.dwHighDateTime=0x1d3b054, ftLastWriteTime.dwLowDateTime=0xd9447400, ftLastWriteTime.dwHighDateTime=0x1d41168, nFileSizeHigh=0x0, nFileSizeLow=0x34400)) returned 1 [0074.951] SetErrorMode (uMode=0x0) returned 0x1 [0074.951] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpdwHandle=0x2eae70 | out: lpdwHandle=0x2eae70) returned 0x504 [0074.951] GetFileVersionInfoW (in: lptstrFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", dwHandle=0x0, dwLen=0x504, lpData=0x286f160 | out: lpData=0x286f160) returned 1 [0074.954] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2eade8, puLen=0x2eade0 | out: lplpBuffer=0x2eade8*=0x286f1fc, puLen=0x2eade0) returned 1 [0074.954] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.954] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x286f264, puLen=0x2ead50) returned 1 [0074.954] lstrlenW (lpString="get") returned 3 [0074.954] CoTaskMemAlloc (cb=0xa) returned 0x1b56f3c0 [0074.954] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="get" | out: lpString1="get") returned="get" [0074.954] CoTaskMemFree (pv=0x1b56f3c0) [0074.954] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x286f28c, puLen=0x2ead50) returned 1 [0074.954] lstrlenW (lpString="1.0.0.0") returned 7 [0074.955] CoTaskMemAlloc (cb=0x12) returned 0x1b56f3c0 [0074.955] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="1.0.0.0" | out: lpString1="1.0.0.0") returned="1.0.0.0" [0074.955] CoTaskMemFree (pv=0x1b56f3c0) [0074.955] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x286f2bc, puLen=0x2ead50) returned 1 [0074.955] lstrlenW (lpString="get.exe") returned 7 [0074.955] CoTaskMemAlloc (cb=0x12) returned 0x1b56f3c0 [0074.955] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="get.exe" | out: lpString1="get.exe") returned="get.exe" [0074.955] CoTaskMemFree (pv=0x1b56f3c0) [0074.955] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x286f2f0, puLen=0x2ead50) returned 1 [0074.955] lstrlenW (lpString="Copyright © 2017") returned 17 [0074.955] CoTaskMemAlloc (cb=0x26) returned 0x1b570250 [0074.955] lstrcpyW (in: lpString1=0x1b570250, lpString2="Copyright © 2017" | out: lpString1="Copyright © 2017") returned="Copyright © 2017" [0074.955] CoTaskMemFree (pv=0x1b570250) [0074.955] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x286f33c, puLen=0x2ead50) returned 1 [0074.955] lstrlenW (lpString="get.exe") returned 7 [0074.955] CoTaskMemAlloc (cb=0x12) returned 0x1b56f3c0 [0074.955] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="get.exe" | out: lpString1="get.exe") returned="get.exe" [0074.955] CoTaskMemFree (pv=0x1b56f3c0) [0074.955] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x286f36c, puLen=0x2ead50) returned 1 [0074.955] lstrlenW (lpString="get") returned 3 [0074.955] CoTaskMemAlloc (cb=0xa) returned 0x1b56f3c0 [0074.956] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="get" | out: lpString1="get") returned="get" [0074.956] CoTaskMemFree (pv=0x1b56f3c0) [0074.956] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x286f398, puLen=0x2ead50) returned 1 [0074.956] lstrlenW (lpString="1.0.0.0") returned 7 [0074.956] CoTaskMemAlloc (cb=0x12) returned 0x1b56f3c0 [0074.956] lstrcpyW (in: lpString1=0x1b56f3c0, lpString2="1.0.0.0" | out: lpString1="1.0.0.0") returned="1.0.0.0" [0074.956] CoTaskMemFree (pv=0x1b56f3c0) [0074.956] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.956] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.956] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.956] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x2ead58, puLen=0x2ead50 | out: lplpBuffer=0x2ead58*=0x0, puLen=0x2ead50) returned 0 [0074.956] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x2ead28, puLen=0x2ead20 | out: lplpBuffer=0x2ead28*=0x286f1fc, puLen=0x2ead20) returned 1 [0074.956] CoTaskMemAlloc (cb=0x204) returned 0x1b57b350 [0074.956] VerLanguageNameW (in: wLang=0x0, szLang=0x1b57b350, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0074.956] CoTaskMemFree (pv=0x1b57b350) [0074.956] VerQueryValueW (in: pBlock=0x286f160, lpSubBlock="\\", lplpBuffer=0x2ead78, puLen=0x2ead70 | out: lplpBuffer=0x2ead78*=0x286f188, puLen=0x2ead70) returned 1 [0074.957] GetCurrentActCtx (in: lphActCtx=0x2eacf0 | out: lphActCtx=0x2eacf0*=0x1a4cd8) returned 1 [0074.977] GetCurrentActCtx (in: lphActCtx=0x2eab70 | out: lphActCtx=0x2eab70*=0x1a4cd8) returned 1 [0074.978] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000 [0074.978] CreateWindowExW (dwExStyle=0x10000, lpClassName="WindowsForms10.Window.8.app.0.33c0d9d", lpWindowName="WindowsFormsParkingWindow", dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffffffffffd, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x201d8 [0074.978] SetWindowLongPtrW (hWnd=0x201d8, nIndex=-4, dwNewLong=0x77c7b0ac) returned 0x9a150c [0074.978] GetWindowLongPtrW (hWnd=0x201d8, nIndex=-4) returned 0x77c7b0ac [0074.978] SetWindowLongPtrW (hWnd=0x201d8, nIndex=-4, dwNewLong=0x9b7ddc) returned 0x77c7b0ac [0074.978] GetWindowLongPtrW (hWnd=0x201d8, nIndex=-4) returned 0x9b7ddc [0074.979] GetWindowLongPtrW (hWnd=0x201d8, nIndex=-16) returned 0x6c10000 [0074.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0x24, wParam=0x0, lParam=0x2ea290) returned 0x0 [0074.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0x81, wParam=0x0, lParam=0x2ea210) returned 0x1 [0074.980] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0x83, wParam=0x0, lParam=0x2ea2b0) returned 0x0 [0074.980] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0x1, wParam=0x0, lParam=0x2ea1d0) returned 0x0 [0074.980] GetClientRect (in: hWnd=0x201d8, lpRect=0x2e99c0 | out: lpRect=0x2e99c0) returned 1 [0074.981] GetWindowRect (in: hWnd=0x201d8, lpRect=0x2e99c0 | out: lpRect=0x2e99c0) returned 1 [0074.987] SetWindowTextW (hWnd=0x201d8, lpString="WindowsFormsParkingWindow") returned 1 [0074.987] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0xc, wParam=0x0, lParam=0x2871a98) returned 0x1 [0074.987] GetParent (hWnd=0x201d8) returned 0x0 [0074.987] GetClassInfoW (in: hInstance=0x0, lpClassName="STATIC", lpWndClass=0x2871ef8 | out: lpWndClass=0x2871ef8) returned 1 [0074.988] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000 [0074.988] CoTaskMemAlloc (cb=0x48) returned 0x1b56d730 [0074.988] RegisterClassW (lpWndClass=0x2ea9d0) returned 0xc13d [0074.988] CoTaskMemFree (pv=0x1b56d730) [0074.988] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000 [0074.988] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x5600000d, X=0, Y=0, nWidth=100, nHeight=23, hWndParent=0x201d8, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x201da [0074.991] SetWindowLongPtrW (hWnd=0x201da, nIndex=-4, dwNewLong=0x7fefc7161b4) returned 0x9b7e2c [0074.991] GetWindowLongPtrW (hWnd=0x201da, nIndex=-4) returned 0x7fefc7161b4 [0074.991] SetWindowLongPtrW (hWnd=0x201da, nIndex=-4, dwNewLong=0x9b7e7c) returned 0x7fefc7161b4 [0074.991] GetWindowLongPtrW (hWnd=0x201da, nIndex=-4) returned 0x9b7e7c [0074.991] GetWindowLongPtrW (hWnd=0x201da, nIndex=-16) returned 0x4600000d [0074.991] GetWindowLongPtrW (hWnd=0x201da, nIndex=-12) returned 0x0 [0074.991] SetWindowLongPtrW (hWnd=0x201da, nIndex=-12, dwNewLong=0x201da) returned 0x0 [0074.992] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x81, wParam=0x0, lParam=0x2ea390) returned 0x1 [0074.992] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x83, wParam=0x0, lParam=0x2ea430) returned 0x0 [0074.992] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x1, wParam=0x0, lParam=0x2ea390) returned 0x0 [0074.992] GetClientRect (in: hWnd=0x201da, lpRect=0x2e9b30 | out: lpRect=0x2e9b30) returned 1 [0074.992] GetWindowRect (in: hWnd=0x201da, lpRect=0x2e9b30 | out: lpRect=0x2e9b30) returned 1 [0074.992] GetParent (hWnd=0x201da) returned 0x201d8 [0074.992] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d8, lpPoints=0x2e9b20, cPoints=0x2 | out: lpPoints=0x2e9b20) returned -1572867 [0074.993] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0 [0074.993] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0074.993] GetClientRect (in: hWnd=0x201da, lpRect=0x2e9c30 | out: lpRect=0x2e9c30) returned 1 [0074.993] GetWindowRect (in: hWnd=0x201da, lpRect=0x2e9c30 | out: lpRect=0x2e9c30) returned 1 [0074.993] GetParent (hWnd=0x201da) returned 0x201d8 [0074.993] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d8, lpPoints=0x2e9c20, cPoints=0x2 | out: lpPoints=0x2e9c20) returned -1572867 [0074.993] SendMessageW (hWnd=0x201da, Msg=0x2210, wParam=0x1da0001, lParam=0x201da) returned 0x0 [0074.993] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x2210, wParam=0x1da0001, lParam=0x201da) returned 0x0 [0074.995] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0074.995] GetParent (hWnd=0x201da) returned 0x201d8 [0074.996] GdipCreateFromHWND (hwnd=0x201da, graphics=0x2eae70) returned 0x0 [0075.053] GdipMeasureString (graphics=0x1afad3c0, string="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.", length=283, font=0x1b013a40, layoutRect=0x2ead08, stringFormat=0x0, boundingBox=0x2eacf8, codepointsFitted=0x2eacf4, linesFilled=0x2eacf0) returned 0x0 [0075.287] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0075.287] GdipDeleteGraphics (graphics=0x1afad3c0) returned 0x0 [0075.288] GetForegroundWindow () returned 0x101ac [0075.328] GetCursorPos (in: lpPoint=0x2872440 | out: lpPoint=0x2872440*(x=591, y=123)) returned 1 [0075.329] GetSystemMetrics (nIndex=80) returned 1 [0075.347] MonitorFromPoint (pt=0x7b0000024f, dwFlags=0x2) returned 0x10001 [0075.396] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ea990 | out: lpmi=0x2ea990) returned 1 [0075.396] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0xf010836 [0075.397] GetDeviceCaps (hdc=0xf010836, index=12) returned 32 [0075.397] GetDeviceCaps (hdc=0xf010836, index=14) returned 1 [0075.397] DeleteDC (hdc=0xf010836) returned 1 [0075.410] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2eaa90 | out: lpmi=0x2eaa90) returned 1 [0075.410] AdjustWindowRectEx (in: lpRect=0x2ead10, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2ead10) returned 1 [0075.410] GetSystemMetrics (nIndex=59) returned 1460 [0075.410] GetSystemMetrics (nIndex=60) returned 920 [0075.410] GetSystemMetrics (nIndex=34) returned 132 [0075.410] GetSystemMetrics (nIndex=35) returned 38 [0075.410] GetCursorPos (in: lpPoint=0x2872808 | out: lpPoint=0x2872808*(x=591, y=123)) returned 1 [0075.410] MonitorFromPoint (pt=0x7e0000024e, dwFlags=0x2) returned 0x10001 [0075.410] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ea610 | out: lpmi=0x2ea610) returned 1 [0075.410] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x10010836 [0075.411] GetDeviceCaps (hdc=0x10010836, index=12) returned 32 [0075.411] GetDeviceCaps (hdc=0x10010836, index=14) returned 1 [0075.411] DeleteDC (hdc=0x10010836) returned 1 [0075.411] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ea710 | out: lpmi=0x2ea710) returned 1 [0075.411] AdjustWindowRectEx (in: lpRect=0x2ea990, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2ea990) returned 1 [0075.422] AdjustWindowRectEx (in: lpRect=0x2eaca0, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2eaca0) returned 1 [0075.454] LoadIconW (hInstance=0x0, lpIconName=0x7f01) returned 0x1002d [0075.459] GetIconInfo (in: hIcon=0x1002d, piconinfo=0x2872be8 | out: piconinfo=0x2872be8) returned 1 [0075.464] GetObjectW (in: h=0xd050727, c=32, pv=0x2872c18 | out: pv=0x2872c18) returned 32 [0075.470] GdipCreateBitmapFromHBITMAP (hbm=0xd050727, hpal=0x0, bitmap=0x2eab40) returned 0x0 [0075.473] GdipGetImageWidth (image=0x1b860fd0, width=0x2eabc0) returned 0x0 [0075.475] GdipGetImageHeight (image=0x1b860fd0, height=0x2eabc0) returned 0x0 [0075.476] GdipGetImagePixelFormat (image=0x1b860fd0, format=0x2eabc0) returned 0x0 [0075.477] GdipBitmapLockBits (bitmap=0x1b860fd0, rect=0x2eaae0, flags=0x1, format=0x22009, lockedBitmapData=0x2872db0) returned 0x0 [0075.479] GdipCreateBitmapFromScan0 (width=32, height=32, stride=0, format=0x26200a, scan0=0x0, bitmap=0x2eab80) returned 0x0 [0075.479] GdipBitmapLockBits (bitmap=0x1b863aa0, rect=0x2eaae0, flags=0x2, format=0x26200a, lockedBitmapData=0x2872e10) returned 0x0 [0075.504] RtlMoveMemory (in: Destination=0x1b046450, Source=0x1b86ad40, Length=0x80 | out: Destination=0x1b046450) [0075.504] RtlMoveMemory (in: Destination=0x1b0464d0, Source=0x1b86acc0, Length=0x80 | out: Destination=0x1b0464d0) [0075.505] RtlMoveMemory (in: Destination=0x1b046550, Source=0x1b86ac40, Length=0x80 | out: Destination=0x1b046550) [0075.505] RtlMoveMemory (in: Destination=0x1b0465d0, Source=0x1b86abc0, Length=0x80 | out: Destination=0x1b0465d0) [0075.505] RtlMoveMemory (in: Destination=0x1b046650, Source=0x1b86ab40, Length=0x80 | out: Destination=0x1b046650) [0075.505] RtlMoveMemory (in: Destination=0x1b0466d0, Source=0x1b86aac0, Length=0x80 | out: Destination=0x1b0466d0) [0075.505] RtlMoveMemory (in: Destination=0x1b046750, Source=0x1b86aa40, Length=0x80 | out: Destination=0x1b046750) [0075.505] RtlMoveMemory (in: Destination=0x1b0467d0, Source=0x1b86a9c0, Length=0x80 | out: Destination=0x1b0467d0) [0075.505] RtlMoveMemory (in: Destination=0x1b046850, Source=0x1b86a940, Length=0x80 | out: Destination=0x1b046850) [0075.505] RtlMoveMemory (in: Destination=0x1b0468d0, Source=0x1b86a8c0, Length=0x80 | out: Destination=0x1b0468d0) [0075.505] RtlMoveMemory (in: Destination=0x1b046950, Source=0x1b86a840, Length=0x80 | out: Destination=0x1b046950) [0075.505] RtlMoveMemory (in: Destination=0x1b0469d0, Source=0x1b86a7c0, Length=0x80 | out: Destination=0x1b0469d0) [0075.505] RtlMoveMemory (in: Destination=0x1b046a50, Source=0x1b86a740, Length=0x80 | out: Destination=0x1b046a50) [0075.505] RtlMoveMemory (in: Destination=0x1b046ad0, Source=0x1b86a6c0, Length=0x80 | out: Destination=0x1b046ad0) [0075.505] RtlMoveMemory (in: Destination=0x1b046b50, Source=0x1b86a640, Length=0x80 | out: Destination=0x1b046b50) [0075.505] RtlMoveMemory (in: Destination=0x1b046bd0, Source=0x1b86a5c0, Length=0x80 | out: Destination=0x1b046bd0) [0075.505] RtlMoveMemory (in: Destination=0x1b046c50, Source=0x1b86a540, Length=0x80 | out: Destination=0x1b046c50) [0075.505] RtlMoveMemory (in: Destination=0x1b046cd0, Source=0x1b86a4c0, Length=0x80 | out: Destination=0x1b046cd0) [0075.506] RtlMoveMemory (in: Destination=0x1b046d50, Source=0x1b86a440, Length=0x80 | out: Destination=0x1b046d50) [0075.506] RtlMoveMemory (in: Destination=0x1b046dd0, Source=0x1b86a3c0, Length=0x80 | out: Destination=0x1b046dd0) [0075.506] RtlMoveMemory (in: Destination=0x1b046e50, Source=0x1b86a340, Length=0x80 | out: Destination=0x1b046e50) [0075.506] RtlMoveMemory (in: Destination=0x1b046ed0, Source=0x1b86a2c0, Length=0x80 | out: Destination=0x1b046ed0) [0075.506] RtlMoveMemory (in: Destination=0x1b046f50, Source=0x1b86a240, Length=0x80 | out: Destination=0x1b046f50) [0075.506] RtlMoveMemory (in: Destination=0x1b046fd0, Source=0x1b86a1c0, Length=0x80 | out: Destination=0x1b046fd0) [0075.506] RtlMoveMemory (in: Destination=0x1b047050, Source=0x1b86a140, Length=0x80 | out: Destination=0x1b047050) [0075.506] RtlMoveMemory (in: Destination=0x1b0470d0, Source=0x1b86a0c0, Length=0x80 | out: Destination=0x1b0470d0) [0075.506] RtlMoveMemory (in: Destination=0x1b047150, Source=0x1b86a040, Length=0x80 | out: Destination=0x1b047150) [0075.509] RtlMoveMemory (in: Destination=0x1b0471d0, Source=0x1b869fc0, Length=0x80 | out: Destination=0x1b0471d0) [0075.509] RtlMoveMemory (in: Destination=0x1b047250, Source=0x1b869f40, Length=0x80 | out: Destination=0x1b047250) [0075.509] RtlMoveMemory (in: Destination=0x1b0472d0, Source=0x1b869ec0, Length=0x80 | out: Destination=0x1b0472d0) [0075.509] RtlMoveMemory (in: Destination=0x1b047350, Source=0x1b869e40, Length=0x80 | out: Destination=0x1b047350) [0075.509] RtlMoveMemory (in: Destination=0x1b0473d0, Source=0x1b869dc0, Length=0x80 | out: Destination=0x1b0473d0) [0075.511] GdipBitmapUnlockBits (bitmap=0x1b860fd0, lockedBitmapData=0x2872db0) returned 0x0 [0075.511] GdipBitmapUnlockBits (bitmap=0x1b863aa0, lockedBitmapData=0x2872e10) returned 0x0 [0075.511] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0075.511] GdipDisposeImage (image=0x1b860fd0) returned 0x0 [0075.512] DeleteObject (ho=0xd050727) returned 1 [0075.512] DeleteObject (ho=0x11050836) returned 1 [0075.521] GetCurrentThreadId () returned 0x968 [0075.521] GetCurrentThreadId () returned 0x968 [0075.533] SetWindowPos (hWnd=0x201da, hWndInsertAfter=0x0, X=64, Y=8, cx=354, cy=81, uFlags=0x14) returned 1 [0075.533] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x46, wParam=0x0, lParam=0x2eabe0) returned 0x0 [0075.533] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x83, wParam=0x1, lParam=0x2eabb0) returned 0x0 [0075.533] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x47, wParam=0x0, lParam=0x2eabe0) returned 0x0 [0075.533] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x3, wParam=0x0, lParam=0x80040) returned 0x0 [0075.533] GetClientRect (in: hWnd=0x201da, lpRect=0x2e9790 | out: lpRect=0x2e9790) returned 1 [0075.533] GetWindowRect (in: hWnd=0x201da, lpRect=0x2e9790 | out: lpRect=0x2e9790) returned 1 [0075.533] GetParent (hWnd=0x201da) returned 0x201d8 [0075.534] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d8, lpPoints=0x2e9780, cPoints=0x2 | out: lpPoints=0x2e9780) returned -1572867 [0075.534] GetSysColor (nIndex=10) returned 0xb4b4b4 [0075.534] GetSysColor (nIndex=2) returned 0xd1b499 [0075.534] GetSysColor (nIndex=9) returned 0x0 [0075.534] GetSysColor (nIndex=12) returned 0xababab [0075.534] GetSysColor (nIndex=15) returned 0xf0f0f0 [0075.534] GetSysColor (nIndex=20) returned 0xffffff [0075.535] GetSysColor (nIndex=16) returned 0xa0a0a0 [0075.535] GetSysColor (nIndex=15) returned 0xf0f0f0 [0075.535] GetSysColor (nIndex=16) returned 0xa0a0a0 [0075.535] GetSysColor (nIndex=21) returned 0x696969 [0075.535] GetSysColor (nIndex=22) returned 0xe3e3e3 [0075.535] GetSysColor (nIndex=20) returned 0xffffff [0075.535] GetSysColor (nIndex=18) returned 0x0 [0075.535] GetSysColor (nIndex=1) returned 0x0 [0075.535] GetSysColor (nIndex=27) returned 0xead1b9 [0075.535] GetSysColor (nIndex=28) returned 0xf2e4d7 [0075.535] GetSysColor (nIndex=17) returned 0x6d6d6d [0075.535] GetSysColor (nIndex=13) returned 0xff9933 [0075.535] GetSysColor (nIndex=14) returned 0xffffff [0075.535] GetSysColor (nIndex=26) returned 0xcc6600 [0075.535] GetSysColor (nIndex=11) returned 0xfcf7f4 [0075.536] GetSysColor (nIndex=3) returned 0xdbcdbf [0075.536] GetSysColor (nIndex=19) returned 0x544e43 [0075.536] GetSysColor (nIndex=24) returned 0xe1ffff [0075.536] GetSysColor (nIndex=23) returned 0x0 [0075.536] GetSysColor (nIndex=4) returned 0xf0f0f0 [0075.536] GetSysColor (nIndex=30) returned 0xf0f0f0 [0075.536] GetSysColor (nIndex=29) returned 0xff9933 [0075.536] GetSysColor (nIndex=7) returned 0x0 [0075.536] GetSysColor (nIndex=0) returned 0xc8c8c8 [0075.536] GetSysColor (nIndex=5) returned 0xffffff [0075.536] GetSysColor (nIndex=6) returned 0x646464 [0075.536] GetSysColor (nIndex=8) returned 0x0 [0075.537] InvalidateRect (hWnd=0x201da, lpRect=0x0, bErase=1) returned 1 [0075.537] GetWindowTextLengthW (hWnd=0x201da) returned 0 [0075.537] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0075.537] GetSystemMetrics (nIndex=42) returned 0 [0075.537] CoTaskMemAlloc (cb=0x6) returned 0x1b57eb70 [0075.537] GetWindowTextW (in: hWnd=0x201da, lpString=0x1b57eb70, nMaxCount=1 | out: lpString="") returned 0 [0075.537] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xd, wParam=0x1, lParam=0x1b57eb70) returned 0x0 [0075.537] CoTaskMemFree (pv=0x1b57eb70) [0075.538] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x5, wParam=0x0, lParam=0x510162) returned 0x0 [0075.538] GetClientRect (in: hWnd=0x201da, lpRect=0x2ea370 | out: lpRect=0x2ea370) returned 1 [0075.538] GetWindowRect (in: hWnd=0x201da, lpRect=0x2ea370 | out: lpRect=0x2ea370) returned 1 [0075.538] GetParent (hWnd=0x201da) returned 0x201d8 [0075.538] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d8, lpPoints=0x2ea360, cPoints=0x2 | out: lpPoints=0x2ea360) returned -1572867 [0075.539] GetWindowTextLengthW (hWnd=0x201da) returned 0 [0075.539] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0075.539] GetSystemMetrics (nIndex=42) returned 0 [0075.539] CoTaskMemAlloc (cb=0x6) returned 0x1b57eb70 [0075.539] GetWindowTextW (in: hWnd=0x201da, lpString=0x1b57eb70, nMaxCount=1 | out: lpString="") returned 0 [0075.539] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xd, wParam=0x1, lParam=0x1b57eb70) returned 0x0 [0075.539] CoTaskMemFree (pv=0x1b57eb70) [0075.539] GetWindowTextLengthW (hWnd=0x201da) returned 0 [0075.539] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0075.539] GetSystemMetrics (nIndex=42) returned 0 [0075.539] CoTaskMemAlloc (cb=0x6) returned 0x1b57eb70 [0075.539] GetWindowTextW (in: hWnd=0x201da, lpString=0x1b57eb70, nMaxCount=1 | out: lpString="") returned 0 [0075.539] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xd, wParam=0x1, lParam=0x1b57eb70) returned 0x0 [0075.539] CoTaskMemFree (pv=0x1b57eb70) [0075.539] SetWindowTextW (hWnd=0x201da, lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.") returned 1 [0075.539] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xc, wParam=0x0, lParam=0x2830790) returned 0x1 [0075.541] InvalidateRect (hWnd=0x201da, lpRect=0x0, bErase=1) returned 1 [0075.545] GetCurrentThreadId () returned 0x968 [0075.546] GetWindowThreadProcessId (in: hWnd=0x201da, lpdwProcessId=0x2ead50 | out: lpdwProcessId=0x2ead50) returned 0x968 [0075.579] GdipCreateBitmapFromStream (stream=0x1b190020, bitmap=0x2eae38) returned 0x0 [0075.894] GdipImageForceValidation (image=0x1b864090) returned 0x0 [0075.896] GdipGetImageRawFormat (image=0x1b864090, format=0x2eacf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0075.905] GdipGetImageHeight (image=0x1b864090, height=0x2eadf0) returned 0x0 [0075.905] GdipGetImageWidth (image=0x1b864090, width=0x2eadf0) returned 0x0 [0075.908] GdipGetImageWidth (image=0x1b864090, width=0x2eada0) returned 0x0 [0075.908] GdipGetImageHeight (image=0x1b864090, height=0x2eada0) returned 0x0 [0075.909] GdipGetImageWidth (image=0x1b864090, width=0x2ead40) returned 0x0 [0075.909] GdipGetImageHeight (image=0x1b864090, height=0x2ead40) returned 0x0 [0075.909] GdipBitmapGetPixel (bitmap=0x1b864090, x=0, y=15, color=0x2eada0) returned 0x0 [0075.910] GdipGetImageRawFormat (image=0x1b864090, format=0x2eabb0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0075.910] GdipGetImageWidth (image=0x1b864090, width=0x2eab80) returned 0x0 [0075.910] GdipGetImageHeight (image=0x1b864090, height=0x2eab80) returned 0x0 [0075.912] GdipCreateBitmapFromScan0 (width=16, height=16, stride=0, format=0x26200a, scan0=0x0, bitmap=0x2eab90) returned 0x0 [0075.915] GdipGetImagePixelFormat (image=0x1b860fd0, format=0x2eab60) returned 0x0 [0075.917] GdipGetImageGraphicsContext (image=0x1b860fd0, graphics=0x2eabc0) returned 0x0 [0075.920] GdipGraphicsClear (graphics=0x1b864fe0, color=0xffffff) returned 0x0 [0075.921] GdipCreateImageAttributes (imageattr=0x2eabf0) returned 0x0 [0075.922] GdipSetImageAttributesColorKeys (imageattr=0x1b869df0, type=0x0, enableFlag=1, colorLow=0xffffffffffc0c0c0, colorHigh=0xffffffffffc0c0c0) returned 0x0 [0075.922] GdipDrawImageRectRectI (graphics=0x1b864fe0, image=0x1b864090, dstx=0, dsty=0, dstwidth=16, dstheight=16, srcx=0, srcy=0, srcwidth=16, srcheight=16, srcUnit=0x2, imageAttributes=0x1b869df0, callback=0x0, callbackData=0x0) returned 0x0 [0075.923] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0075.923] GdipDisposeImageAttributes (imageattr=0x1b869df0) returned 0x0 [0075.923] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0075.924] GdipDeleteGraphics (graphics=0x1b864fe0) returned 0x0 [0075.924] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0075.924] GdipDisposeImage (image=0x1b864090) returned 0x0 [0075.924] GdipCreateBitmapFromStream (stream=0x1b19ffa0, bitmap=0x2eae38) returned 0x0 [0075.926] GdipImageForceValidation (image=0x1b864090) returned 0x0 [0075.927] GdipGetImageRawFormat (image=0x1b864090, format=0x2eacf0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0075.927] GdipGetImageHeight (image=0x1b864090, height=0x2eadf0) returned 0x0 [0075.927] GdipGetImageWidth (image=0x1b864090, width=0x2eadf0) returned 0x0 [0075.927] GdipGetImageWidth (image=0x1b864090, width=0x2eada0) returned 0x0 [0075.927] GdipGetImageHeight (image=0x1b864090, height=0x2eada0) returned 0x0 [0075.927] GdipGetImageWidth (image=0x1b864090, width=0x2ead40) returned 0x0 [0075.927] GdipGetImageHeight (image=0x1b864090, height=0x2ead40) returned 0x0 [0075.927] GdipBitmapGetPixel (bitmap=0x1b864090, x=0, y=15, color=0x2eada0) returned 0x0 [0075.927] GdipGetImageRawFormat (image=0x1b864090, format=0x2eabb0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0075.927] GdipGetImageWidth (image=0x1b864090, width=0x2eab80) returned 0x0 [0075.927] GdipGetImageHeight (image=0x1b864090, height=0x2eab80) returned 0x0 [0075.927] GdipCreateBitmapFromScan0 (width=16, height=16, stride=0, format=0x26200a, scan0=0x0, bitmap=0x2eab90) returned 0x0 [0075.927] GdipGetImagePixelFormat (image=0x1b047460, format=0x2eab60) returned 0x0 [0075.927] GdipGetImageGraphicsContext (image=0x1b047460, graphics=0x2eabc0) returned 0x0 [0075.927] GdipGraphicsClear (graphics=0x1b047cc0, color=0xffffff) returned 0x0 [0075.927] GdipCreateImageAttributes (imageattr=0x2eabf0) returned 0x0 [0075.928] GdipSetImageAttributesColorKeys (imageattr=0x1b869df0, type=0x0, enableFlag=1, colorLow=0xffffffffffc0c0c0, colorHigh=0xffffffffffc0c0c0) returned 0x0 [0075.928] GdipDrawImageRectRectI (graphics=0x1b047cc0, image=0x1b864090, dstx=0, dsty=0, dstwidth=16, dstheight=16, srcx=0, srcy=0, srcwidth=16, srcheight=16, srcUnit=0x2, imageAttributes=0x1b869df0, callback=0x0, callbackData=0x0) returned 0x0 [0075.928] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0075.928] GdipDisposeImageAttributes (imageattr=0x1b869df0) returned 0x0 [0075.928] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0075.928] GdipDeleteGraphics (graphics=0x1b047cc0) returned 0x0 [0075.928] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0075.928] GdipDisposeImage (image=0x1b864090) returned 0x0 [0075.928] AdjustWindowRectEx (in: lpRect=0x2eace0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2eace0) returned 1 [0075.930] GetCurrentThreadId () returned 0x968 [0075.930] GetCurrentThreadId () returned 0x968 [0075.930] AdjustWindowRectEx (in: lpRect=0x2eace0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2eace0) returned 1 [0075.930] GetCurrentThreadId () returned 0x968 [0075.930] GetCurrentThreadId () returned 0x968 [0075.930] AdjustWindowRectEx (in: lpRect=0x2eace0, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2eace0) returned 1 [0075.930] GetCurrentThreadId () returned 0x968 [0075.930] GetCurrentThreadId () returned 0x968 [0075.932] GetSystemMetrics (nIndex=5) returned 1 [0075.932] GetSystemMetrics (nIndex=6) returned 1 [0075.932] AdjustWindowRectEx (in: lpRect=0x2eab90, dwStyle=0x56210044, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2eab90) returned 1 [0075.932] AdjustWindowRectEx (in: lpRect=0x2eab90, dwStyle=0x56210044, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2eab90) returned 1 [0075.934] AdjustWindowRectEx (in: lpRect=0x2eace0, dwStyle=0x563008c4, bMenu=0, dwExStyle=0x200 | out: lpRect=0x2eace0) returned 1 [0075.934] GetCurrentThreadId () returned 0x968 [0075.934] GetCurrentThreadId () returned 0x968 [0076.054] GetProcessWindowStation () returned 0x44 [0076.055] GetCapture () returned 0x0 [0076.055] GetActiveWindow () returned 0x0 [0076.057] GetCurrentActCtx (in: lphActCtx=0x2eac40 | out: lphActCtx=0x2eac40*=0x1a4cd8) returned 1 [0076.057] GetProcessWindowStation () returned 0x44 [0076.082] OleInitialize (pvReserved=0x0) returned 0x0 [0076.083] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x2ea970 | out: lplpMessageFilter=0x2ea970*=0x0) returned 0x0 [0076.084] GetCurrentThreadId () returned 0x968 [0076.085] EnumThreadWindows (dwThreadId=0x968, lpfn=0x9b7ecc, lParam=0x0) returned 1 [0076.090] IsWindowVisible (hWnd=0x301ae) returned 0 [0076.090] IsWindowVisible (hWnd=0x301b8) returned 0 [0076.090] IsWindowVisible (hWnd=0x301b2) returned 0 [0076.090] GetActiveWindow () returned 0x0 [0076.091] GetFocus () returned 0x0 [0076.091] GetCurrentActCtx (in: lphActCtx=0x2ea8a0 | out: lphActCtx=0x2ea8a0*=0x1a4cd8) returned 1 [0076.091] AdjustWindowRectEx (in: lpRect=0x2ea750, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2ea750) returned 1 [0076.091] GetCursorPos (in: lpPoint=0x2875918 | out: lpPoint=0x2875918*(x=591, y=123)) returned 1 [0076.091] MonitorFromPoint (pt=0x7b0000024f, dwFlags=0x2) returned 0x10001 [0076.091] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ea5a0 | out: lpmi=0x2ea5a0) returned 1 [0076.091] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x12010836 [0076.091] GetDeviceCaps (hdc=0x12010836, index=12) returned 32 [0076.091] GetDeviceCaps (hdc=0x12010836, index=14) returned 1 [0076.091] DeleteDC (hdc=0x12010836) returned 1 [0076.092] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ea6a0 | out: lpmi=0x2ea6a0) returned 1 [0076.092] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000 [0076.092] CreateWindowExW (dwExStyle=0x50001, lpClassName="WindowsForms10.Window.8.app.0.33c0d9d", lpWindowName="Microsoft .NET Framework", dwStyle=0x2c80000, X=498, Y=347, nWidth=444, nHeight=166, hWndParent=0x0, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x201d6 [0076.092] SetWindowLongPtrW (hWnd=0x201d6, nIndex=-4, dwNewLong=0x77c7b0ac) returned 0x9a150c [0076.092] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-4) returned 0x77c7b0ac [0076.092] SetWindowLongPtrW (hWnd=0x201d6, nIndex=-4, dwNewLong=0x9b7f1c) returned 0x77c7b0ac [0076.092] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-4) returned 0x9b7f1c [0076.092] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-16) returned 0x6c80000 [0076.093] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x81, wParam=0x0, lParam=0x2e9f40) returned 0x1 [0076.093] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x83, wParam=0x0, lParam=0x2e9fe0) returned 0x0 [0076.093] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x1, wParam=0x0, lParam=0x2e9f00) returned 0x0 [0076.093] GetClientRect (in: hWnd=0x201d6, lpRect=0x2e9710 | out: lpRect=0x2e9710) returned 1 [0076.093] GetWindowRect (in: hWnd=0x201d6, lpRect=0x2e9710 | out: lpRect=0x2e9710) returned 1 [0076.093] SetWindowTextW (hWnd=0x201d6, lpString="Microsoft .NET Framework") returned 1 [0076.093] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xc, wParam=0x0, lParam=0x2872280) returned 0x1 [0076.094] GetStartupInfoW (in: lpStartupInfo=0x2875da0 | out: lpStartupInfo=0x2875da0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0076.094] GetParent (hWnd=0x201d6) returned 0x0 [0076.094] SetWindowLongPtrW (hWnd=0x201d6, nIndex=-8, dwNewLong=0x0) returned 0x0 [0076.094] SendMessageW (hWnd=0x201d6, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0 [0076.094] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0 [0076.094] SendMessageW (hWnd=0x201d6, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0076.094] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0076.210] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0076.210] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0076.210] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0076.215] GetSystemMenu (hWnd=0x201d6, bRevert=0) returned 0x5012b [0076.215] GetWindowPlacement (in: hWnd=0x201d6, lpwndpl=0x2ea760 | out: lpwndpl=0x2ea760) returned 1 [0076.215] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf020, uEnable=0x1) returned 0 [0076.215] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf030, uEnable=0x1) returned 0 [0076.215] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0076.215] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0076.215] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf000, uEnable=0x1) returned 0 [0076.215] GetClientRect (in: hWnd=0x201d6, lpRect=0x2ea880 | out: lpRect=0x2ea880) returned 1 [0076.215] GetClientRect (in: hWnd=0x201d6, lpRect=0x2ea760 | out: lpRect=0x2ea760) returned 1 [0076.215] GetWindowRect (in: hWnd=0x201d6, lpRect=0x2ea760 | out: lpRect=0x2ea760) returned 1 [0076.215] SetWindowPos (hWnd=0x201d6, hWndInsertAfter=0xffffffffffffffff, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0076.215] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x46, wParam=0x0, lParam=0x2ea860) returned 0x0 [0076.216] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x46, wParam=0x0, lParam=0x2ea860) returned 0x0 [0076.216] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0076.216] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0076.216] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0076.216] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0076.216] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0076.216] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0076.216] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0077.325] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0077.327] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0077.327] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0077.329] GetParent (hWnd=0x201d6) returned 0x0 [0077.330] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0077.331] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0077.331] GetWindowPlacement (in: hWnd=0x201d6, lpwndpl=0x2ea2c0 | out: lpwndpl=0x2ea2c0) returned 1 [0077.331] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x47, wParam=0x0, lParam=0x2ea860) returned 0x0 [0077.332] GetClientRect (in: hWnd=0x201d6, lpRect=0x2ea060 | out: lpRect=0x2ea060) returned 1 [0077.332] GetWindowRect (in: hWnd=0x201d6, lpRect=0x2ea060 | out: lpRect=0x2ea060) returned 1 [0077.332] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0077.332] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0077.332] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0077.332] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x83, wParam=0x1, lParam=0x2ea1c0) returned 0x0 [0077.333] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-16) returned 0x6c80000 [0077.333] GetWindowTextLengthW (hWnd=0x201d6) returned 24 [0077.333] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0077.333] GetSystemMetrics (nIndex=42) returned 0 [0077.333] CoTaskMemAlloc (cb=0x36) returned 0x1b57a560 [0077.333] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b57a560, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0077.333] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b57a560) returned 0x18 [0077.333] CoTaskMemFree (pv=0x1b57a560) [0077.333] GetWindowTextLengthW (hWnd=0x201d6) returned 24 [0077.333] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0077.333] GetSystemMetrics (nIndex=42) returned 0 [0077.333] CoTaskMemAlloc (cb=0x36) returned 0x1b57a560 [0077.333] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b57a560, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0077.333] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b57a560) returned 0x18 [0077.333] CoTaskMemFree (pv=0x1b57a560) [0077.333] GetCursorPos (in: lpPoint=0x28761d8 | out: lpPoint=0x28761d8*(x=591, y=123)) returned 1 [0077.333] MonitorFromPoint (pt=0x7e00000250, dwFlags=0x2) returned 0x10001 [0077.333] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ea5d0 | out: lpmi=0x2ea5d0) returned 1 [0077.333] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x9010720 [0077.334] GetDeviceCaps (hdc=0x9010720, index=12) returned 32 [0077.334] GetDeviceCaps (hdc=0x9010720, index=14) returned 1 [0077.334] DeleteDC (hdc=0x9010720) returned 1 [0077.334] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ea6d0 | out: lpmi=0x2ea6d0) returned 1 [0077.334] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-16) returned 0x6c80000 [0077.334] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-20) returned 0x50109 [0077.334] SetWindowLongPtrW (hWnd=0x201d6, nIndex=-16, dwNewLong=0x2c80000) returned 0x6c80000 [0077.334] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x2ea7a0) returned 0x0 [0077.334] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x2ea7a0) returned 0x0 [0077.334] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0077.334] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0077.335] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0077.335] SetWindowLongPtrW (hWnd=0x201d6, nIndex=-20, dwNewLong=0x50001) returned 0x50109 [0077.335] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x2ea7a0) returned 0x0 [0077.335] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x2ea7a0) returned 0x0 [0077.335] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0077.335] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0077.335] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0077.335] SetWindowPos (hWnd=0x201d6, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0077.335] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x46, wParam=0x0, lParam=0x2ea840) returned 0x0 [0077.339] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x83, wParam=0x1, lParam=0x2ea810) returned 0x0 [0077.339] GetWindowPlacement (in: hWnd=0x201d6, lpwndpl=0x2ea2a0 | out: lpwndpl=0x2ea2a0) returned 1 [0077.339] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x47, wParam=0x0, lParam=0x2ea840) returned 0x0 [0077.339] GetClientRect (in: hWnd=0x201d6, lpRect=0x2ea040 | out: lpRect=0x2ea040) returned 1 [0077.339] GetWindowRect (in: hWnd=0x201d6, lpRect=0x2ea040 | out: lpRect=0x2ea040) returned 1 [0077.339] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0077.339] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0077.339] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0077.339] RedrawWindow (hWnd=0x201d6, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0077.340] GetSystemMenu (hWnd=0x201d6, bRevert=0) returned 0x5012b [0077.340] GetWindowPlacement (in: hWnd=0x201d6, lpwndpl=0x2ea760 | out: lpwndpl=0x2ea760) returned 1 [0077.340] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0077.340] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf030, uEnable=0x1) returned 1 [0077.340] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0077.340] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0077.340] EnableMenuItem (hMenu=0x5012b, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0077.340] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-8) returned 0x0 [0077.340] IsWindowEnabled (hWnd=0x201d6) returned 1 [0077.340] ShowWindow (hWnd=0x201d6, nCmdShow=5) returned 0 [0077.340] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0077.341] GetCurrentActCtx (in: lphActCtx=0x2e9f40 | out: lphActCtx=0x2e9f40*=0x1a4cd8) returned 1 [0077.341] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000 [0077.341] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x56000000, X=0, Y=0, nWidth=64, nHeight=64, hWndParent=0x201d6, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x201cc [0077.341] SetWindowLongPtrW (hWnd=0x201cc, nIndex=-4, dwNewLong=0x77c7b0ac) returned 0x9a150c [0077.341] GetWindowLongPtrW (hWnd=0x201cc, nIndex=-4) returned 0x77c7b0ac [0077.341] SetWindowLongPtrW (hWnd=0x201cc, nIndex=-4, dwNewLong=0x9b7f6c) returned 0x77c7b0ac [0077.341] GetWindowLongPtrW (hWnd=0x201cc, nIndex=-4) returned 0x9b7f6c [0077.341] GetWindowLongPtrW (hWnd=0x201cc, nIndex=-16) returned 0x46000000 [0077.341] GetWindowLongPtrW (hWnd=0x201cc, nIndex=-12) returned 0x0 [0077.341] SetWindowLongPtrW (hWnd=0x201cc, nIndex=-12, dwNewLong=0x201cc) returned 0x0 [0077.341] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x81, wParam=0x0, lParam=0x2e95e0) returned 0x1 [0077.342] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x83, wParam=0x0, lParam=0x2e9680) returned 0x0 [0077.342] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x1, wParam=0x0, lParam=0x2e95e0) returned 0x0 [0077.342] GetWindow (hWnd=0x201cc, uCmd=0x3) returned 0x0 [0077.342] GetClientRect (in: hWnd=0x201cc, lpRect=0x2e8e30 | out: lpRect=0x2e8e30) returned 1 [0077.342] GetWindowRect (in: hWnd=0x201cc, lpRect=0x2e8e30 | out: lpRect=0x2e8e30) returned 1 [0077.342] GetParent (hWnd=0x201cc) returned 0x201d6 [0077.342] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8e20, cPoints=0x2 | out: lpPoints=0x2e8e20) returned -24314357 [0077.343] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x5, wParam=0x0, lParam=0x400040) returned 0x0 [0077.343] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0077.343] GetClientRect (in: hWnd=0x201cc, lpRect=0x2e8f30 | out: lpRect=0x2e8f30) returned 1 [0077.343] GetWindowRect (in: hWnd=0x201cc, lpRect=0x2e8f30 | out: lpRect=0x2e8f30) returned 1 [0077.343] GetParent (hWnd=0x201cc) returned 0x201d6 [0077.343] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8f20, cPoints=0x2 | out: lpPoints=0x2e8f20) returned -24314357 [0077.343] SendMessageW (hWnd=0x201cc, Msg=0x2210, wParam=0x1cc0001, lParam=0x201cc) returned 0x0 [0077.343] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x2210, wParam=0x1cc0001, lParam=0x201cc) returned 0x0 [0077.343] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0077.344] GetParent (hWnd=0x201cc) returned 0x201d6 [0077.344] GetParent (hWnd=0x201da) returned 0x201d8 [0077.344] SetParent (hWndChild=0x201da, hWndNewParent=0x201d6) returned 0x201d8 [0077.344] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0077.344] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x46, wParam=0x0, lParam=0x2e9ee0) returned 0x0 [0077.345] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0077.345] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x47, wParam=0x0, lParam=0x2e9ee0) returned 0x0 [0077.345] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x3, wParam=0x0, lParam=0x80040) returned 0x0 [0077.345] GetClientRect (in: hWnd=0x201da, lpRect=0x2e8a90 | out: lpRect=0x2e8a90) returned 1 [0077.345] GetWindowRect (in: hWnd=0x201da, lpRect=0x2e8a90 | out: lpRect=0x2e8a90) returned 1 [0077.345] GetParent (hWnd=0x201da) returned 0x201d6 [0077.345] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8a80, cPoints=0x2 | out: lpPoints=0x2e8a80) returned -24314357 [0077.345] GetClientRect (in: hWnd=0x201da, lpRect=0x2e9670 | out: lpRect=0x2e9670) returned 1 [0077.345] GetWindowRect (in: hWnd=0x201da, lpRect=0x2e9670 | out: lpRect=0x2e9670) returned 1 [0077.345] GetParent (hWnd=0x201da) returned 0x201d6 [0077.345] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e9660, cPoints=0x2 | out: lpPoints=0x2e9660) returned -24314357 [0077.345] GetParent (hWnd=0x201da) returned 0x201d6 [0077.345] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0077.346] GetWindow (hWnd=0x201da, uCmd=0x3) returned 0x0 [0077.346] SetWindowPos (hWnd=0x201da, hWndInsertAfter=0x201cc, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0077.346] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x46, wParam=0x0, lParam=0x2e9d90) returned 0x0 [0077.346] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0077.346] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x47, wParam=0x0, lParam=0x2e9d90) returned 0x0 [0077.346] GetClientRect (in: hWnd=0x201da, lpRect=0x2e9520 | out: lpRect=0x2e9520) returned 1 [0077.346] GetWindowRect (in: hWnd=0x201da, lpRect=0x2e9520 | out: lpRect=0x2e9520) returned 1 [0077.346] GetParent (hWnd=0x201da) returned 0x201d6 [0077.346] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e9510, cPoints=0x2 | out: lpPoints=0x2e9510) returned -24314357 [0077.346] GetParent (hWnd=0x201da) returned 0x201d6 [0077.347] GetWindow (hWnd=0x201da, uCmd=0x3) returned 0x201cc [0077.347] GetWindowThreadProcessId (in: hWnd=0x201da, lpdwProcessId=0x2e9f60 | out: lpdwProcessId=0x2e9f60) returned 0x968 [0077.348] GetCurrentActCtx (in: lphActCtx=0x2e9f40 | out: lphActCtx=0x2e9f40*=0x1a4cd8) returned 1 [0077.348] GetClassInfoW (in: hInstance=0x0, lpClassName="BUTTON", lpWndClass=0x28767b0 | out: lpWndClass=0x28767b0) returned 1 [0077.349] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000 [0077.349] CoTaskMemAlloc (cb=0x48) returned 0x1b5789b0 [0077.349] RegisterClassW (lpWndClass=0x2e9c20) returned 0xc142 [0077.349] CoTaskMemFree (pv=0x1b5789b0) [0077.349] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000 [0077.349] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.33c0d9d", lpWindowName="&Details", dwStyle=0x5601000b, X=8, Y=107, nWidth=100, nHeight=23, hWndParent=0x201d6, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x201ce [0077.349] SetWindowLongPtrW (hWnd=0x201ce, nIndex=-4, dwNewLong=0x7fefc713b20) returned 0x9b7fbc [0077.349] GetWindowLongPtrW (hWnd=0x201ce, nIndex=-4) returned 0x7fefc713b20 [0077.350] SetWindowLongPtrW (hWnd=0x201ce, nIndex=-4, dwNewLong=0x9b800c) returned 0x7fefc713b20 [0077.350] GetWindowLongPtrW (hWnd=0x201ce, nIndex=-4) returned 0x9b800c [0077.350] GetWindowLongPtrW (hWnd=0x201ce, nIndex=-16) returned 0x4601000b [0077.350] GetWindowLongPtrW (hWnd=0x201ce, nIndex=-12) returned 0x0 [0077.350] SetWindowLongPtrW (hWnd=0x201ce, nIndex=-12, dwNewLong=0x201ce) returned 0x0 [0077.350] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x81, wParam=0x0, lParam=0x2e95e0) returned 0x1 [0077.351] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x83, wParam=0x0, lParam=0x2e9680) returned 0x0 [0077.351] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x1, wParam=0x0, lParam=0x2e95c0) returned 0x0 [0077.351] SendMessageW (hWnd=0x201ce, Msg=0x2055, wParam=0x201ce, lParam=0x3) returned 0x2 [0077.351] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0077.351] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0077.351] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0077.352] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0077.352] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0077.352] RedrawWindow (hWnd=0x201cc, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0077.352] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0077.352] RedrawWindow (hWnd=0x201da, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0077.352] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0077.352] RedrawWindow (hWnd=0x201ce, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0077.352] RedrawWindow (hWnd=0x201d6, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0077.352] GetWindow (hWnd=0x201ce, uCmd=0x3) returned 0x201da [0077.352] GetClientRect (in: hWnd=0x201ce, lpRect=0x2e8d60 | out: lpRect=0x2e8d60) returned 1 [0077.352] GetWindowRect (in: hWnd=0x201ce, lpRect=0x2e8d60 | out: lpRect=0x2e8d60) returned 1 [0077.352] GetParent (hWnd=0x201ce) returned 0x201d6 [0077.352] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8d50, cPoints=0x2 | out: lpPoints=0x2e8d50) returned -24314357 [0077.353] SetWindowTextW (hWnd=0x201ce, lpString="&Details") returned 1 [0077.353] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0xc, wParam=0x0, lParam=0x28738b0) returned 0x1 [0077.353] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0 [0077.353] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x3, wParam=0x0, lParam=0x6b0008) returned 0x0 [0077.353] GetClientRect (in: hWnd=0x201ce, lpRect=0x2e8e80 | out: lpRect=0x2e8e80) returned 1 [0077.353] GetWindowRect (in: hWnd=0x201ce, lpRect=0x2e8e80 | out: lpRect=0x2e8e80) returned 1 [0077.353] GetParent (hWnd=0x201ce) returned 0x201d6 [0077.353] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8e70, cPoints=0x2 | out: lpPoints=0x2e8e70) returned -24314357 [0077.353] SendMessageW (hWnd=0x201ce, Msg=0x2210, wParam=0x1ce0001, lParam=0x201ce) returned 0x0 [0077.353] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x2210, wParam=0x1ce0001, lParam=0x201ce) returned 0x0 [0077.353] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0077.353] GetParent (hWnd=0x201ce) returned 0x201d6 [0077.353] GetCurrentActCtx (in: lphActCtx=0x2e9f40 | out: lphActCtx=0x2e9f40*=0x1a4cd8) returned 1 [0077.354] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000 [0077.354] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.33c0d9d", lpWindowName="&Continue", dwStyle=0x5601000b, X=225, Y=107, nWidth=100, nHeight=23, hWndParent=0x201d6, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x201c8 [0077.354] SetWindowLongPtrW (hWnd=0x201c8, nIndex=-4, dwNewLong=0x7fefc713b20) returned 0x9b7fbc [0077.354] GetWindowLongPtrW (hWnd=0x201c8, nIndex=-4) returned 0x7fefc713b20 [0077.354] SetWindowLongPtrW (hWnd=0x201c8, nIndex=-4, dwNewLong=0x9b805c) returned 0x7fefc713b20 [0077.354] GetWindowLongPtrW (hWnd=0x201c8, nIndex=-4) returned 0x9b805c [0077.354] GetWindowLongPtrW (hWnd=0x201c8, nIndex=-16) returned 0x4601000b [0077.354] GetWindowLongPtrW (hWnd=0x201c8, nIndex=-12) returned 0x0 [0077.354] SetWindowLongPtrW (hWnd=0x201c8, nIndex=-12, dwNewLong=0x201c8) returned 0x0 [0077.354] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x81, wParam=0x0, lParam=0x2e95e0) returned 0x1 [0077.354] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x83, wParam=0x0, lParam=0x2e9680) returned 0x0 [0077.355] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x1, wParam=0x0, lParam=0x2e95c0) returned 0x0 [0077.355] SendMessageW (hWnd=0x201c8, Msg=0x2055, wParam=0x201c8, lParam=0x3) returned 0x2 [0077.355] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0077.355] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0077.355] GetWindow (hWnd=0x201c8, uCmd=0x3) returned 0x201ce [0077.355] GetClientRect (in: hWnd=0x201c8, lpRect=0x2e8d60 | out: lpRect=0x2e8d60) returned 1 [0077.355] GetWindowRect (in: hWnd=0x201c8, lpRect=0x2e8d60 | out: lpRect=0x2e8d60) returned 1 [0077.355] GetParent (hWnd=0x201c8) returned 0x201d6 [0077.355] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8d50, cPoints=0x2 | out: lpPoints=0x2e8d50) returned -24314357 [0077.355] SetWindowTextW (hWnd=0x201c8, lpString="&Continue") returned 1 [0077.355] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0xc, wParam=0x0, lParam=0x2873740) returned 0x1 [0077.356] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0 [0077.356] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x3, wParam=0x0, lParam=0x6b00e1) returned 0x0 [0077.356] GetClientRect (in: hWnd=0x201c8, lpRect=0x2e8e80 | out: lpRect=0x2e8e80) returned 1 [0077.356] GetWindowRect (in: hWnd=0x201c8, lpRect=0x2e8e80 | out: lpRect=0x2e8e80) returned 1 [0077.356] GetParent (hWnd=0x201c8) returned 0x201d6 [0077.356] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8e70, cPoints=0x2 | out: lpPoints=0x2e8e70) returned -24314357 [0077.356] SendMessageW (hWnd=0x201c8, Msg=0x2210, wParam=0x1c80001, lParam=0x201c8) returned 0x0 [0077.356] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x2210, wParam=0x1c80001, lParam=0x201c8) returned 0x0 [0077.356] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0077.356] GetParent (hWnd=0x201c8) returned 0x201d6 [0077.356] GetCurrentActCtx (in: lphActCtx=0x2e9f40 | out: lphActCtx=0x2e9f40*=0x1a4cd8) returned 1 [0077.356] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000 [0077.356] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.33c0d9d", lpWindowName="&Quit", dwStyle=0x5601000b, X=330, Y=107, nWidth=100, nHeight=23, hWndParent=0x201d6, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x201ca [0077.356] SetWindowLongPtrW (hWnd=0x201ca, nIndex=-4, dwNewLong=0x7fefc713b20) returned 0x9b7fbc [0077.356] GetWindowLongPtrW (hWnd=0x201ca, nIndex=-4) returned 0x7fefc713b20 [0077.357] SetWindowLongPtrW (hWnd=0x201ca, nIndex=-4, dwNewLong=0x9b80ac) returned 0x7fefc713b20 [0077.357] GetWindowLongPtrW (hWnd=0x201ca, nIndex=-4) returned 0x9b80ac [0077.357] GetWindowLongPtrW (hWnd=0x201ca, nIndex=-16) returned 0x4601000b [0077.357] GetWindowLongPtrW (hWnd=0x201ca, nIndex=-12) returned 0x0 [0077.357] SetWindowLongPtrW (hWnd=0x201ca, nIndex=-12, dwNewLong=0x201ca) returned 0x0 [0077.357] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x81, wParam=0x0, lParam=0x2e95e0) returned 0x1 [0077.357] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x83, wParam=0x0, lParam=0x2e9680) returned 0x0 [0077.357] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x1, wParam=0x0, lParam=0x2e95c0) returned 0x0 [0077.357] SendMessageW (hWnd=0x201ca, Msg=0x2055, wParam=0x201ca, lParam=0x3) returned 0x2 [0077.357] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0077.357] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0077.357] GetWindow (hWnd=0x201ca, uCmd=0x3) returned 0x201c8 [0077.357] GetClientRect (in: hWnd=0x201ca, lpRect=0x2e8d60 | out: lpRect=0x2e8d60) returned 1 [0077.357] GetWindowRect (in: hWnd=0x201ca, lpRect=0x2e8d60 | out: lpRect=0x2e8d60) returned 1 [0077.357] GetParent (hWnd=0x201ca) returned 0x201d6 [0077.357] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8d50, cPoints=0x2 | out: lpPoints=0x2e8d50) returned -24314357 [0077.358] SetWindowTextW (hWnd=0x201ca, lpString="&Quit") returned 1 [0077.358] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0xc, wParam=0x0, lParam=0x28737c0) returned 0x1 [0077.358] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0 [0077.358] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x3, wParam=0x0, lParam=0x6b014a) returned 0x0 [0077.358] GetClientRect (in: hWnd=0x201ca, lpRect=0x2e8e80 | out: lpRect=0x2e8e80) returned 1 [0077.358] GetWindowRect (in: hWnd=0x201ca, lpRect=0x2e8e80 | out: lpRect=0x2e8e80) returned 1 [0077.358] GetParent (hWnd=0x201ca) returned 0x201d6 [0077.358] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8e70, cPoints=0x2 | out: lpPoints=0x2e8e70) returned -24314357 [0077.358] SendMessageW (hWnd=0x201ca, Msg=0x2210, wParam=0x1ca0001, lParam=0x201ca) returned 0x0 [0077.358] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x2210, wParam=0x1ca0001, lParam=0x201ca) returned 0x0 [0077.358] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0077.358] GetParent (hWnd=0x201ca) returned 0x201d6 [0077.358] GetCurrentActCtx (in: lphActCtx=0x2e9ef0 | out: lphActCtx=0x2e9ef0*=0x1a4cd8) returned 1 [0077.359] GetModuleHandleW (lpModuleName=0x0) returned 0x1330000 [0077.359] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.33c0d9d", lpWindowName="See the end of this message for details on invoking \r\njust-in-time (JIT) debugging instead of this dialog box.\r\n\r\n************** Exception Text **************\r\nSystem.IO.DirectoryNotFoundException: Could not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.\r\n at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)\r\n at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy)\r\n at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)\r\n at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)\r\n at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding, Int32 bufferSize)\r\n at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding)\r\n at System.IO.File.WriteAllText(String path, String contents, Encoding encoding)\r\n at get.ranran.html()\r\n at get.ranran.Form1_Load(Object sender, EventArgs e)\r\n at System.EventHandler.Invoke(Object sender, EventArgs e)\r\n at System.Windows.Forms.Form.OnLoad(EventArgs e)\r\n at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)\r\n at System.Windows.Forms.Control.CreateControl()\r\n at System.Windows.Forms.Control.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Control.WndProc(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)\r\n at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)\r\n\r\n\r\n************** Loaded Assemblies **************\r\nmscorlib\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/Microsoft.NET/Framework64/v2.0.50727/mscorlib.dll\r\n----------------------------------------\r\nget\r\n Assembly Version: 1.0.0.0\r\n Win32 Version: 1.0.0.0\r\n CodeBase: file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/KryptoTrojaner.exe\r\n----------------------------------------\r\nMicrosoft.VisualBasic\r\n Assembly Version: 8.0.0.0\r\n Win32 Version: 8.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/Microsoft.VisualBasic/8.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualBasic.dll\r\n----------------------------------------\r\nSystem\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll\r\n----------------------------------------\r\nSystem.Windows.Forms\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll\r\n----------------------------------------\r\nSystem.Drawing\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll\r\n----------------------------------------\r\nSystem.Runtime.Remoting\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Runtime.Remoting/2.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll\r\n----------------------------------------\r\n9ee08ca6-3f27-4b57-b8d0-4985d08ba511\r\n Assembly Version: 1.0.0.0\r\n Win32 Version: 1.0.0.0\r\n CodeBase: file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/KryptoTrojaner.exe\r\n----------------------------------------\r\n\r\n************** JIT Debugging **************\r\nTo enable just-in-time (JIT) debugging, the .config file for this\r\napplication or computer (machine.config) must have the\r\njitDebugging value set in the system.windows.forms section.\r\nThe application must also be compiled with debugging\r\nenabled.\r\n\r\nFor example:\r\n\r\n\r\n \r\n\r\n\r\nWhen JIT debugging is enabled, any unhandled exception\r\nwill be sent to the JIT debugger registered on the computer\r\nrather than be handled by this dialog box.\r\n\r\n\r\n", dwStyle=0x563008c4, X=8, Y=138, nWidth=422, nHeight=154, hWndParent=0x201d6, hMenu=0x0, hInstance=0x1330000, lpParam=0x0) returned 0x201e2 [0077.359] SetWindowLongPtrW (hWnd=0x201e2, nIndex=-4, dwNewLong=0x7fefc71975c) returned 0x9b202c [0077.359] GetWindowLongPtrW (hWnd=0x201e2, nIndex=-4) returned 0x7fefc71975c [0077.359] SetWindowLongPtrW (hWnd=0x201e2, nIndex=-4, dwNewLong=0x9b80fc) returned 0x7fefc71975c [0077.359] GetWindowLongPtrW (hWnd=0x201e2, nIndex=-4) returned 0x9b80fc [0077.359] GetWindowLongPtrW (hWnd=0x201e2, nIndex=-16) returned 0x463008c4 [0077.359] GetWindowLongPtrW (hWnd=0x201e2, nIndex=-12) returned 0x0 [0077.359] SetWindowLongPtrW (hWnd=0x201e2, nIndex=-12, dwNewLong=0x201e2) returned 0x0 [0077.359] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x81, wParam=0x0, lParam=0x2e9590) returned 0x1 [0077.360] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x83, wParam=0x0, lParam=0x2e9630) returned 0x0 [0077.360] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x1, wParam=0x0, lParam=0x2e95d0) returned 0x1 [0077.376] GetWindow (hWnd=0x201e2, uCmd=0x3) returned 0x201ca [0077.376] GetClientRect (in: hWnd=0x201e2, lpRect=0x2e8e20 | out: lpRect=0x2e8e20) returned 1 [0077.376] GetWindowRect (in: hWnd=0x201e2, lpRect=0x2e8e20 | out: lpRect=0x2e8e20) returned 1 [0077.376] GetParent (hWnd=0x201e2) returned 0x201d6 [0077.376] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8e10, cPoints=0x2 | out: lpPoints=0x2e8e10) returned -24314357 [0077.376] GetWindowTextLengthW (hWnd=0x201d6) returned 24 [0077.376] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0077.376] GetSystemMetrics (nIndex=42) returned 0 [0077.376] CoTaskMemAlloc (cb=0x36) returned 0x1b57a560 [0077.376] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b57a560, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0077.376] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b57a560) returned 0x18 [0077.376] CoTaskMemFree (pv=0x1b57a560) [0077.376] SendMessageW (hWnd=0x201e2, Msg=0x30, wParam=0x2e0a0218, lParam=0x0) returned 0x1 [0077.376] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x30, wParam=0x2e0a0218, lParam=0x0) returned 0x1 [0077.393] SetWindowTextW (hWnd=0x201e2, lpString="See the end of this message for details on invoking \r\njust-in-time (JIT) debugging instead of this dialog box.\r\n\r\n************** Exception Text **************\r\nSystem.IO.DirectoryNotFoundException: Could not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.\r\n at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)\r\n at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy)\r\n at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)\r\n at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)\r\n at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding, Int32 bufferSize)\r\n at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding)\r\n at System.IO.File.WriteAllText(String path, String contents, Encoding encoding)\r\n at get.ranran.html()\r\n at get.ranran.Form1_Load(Object sender, EventArgs e)\r\n at System.EventHandler.Invoke(Object sender, EventArgs e)\r\n at System.Windows.Forms.Form.OnLoad(EventArgs e)\r\n at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)\r\n at System.Windows.Forms.Control.CreateControl()\r\n at System.Windows.Forms.Control.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Control.WndProc(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)\r\n at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)\r\n\r\n\r\n************** Loaded Assemblies **************\r\nmscorlib\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/Microsoft.NET/Framework64/v2.0.50727/mscorlib.dll\r\n----------------------------------------\r\nget\r\n Assembly Version: 1.0.0.0\r\n Win32 Version: 1.0.0.0\r\n CodeBase: file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/KryptoTrojaner.exe\r\n----------------------------------------\r\nMicrosoft.VisualBasic\r\n Assembly Version: 8.0.0.0\r\n Win32 Version: 8.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/Microsoft.VisualBasic/8.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualBasic.dll\r\n----------------------------------------\r\nSystem\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll\r\n----------------------------------------\r\nSystem.Windows.Forms\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll\r\n----------------------------------------\r\nSystem.Drawing\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll\r\n----------------------------------------\r\nSystem.Runtime.Remoting\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Runtime.Remoting/2.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll\r\n----------------------------------------\r\n9ee08ca6-3f27-4b57-b8d0-4985d08ba511\r\n Assembly Version: 1.0.0.0\r\n Win32 Version: 1.0.0.0\r\n CodeBase: file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/KryptoTrojaner.exe\r\n----------------------------------------\r\n\r\n************** JIT Debugging **************\r\nTo enable just-in-time (JIT) debugging, the .config file for this\r\napplication or computer (machine.config) must have the\r\njitDebugging value set in the system.windows.forms section.\r\nThe application must also be compiled with debugging\r\nenabled.\r\n\r\nFor example:\r\n\r\n\r\n \r\n\r\n\r\nWhen JIT debugging is enabled, any unhandled exception\r\nwill be sent to the JIT debugger registered on the computer\r\nrather than be handled by this dialog box.\r\n\r\n\r\n") returned 1 [0077.393] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0xc, wParam=0x0, lParam=0x286a4b0) returned 0x1 [0077.395] GetSystemMetrics (nIndex=5) returned 1 [0077.395] GetSystemMetrics (nIndex=6) returned 1 [0077.395] SendMessageW (hWnd=0x201e2, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0077.395] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0077.395] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x5, wParam=0x0, lParam=0x850191) returned 0x1 [0077.395] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x3, wParam=0x0, lParam=0x8c000a) returned 0x0 [0077.395] GetClientRect (in: hWnd=0x201e2, lpRect=0x2e8ee0 | out: lpRect=0x2e8ee0) returned 1 [0077.395] GetWindowRect (in: hWnd=0x201e2, lpRect=0x2e8ee0 | out: lpRect=0x2e8ee0) returned 1 [0077.395] GetParent (hWnd=0x201e2) returned 0x201d6 [0077.395] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x201d6, lpPoints=0x2e8ed0, cPoints=0x2 | out: lpPoints=0x2e8ed0) returned -24314357 [0077.395] SendMessageW (hWnd=0x201e2, Msg=0x2210, wParam=0x1e20001, lParam=0x201e2) returned 0x0 [0077.395] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x2210, wParam=0x1e20001, lParam=0x201e2) returned 0x0 [0077.395] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0077.395] GetParent (hWnd=0x201e2) returned 0x201d6 [0077.396] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-8) returned 0x0 [0077.396] GetCursorPos (in: lpPoint=0x28771c0 | out: lpPoint=0x28771c0*(x=591, y=123)) returned 1 [0077.397] MonitorFromPoint (pt=0x2c700000526, dwFlags=0x2) returned 0x10001 [0077.397] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2e9de0 | out: lpmi=0x2e9de0) returned 1 [0077.397] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x15010720 [0077.397] GetDeviceCaps (hdc=0x15010720, index=12) returned 32 [0077.397] GetDeviceCaps (hdc=0x15010720, index=14) returned 1 [0077.397] DeleteDC (hdc=0x15010720) returned 1 [0077.397] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2e9ee0 | out: lpmi=0x2e9ee0) returned 1 [0077.399] GetWindowThreadProcessId (in: hWnd=0x201d6, lpdwProcessId=0x2e9ed0 | out: lpdwProcessId=0x2e9ed0) returned 0x968 [0077.399] GetCurrentThreadId () returned 0x968 [0077.411] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc143 [0077.412] PostMessageW (hWnd=0x201d6, Msg=0xc143, wParam=0x0, lParam=0x0) returned 1 [0077.413] GetWindowTextLengthW (hWnd=0x201d6) returned 24 [0077.413] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0077.413] GetSystemMetrics (nIndex=42) returned 0 [0077.413] CoTaskMemAlloc (cb=0x36) returned 0x1b579fa0 [0077.413] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b579fa0, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0077.413] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b579fa0) returned 0x18 [0077.413] CoTaskMemFree (pv=0x1b579fa0) [0077.416] GdipImageGetFrameDimensionsCount (image=0x1b863aa0, count=0x2e9dc0) returned 0x0 [0077.416] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x1b5a4590 [0077.417] GdipImageGetFrameDimensionsList (image=0x1b863aa0, dimensionIDs=0x1b5a4590*(Data1=0x6f0024, Data2=0x73, Data3=0x74, Data4=([0]=0x4d, [1]=0x0, [2]=0x65, [3]=0x0, [4]=0x73, [5]=0x0, [6]=0x73, [7]=0x0)), count=0x1) returned 0x0 [0077.419] LocalFree (hMem=0x1b5a4590) returned 0x0 [0077.421] GdipImageGetFrameDimensionsCount (image=0x1b860fd0, count=0x2e9dc0) returned 0x0 [0077.421] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x1b5a45d0 [0077.421] GdipImageGetFrameDimensionsList (image=0x1b860fd0, dimensionIDs=0x1b5a45d0*(Data1=0x550c0028, Data2=0x726e, Data3=0x7365, Data4=([0]=0x74, [1]=0x72, [2]=0x69, [3]=0x63, [4]=0x74, [5]=0x65, [6]=0x64, [7]=0x1)), count=0x1) returned 0x0 [0077.421] LocalFree (hMem=0x1b5a45d0) returned 0x0 [0077.422] SystemParametersInfoW (in: uiAction=0x5f, uiParam=0x0, pvParam=0x2ea160, fWinIni=0x0 | out: pvParam=0x2ea160) returned 1 [0077.422] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x46, wParam=0x0, lParam=0x2ea8a0) returned 0x0 [0077.426] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0077.426] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0077.426] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0077.427] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0077.428] GetWindowPlacement (in: hWnd=0x201d6, lpwndpl=0x2ea320 | out: lpwndpl=0x2ea320) returned 1 [0077.428] GetClientRect (in: hWnd=0x201d6, lpRect=0x2ea1d0 | out: lpRect=0x2ea1d0) returned 1 [0077.429] GetWindowTextLengthW (hWnd=0x201d6) returned 24 [0077.429] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0077.429] GetSystemMetrics (nIndex=42) returned 0 [0077.429] CoTaskMemAlloc (cb=0x36) returned 0x1b579fa0 [0077.429] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b579fa0, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0077.429] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b579fa0) returned 0x18 [0077.429] CoTaskMemFree (pv=0x1b579fa0) [0077.432] GetClientRect (in: hWnd=0x201d6, lpRect=0x2e9f70 | out: lpRect=0x2e9f70) returned 1 [0077.434] GdipCreateHalftonePalette () returned 0x13080713 [0077.435] SelectPalette (hdc=0xb010833, hPal=0x13080713, bForceBkgd=1) returned 0x188000b [0077.435] GdipCreateFromHDC (hdc=0xb010833, graphics=0x2e9b40) returned 0x0 [0077.439] GdipSetPageUnit (graphics=0x1b047cc0, unit=0x2) returned 0x0 [0077.464] GdipCreateMatrix (matrix=0x2e9a30) returned 0x0 [0077.465] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869df0) returned 0x0 [0077.466] GdipIsMatrixIdentity (matrix=0x1b869df0, result=0x2e9a90) returned 0x0 [0077.467] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.468] GdipDeleteMatrix (matrix=0x1b869df0) returned 0x0 [0077.470] GdipCreateRegion (region=0x2e9a30) returned 0x0 [0077.472] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0 [0077.473] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e9a60) returned 0x0 [0077.474] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.475] GdipDeleteRegion (region=0x1afad4d0) returned 0x0 [0077.475] GdipSaveGraphics (graphics=0x1b047cc0, state=0x2e9b30) returned 0x0 [0077.522] GdipCreateRegion (region=0x2e9a00) returned 0x0 [0077.522] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0 [0077.522] GdipCreateMatrix (matrix=0x2e9a00) returned 0x0 [0077.522] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869e30) returned 0x0 [0077.522] GdipIsMatrixIdentity (matrix=0x1b869e30, result=0x2e9a60) returned 0x0 [0077.528] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fa0 [0077.528] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fa0) returned 0x0 [0077.528] LocalFree (hMem=0x1b579fa0) returned 0x0 [0077.528] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.528] GdipDeleteMatrix (matrix=0x1b869e30) returned 0x0 [0077.528] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e9ab0) returned 0x0 [0077.528] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.528] GdipDeleteRegion (region=0x1afad4d0) returned 0x0 [0077.529] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e9ae0) returned 0x0 [0077.530] GetCurrentObject (hdc=0xb010833, type=0x1) returned 0x1b00017 [0077.530] GetCurrentObject (hdc=0xb010833, type=0x2) returned 0x1900010 [0077.530] GetCurrentObject (hdc=0xb010833, type=0x7) returned 0x1050032 [0077.530] GetCurrentObject (hdc=0xb010833, type=0x6) returned 0x18a002e [0077.612] SaveDC (hdc=0xb010833) returned 1 [0077.613] OffsetViewportOrgEx (in: hdc=0xb010833, x=0, y=0, lppt=0x2878508 | out: lppt=0x2878508) returned 1 [0077.614] GetNearestColor (hdc=0xb010833, color=0xf0f0f0) returned 0xf0f0f0 [0077.663] CreateSolidBrush (color=0xf0f0f0) returned 0x1b100720 [0077.664] FillRect (hDC=0xb010833, lprc=0x2e9ab0, hbr=0x1b100720) returned 1 [0077.665] DeleteObject (ho=0x1b100720) returned 1 [0077.666] RestoreDC (hdc=0xb010833, nSavedDC=-1) returned 1 [0077.668] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.669] GdipReleaseDC (graphics=0x1b047cc0, hdc=0xb010833) returned 0x0 [0077.669] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.669] GdipDeleteGraphics (graphics=0x1b047cc0) returned 0x0 [0077.669] SelectPalette (hdc=0xb010833, hPal=0x188000b, bForceBkgd=0) returned 0x13080713 [0077.669] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0077.669] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0077.669] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0077.670] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x14, wParam=0xb010833, lParam=0x0) returned 0x1 [0077.670] GetStockObject (i=5) returned 0x1900015 [0077.670] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0077.670] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x14, wParam=0x1701082e, lParam=0x0) returned 0x1 [0077.670] GetStockObject (i=5) returned 0x1900015 [0077.671] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0077.671] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x14, wParam=0xb010833, lParam=0x0) returned 0x1 [0077.671] GetStockObject (i=5) returned 0x1900015 [0077.671] GetWindowPlacement (in: hWnd=0x201d6, lpwndpl=0x2ea300 | out: lpwndpl=0x2ea300) returned 1 [0077.671] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x47, wParam=0x0, lParam=0x2ea8a0) returned 0x0 [0077.671] GetClientRect (in: hWnd=0x201d6, lpRect=0x2ea0a0 | out: lpRect=0x2ea0a0) returned 1 [0077.671] GetWindowRect (in: hWnd=0x201d6, lpRect=0x2ea0a0 | out: lpRect=0x2ea0a0) returned 1 [0077.671] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0077.671] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0077.672] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0077.672] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x5, wParam=0x0, lParam=0x8a01b6) returned 0x0 [0077.672] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x3, wParam=0x0, lParam=0x17401f5) returned 0x0 [0077.672] GetClientRect (in: hWnd=0x201d6, lpRect=0x2ea170 | out: lpRect=0x2ea170) returned 1 [0077.672] GetWindowRect (in: hWnd=0x201d6, lpRect=0x2ea170 | out: lpRect=0x2ea170) returned 1 [0077.675] InvalidateRect (hWnd=0x201c8, lpRect=0x0, bErase=0) returned 1 [0077.675] InvalidateRect (hWnd=0x201ce, lpRect=0x0, bErase=0) returned 1 [0077.675] GetFocus () returned 0x201d6 [0077.675] GetFocus () returned 0x201d6 [0077.675] SetFocus (hWnd=0x201ce) returned 0x201d6 [0077.676] GetFocus () returned 0x201ce [0077.676] IsChild (hWndParent=0x201d6, hWnd=0x201ce) returned 1 [0077.676] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x8, wParam=0x201ce, lParam=0x0) returned 0x0 [0077.676] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0077.676] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0077.676] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0077.677] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x7, wParam=0x201d6, lParam=0x0) returned 0x0 [0077.677] GetStockObject (i=5) returned 0x1900015 [0077.677] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0077.677] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0xd, wParam=0x9, lParam=0x1b5a4630) returned 0x8 [0077.678] SendMessageW (hWnd=0x201ce, Msg=0x202b, wParam=0x201ce, lParam=0x2e9b90) returned 0x0 [0077.678] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x202b, wParam=0x201ce, lParam=0x2e9b90) returned 0x0 [0077.679] InvalidateRect (hWnd=0x201ce, lpRect=0x0, bErase=0) returned 1 [0077.679] GetFocus () returned 0x201ce [0077.711] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.711] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0077.711] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0077.712] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0077.712] IsWindowUnicode (hWnd=0x201d6) returned 1 [0077.712] GetMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.749] TranslateMessage (lpMsg=0x2ea8f0) returned 0 [0077.749] DispatchMessageW (lpMsg=0x2ea8f0) returned 0x0 [0077.750] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.750] GetMessageA (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.750] TranslateMessage (lpMsg=0x2ea8f0) returned 0 [0077.751] DispatchMessageA (lpMsg=0x2ea8f0) returned 0x0 [0077.751] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.751] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x84, wParam=0x0, lParam=0x1e40318) returned 0x1 [0077.751] IsWindowUnicode (hWnd=0x201c8) returned 1 [0077.751] GetMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.751] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x84, wParam=0x0, lParam=0x1e40318) returned 0x1 [0077.751] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0077.771] SetCursor (hCursor=0x10003) returned 0x10007 [0077.771] TranslateMessage (lpMsg=0x2ea8f0) returned 0 [0077.771] DispatchMessageW (lpMsg=0x2ea8f0) returned 0x0 [0077.773] _TrackMouseEvent (in: lpEventTrack=0x2878b30 | out: lpEventTrack=0x2878b30) returned 1 [0077.773] SendMessageW (hWnd=0x201c8, Msg=0xc137, wParam=0x0, lParam=0x0) returned 0x0 [0077.773] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0xc137, wParam=0x0, lParam=0x0) returned 0x0 [0077.773] InvalidateRect (hWnd=0x201c8, lpRect=0x0, bErase=0) returned 1 [0077.774] GetKeyState (nVirtKey=1) returned 0 [0077.774] GetKeyState (nVirtKey=2) returned 0 [0077.774] GetKeyState (nVirtKey=4) returned 0 [0077.774] GetKeyState (nVirtKey=5) returned 0 [0077.774] GetKeyState (nVirtKey=6) returned 0 [0077.774] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.774] IsWindowUnicode (hWnd=0x201d6) returned 1 [0077.774] GetMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.774] TranslateMessage (lpMsg=0x2ea8f0) returned 0 [0077.774] DispatchMessageW (lpMsg=0x2ea8f0) returned 0x0 [0077.774] BeginPaint (in: hWnd=0x201d6, lpPaint=0x2e9cc8 | out: lpPaint=0x2e9cc8) returned 0x201082d [0077.775] SelectPalette (hdc=0x201082d, hPal=0x13080713, bForceBkgd=1) returned 0x188000b [0077.775] GetWindowTextLengthW (hWnd=0x201d6) returned 24 [0077.775] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0077.775] GetSystemMetrics (nIndex=42) returned 0 [0077.775] CoTaskMemAlloc (cb=0x36) returned 0x1b579fa0 [0077.775] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b579fa0, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0077.775] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b579fa0) returned 0x18 [0077.775] CoTaskMemFree (pv=0x1b579fa0) [0077.775] EndPaint (hWnd=0x201d6, lpPaint=0x2e9cd8) returned 1 [0077.775] SelectPalette (hdc=0x201082d, hPal=0x188000b, bForceBkgd=0) returned 0x0 [0077.775] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.775] IsWindowUnicode (hWnd=0x201cc) returned 1 [0077.775] GetMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.775] TranslateMessage (lpMsg=0x2ea8f0) returned 0 [0077.775] DispatchMessageW (lpMsg=0x2ea8f0) returned 0x0 [0077.776] BeginPaint (in: hWnd=0x201cc, lpPaint=0x2e9cc8 | out: lpPaint=0x2e9cc8) returned 0xb010833 [0077.776] SelectPalette (hdc=0xb010833, hPal=0x13080713, bForceBkgd=1) returned 0x188000b [0077.777] CreateCompatibleDC (hdc=0xb010833) returned 0x14010812 [0077.777] GetObjectType (h=0xb010833) returned 0x3 [0077.777] CreateCompatibleBitmap (hdc=0xb010833, cx=1, cy=1) returned 0x2905081e [0077.778] GetDIBits (in: hdc=0xb010833, hbm=0x2905081e, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x2e93e8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2e93e8) returned 1 [0077.778] GetDIBits (in: hdc=0xb010833, hbm=0x2905081e, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x2e93e8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2e93e8) returned 1 [0077.778] DeleteObject (ho=0x2905081e) returned 1 [0077.778] CreateDIBSection (in: hdc=0xb010833, lpbmi=0x2e95c0, usage=0x0, ppvBits=0x2e95b8, hSection=0x0, offset=0x0 | out: ppvBits=0x2e95b8) returned 0x66050816 [0077.778] SelectObject (hdc=0x14010812, h=0x66050816) returned 0x185000f [0077.778] GdipCreateFromHDC (hdc=0x14010812, graphics=0x2e9ad0) returned 0x0 [0077.779] GdipTranslateWorldTransform (graphics=0x1b047cc0, dx=0x0, dy=0x7fef1bbba58, order=0x0) returned 0x0 [0077.781] GdipSetClipRectI (graphics=0x1b047cc0, x=0, y=0, width=64, height=64, combineMode=0x0) returned 0x0 [0077.781] GdipCreateMatrix (matrix=0x2e9c00) returned 0x0 [0077.781] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869df0) returned 0x0 [0077.781] GdipIsMatrixIdentity (matrix=0x1b869df0, result=0x2e9c60) returned 0x0 [0077.781] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fa0 [0077.781] GdipGetMatrixElements (matrix=0x1b869df0, matrixOut=0x1b579fa0) returned 0x0 [0077.781] LocalFree (hMem=0x1b579fa0) returned 0x0 [0077.781] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.781] GdipDeleteMatrix (matrix=0x1b869df0) returned 0x0 [0077.781] GdipCreateRegion (region=0x2e9c00) returned 0x0 [0077.781] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0 [0077.782] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e9c30) returned 0x0 [0077.782] GdipSaveGraphics (graphics=0x1b047cc0, state=0x2e9d00) returned 0x0 [0077.782] GetWindowTextLengthW (hWnd=0x201cc) returned 0 [0077.782] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0077.782] GetSystemMetrics (nIndex=42) returned 0 [0077.782] CoTaskMemAlloc (cb=0x6) returned 0x1b57ec50 [0077.782] GetWindowTextW (in: hWnd=0x201cc, lpString=0x1b57ec50, nMaxCount=1 | out: lpString="") returned 0 [0077.782] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0xd, wParam=0x1, lParam=0x1b57ec50) returned 0x0 [0077.782] CoTaskMemFree (pv=0x1b57ec50) [0077.782] GetClientRect (in: hWnd=0x201cc, lpRect=0x2e9c60 | out: lpRect=0x2e9c60) returned 1 [0077.782] GdipCreateRegion (region=0x2e96f0) returned 0x0 [0077.782] GdipGetClip (graphics=0x1b047cc0, region=0x1b86adc0) returned 0x0 [0077.782] GdipCreateMatrix (matrix=0x2e96f0) returned 0x0 [0077.782] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869e30) returned 0x0 [0077.782] GdipIsMatrixIdentity (matrix=0x1b869e30, result=0x2e9750) returned 0x0 [0077.782] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fa0 [0077.782] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fa0) returned 0x0 [0077.782] LocalFree (hMem=0x1b579fa0) returned 0x0 [0077.783] GdipCombineRegionRegion (region=0x1b86adc0, region2=0x1afad4d0, combineMode=0x1) returned 0x0 [0077.783] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fa0 [0077.783] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fa0) returned 0x0 [0077.783] LocalFree (hMem=0x1b579fa0) returned 0x0 [0077.783] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.783] GdipDeleteMatrix (matrix=0x1b869e30) returned 0x0 [0077.783] GdipIsInfiniteRegion (region=0x1b86adc0, graphics=0x1b047cc0, result=0x2e97a0) returned 0x0 [0077.784] GdipIsInfiniteRegion (region=0x1b86adc0, graphics=0x1b047cc0, result=0x2e9760) returned 0x0 [0077.785] GdipGetRegionHRgn (region=0x1b86adc0, graphics=0x1b047cc0, hRgn=0x2e9760) returned 0x0 [0077.786] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.786] GdipDeleteRegion (region=0x1b86adc0) returned 0x0 [0077.786] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e97d0) returned 0x0 [0077.786] GetCurrentObject (hdc=0x14010812, type=0x1) returned 0x1b00017 [0077.786] GetCurrentObject (hdc=0x14010812, type=0x2) returned 0x1900010 [0077.786] GetCurrentObject (hdc=0x14010812, type=0x7) returned 0x66050816 [0077.786] GetCurrentObject (hdc=0x14010812, type=0x6) returned 0x18a002e [0077.786] SaveDC (hdc=0x14010812) returned 1 [0077.787] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1c040836 [0077.788] GetClipRgn (hdc=0x14010812, hrgn=0x1c040836) returned 0 [0077.788] SelectClipRgn (hdc=0x14010812, hrgn=0x16040725) returned 2 [0077.789] DeleteObject (ho=0x1c040836) returned 1 [0077.789] DeleteObject (ho=0x16040725) returned 1 [0077.789] OffsetViewportOrgEx (in: hdc=0x14010812, x=0, y=0, lppt=0x287a528 | out: lppt=0x287a528) returned 1 [0077.789] GetNearestColor (hdc=0x14010812, color=0xf0f0f0) returned 0xf0f0f0 [0077.789] CreateSolidBrush (color=0xf0f0f0) returned 0x1c100720 [0077.789] FillRect (hDC=0x14010812, lprc=0x2e97a0, hbr=0x1c100720) returned 1 [0077.789] DeleteObject (ho=0x1c100720) returned 1 [0077.789] RestoreDC (hdc=0x14010812, nSavedDC=-1) returned 1 [0077.789] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.790] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x14010812) returned 0x0 [0077.790] GdipRestoreGraphics (graphics=0x1b047cc0, state=0xfffffffffdb10dbd) returned 0x0 [0077.795] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.795] GdipDeleteRegion (region=0x1afad4d0) returned 0x0 [0077.795] GetWindowTextLengthW (hWnd=0x201cc) returned 0 [0077.795] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0077.795] GetSystemMetrics (nIndex=42) returned 0 [0077.795] CoTaskMemAlloc (cb=0x6) returned 0x1b57ec50 [0077.795] GetWindowTextW (in: hWnd=0x201cc, lpString=0x1b57ec50, nMaxCount=1 | out: lpString="") returned 0 [0077.795] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0xd, wParam=0x1, lParam=0x1b57ec50) returned 0x0 [0077.795] CoTaskMemFree (pv=0x1b57ec50) [0077.824] GdipGetImageWidth (image=0x1b863aa0, width=0x2e9a60) returned 0x0 [0077.824] GdipGetImageHeight (image=0x1b863aa0, height=0x2e9a60) returned 0x0 [0077.824] GdipGetImageWidth (image=0x1b863aa0, width=0x2e9a10) returned 0x0 [0077.824] GdipGetImageHeight (image=0x1b863aa0, height=0x2e9a10) returned 0x0 [0077.825] GdipDrawImageRectI (graphics=0x1b047cc0, image=0x1b863aa0, x=16, y=16, width=32, height=32) returned 0x0 [0077.826] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e9bd0) returned 0x0 [0077.827] BitBlt (hdc=0xb010833, x=0, y=0, cx=64, cy=64, hdcSrc=0x14010812, x1=0, y1=0, rop=0xcc0020) returned 1 [0077.827] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.827] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x14010812) returned 0x0 [0077.827] SelectObject (hdc=0x14010812, h=0x185000f) returned 0x66050816 [0077.828] DeleteDC (hdc=0x14010812) returned 1 [0077.828] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.828] GdipDeleteGraphics (graphics=0x1b047cc0) returned 0x0 [0077.828] SelectPalette (hdc=0xb010833, hPal=0x188000b, bForceBkgd=0) returned 0x13080713 [0077.828] EndPaint (hWnd=0x201cc, lpPaint=0x2e9cd8) returned 1 [0077.828] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.828] IsWindowUnicode (hWnd=0x201da) returned 1 [0077.828] GetMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.828] TranslateMessage (lpMsg=0x2ea8f0) returned 0 [0077.828] DispatchMessageW (lpMsg=0x2ea8f0) returned 0x0 [0077.828] BeginPaint (in: hWnd=0x201da, lpPaint=0x2e9c18 | out: lpPaint=0x2e9c18) returned 0x2010844 [0077.828] SelectPalette (hdc=0x2010844, hPal=0x13080713, bForceBkgd=1) returned 0x188000b [0077.828] CreateCompatibleDC (hdc=0x2010844) returned 0x16010812 [0077.828] GetObjectType (h=0x2010844) returned 0x3 [0077.828] CreateCompatibleBitmap (hdc=0x2010844, cx=1, cy=1) returned 0x130507f8 [0077.828] GetDIBits (in: hdc=0x2010844, hbm=0x130507f8, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x2e92a8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2e92a8) returned 1 [0077.828] GetDIBits (in: hdc=0x2010844, hbm=0x130507f8, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x2e92a8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2e92a8) returned 1 [0077.828] DeleteObject (ho=0x130507f8) returned 1 [0077.829] CreateDIBSection (in: hdc=0x2010844, lpbmi=0x2e9480, usage=0x0, ppvBits=0x2e9478, hSection=0x0, offset=0x0 | out: ppvBits=0x2e9478) returned 0x59050854 [0077.829] SelectObject (hdc=0x16010812, h=0x59050854) returned 0x185000f [0077.829] GdipCreateFromHDC (hdc=0x16010812, graphics=0x2e9990) returned 0x0 [0077.829] GdipTranslateWorldTransform (graphics=0x1b047cc0, dx=0x0, dy=0x7fef1bbba58, order=0x0) returned 0x0 [0077.829] GdipSetClipRectI (graphics=0x1b047cc0, x=0, y=0, width=354, height=81, combineMode=0x0) returned 0x0 [0077.829] GdipCreateMatrix (matrix=0x2e9b50) returned 0x0 [0077.829] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869df0) returned 0x0 [0077.829] GdipIsMatrixIdentity (matrix=0x1b869df0, result=0x2e9bb0) returned 0x0 [0077.829] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fa0 [0077.829] GdipGetMatrixElements (matrix=0x1b869df0, matrixOut=0x1b579fa0) returned 0x0 [0077.829] LocalFree (hMem=0x1b579fa0) returned 0x0 [0077.829] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.829] GdipDeleteMatrix (matrix=0x1b869df0) returned 0x0 [0077.829] GdipCreateRegion (region=0x2e9b50) returned 0x0 [0077.829] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0 [0077.829] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e9b80) returned 0x0 [0077.830] GdipSaveGraphics (graphics=0x1b047cc0, state=0x2e9c50) returned 0x0 [0077.830] GetWindowTextLengthW (hWnd=0x201da) returned 283 [0077.830] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11b [0077.830] GetSystemMetrics (nIndex=42) returned 0 [0077.830] CoTaskMemAlloc (cb=0x23c) returned 0x1b5abbb0 [0077.830] GetWindowTextW (in: hWnd=0x201da, lpString=0x1b5abbb0, nMaxCount=284 | out: lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.") returned 283 [0077.830] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xd, wParam=0x11c, lParam=0x1b5abbb0) returned 0x11b [0077.830] CoTaskMemFree (pv=0x1b5abbb0) [0077.830] GetClientRect (in: hWnd=0x201da, lpRect=0x2e9bb0 | out: lpRect=0x2e9bb0) returned 1 [0077.830] GdipCreateRegion (region=0x2e9640) returned 0x0 [0077.830] GdipGetClip (graphics=0x1b047cc0, region=0x1b86adc0) returned 0x0 [0077.830] GdipCreateMatrix (matrix=0x2e9640) returned 0x0 [0077.830] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869e30) returned 0x0 [0077.830] GdipIsMatrixIdentity (matrix=0x1b869e30, result=0x2e96a0) returned 0x0 [0077.830] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fa0 [0077.830] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fa0) returned 0x0 [0077.830] LocalFree (hMem=0x1b579fa0) returned 0x0 [0077.830] GdipCombineRegionRegion (region=0x1b86adc0, region2=0x1afad4d0, combineMode=0x1) returned 0x0 [0077.831] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fa0 [0077.831] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fa0) returned 0x0 [0077.831] LocalFree (hMem=0x1b579fa0) returned 0x0 [0077.831] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.831] GdipDeleteMatrix (matrix=0x1b869e30) returned 0x0 [0077.831] GdipIsInfiniteRegion (region=0x1b86adc0, graphics=0x1b047cc0, result=0x2e96f0) returned 0x0 [0077.831] GdipIsInfiniteRegion (region=0x1b86adc0, graphics=0x1b047cc0, result=0x2e96b0) returned 0x0 [0077.831] GdipGetRegionHRgn (region=0x1b86adc0, graphics=0x1b047cc0, hRgn=0x2e96b0) returned 0x0 [0077.831] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.831] GdipDeleteRegion (region=0x1b86adc0) returned 0x0 [0077.831] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e9720) returned 0x0 [0077.831] GetCurrentObject (hdc=0x16010812, type=0x1) returned 0x1b00017 [0077.831] GetCurrentObject (hdc=0x16010812, type=0x2) returned 0x1900010 [0077.831] GetCurrentObject (hdc=0x16010812, type=0x7) returned 0x59050854 [0077.831] GetCurrentObject (hdc=0x16010812, type=0x6) returned 0x18a002e [0077.831] SaveDC (hdc=0x16010812) returned 1 [0077.831] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x17040725 [0077.831] GetClipRgn (hdc=0x16010812, hrgn=0x17040725) returned 0 [0077.831] SelectClipRgn (hdc=0x16010812, hrgn=0x1d040836) returned 2 [0077.831] DeleteObject (ho=0x17040725) returned 1 [0077.831] DeleteObject (ho=0x1d040836) returned 1 [0077.831] OffsetViewportOrgEx (in: hdc=0x16010812, x=0, y=0, lppt=0x287beb0 | out: lppt=0x287beb0) returned 1 [0077.832] GetNearestColor (hdc=0x16010812, color=0xf0f0f0) returned 0xf0f0f0 [0077.832] CreateSolidBrush (color=0xf0f0f0) returned 0x1d100720 [0077.832] FillRect (hDC=0x16010812, lprc=0x2e96f0, hbr=0x1d100720) returned 1 [0077.832] DeleteObject (ho=0x1d100720) returned 1 [0077.832] RestoreDC (hdc=0x16010812, nSavedDC=-1) returned 1 [0077.832] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.832] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x16010812) returned 0x0 [0077.832] GdipRestoreGraphics (graphics=0x1b047cc0, state=0xfffffffffdaf0dbd) returned 0x0 [0077.832] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.832] GdipDeleteRegion (region=0x1afad4d0) returned 0x0 [0077.832] GetWindowTextLengthW (hWnd=0x201da) returned 283 [0077.832] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11b [0077.832] GetSystemMetrics (nIndex=42) returned 0 [0077.833] CoTaskMemAlloc (cb=0x23c) returned 0x1b5abbb0 [0077.833] GetWindowTextW (in: hWnd=0x201da, lpString=0x1b5abbb0, nMaxCount=284 | out: lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.") returned 283 [0077.833] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xd, wParam=0x11c, lParam=0x1b5abbb0) returned 0x11b [0077.833] CoTaskMemFree (pv=0x1b5abbb0) [0077.834] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e9770) returned 0x0 [0077.834] GetCurrentObject (hdc=0x16010812, type=0x1) returned 0x1b00017 [0077.834] GetCurrentObject (hdc=0x16010812, type=0x2) returned 0x1900010 [0077.834] GetCurrentObject (hdc=0x16010812, type=0x7) returned 0x59050854 [0077.834] GetCurrentObject (hdc=0x16010812, type=0x6) returned 0x18a002e [0077.834] SaveDC (hdc=0x16010812) returned 1 [0077.834] GetNearestColor (hdc=0x16010812, color=0x0) returned 0x0 [0077.834] RestoreDC (hdc=0x16010812, nSavedDC=-1) returned 1 [0077.834] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.834] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x16010812) returned 0x0 [0077.851] AdjustWindowRectEx (in: lpRect=0x2e9630, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x2e9630) returned 1 [0077.853] CoTaskMemAlloc (cb=0x44) returned 0x1b5ac110 [0077.853] GdipGetFamilyName (in: family=0x12fc5e0, name=0x1b5ac110, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0077.853] CoTaskMemFree (pv=0x1b5ac110) [0077.854] CreateCompatibleDC (hdc=0x0) returned 0x1a01081f [0077.854] GetCurrentObject (hdc=0x1a01081f, type=0x1) returned 0x1b00017 [0077.854] GetCurrentObject (hdc=0x1a01081f, type=0x2) returned 0x1900010 [0077.854] GetCurrentObject (hdc=0x1a01081f, type=0x7) returned 0x185000f [0077.854] GetCurrentObject (hdc=0x1a01081f, type=0x6) returned 0x18a002e [0077.854] SaveDC (hdc=0x1a01081f) returned 1 [0077.855] GetDeviceCaps (hdc=0x1a01081f, index=90) returned 96 [0077.856] CreateFontIndirectW (lplf=0x1b7a30) returned 0xa0a0281 [0077.856] GetObjectW (in: h=0xa0a0281, c=92, pv=0x2e93d0 | out: pv=0x2e93d0) returned 92 [0077.876] GetCurrentObject (hdc=0x1a01081f, type=0x6) returned 0x18a002e [0077.876] GetObjectW (in: h=0x18a002e, c=92, pv=0x2e9200 | out: pv=0x2e9200) returned 92 [0077.878] SelectObject (hdc=0x1a01081f, h=0xa0a0281) returned 0x18a002e [0077.879] GetMapMode (hdc=0x1a01081f) returned 1 [0077.880] GetTextMetricsW (in: hdc=0x1a01081f, lptm=0x2e9230 | out: lptm=0x2e9230) returned 1 [0077.880] DrawTextExW (in: hdc=0x1a01081f, lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.", cchText=283, lprc=0x2e9500, format=0x102400, lpdtp=0x287cb60 | out: lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.", lprc=0x2e9500) returned 39 [0077.881] GdipGetTextRenderingHint (graphics=0x1b047cc0, mode=0x2e9650) returned 0x0 [0077.881] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e9630) returned 0x0 [0077.882] GetCurrentObject (hdc=0x16010812, type=0x1) returned 0x1b00017 [0077.882] GetCurrentObject (hdc=0x16010812, type=0x2) returned 0x1900010 [0077.882] GetCurrentObject (hdc=0x16010812, type=0x7) returned 0x59050854 [0077.882] GetCurrentObject (hdc=0x16010812, type=0x6) returned 0x18a002e [0077.882] SaveDC (hdc=0x16010812) returned 1 [0077.882] GetTextAlign (hdc=0x16010812) returned 0x0 [0077.883] GetTextColor (hdc=0x16010812) returned 0x0 [0077.883] GetCurrentObject (hdc=0x16010812, type=0x6) returned 0x18a002e [0077.883] GetObjectW (in: h=0x18a002e, c=92, pv=0x2e90a0 | out: pv=0x2e90a0) returned 92 [0077.883] SelectObject (hdc=0x16010812, h=0xa0a0281) returned 0x18a002e [0077.883] GetBkMode (hdc=0x16010812) returned 2 [0077.883] SetBkMode (hdc=0x16010812, mode=1) returned 2 [0077.883] DrawTextExW (in: hdc=0x16010812, lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.", cchText=283, lprc=0x2e91e0, format=0x102010, lpdtp=0x287cea8 | out: lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.", lprc=0x2e91e0) returned 78 [0077.887] RestoreDC (hdc=0x16010812, nSavedDC=-1) returned 1 [0077.887] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.887] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x16010812) returned 0x0 [0077.887] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e9b20) returned 0x0 [0077.887] BitBlt (hdc=0x2010844, x=0, y=0, cx=354, cy=81, hdcSrc=0x16010812, x1=0, y1=0, rop=0xcc0020) returned 1 [0077.887] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.888] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x16010812) returned 0x0 [0077.888] SelectObject (hdc=0x16010812, h=0x185000f) returned 0x59050854 [0077.888] DeleteDC (hdc=0x16010812) returned 1 [0077.888] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.888] GdipDeleteGraphics (graphics=0x1b047cc0) returned 0x0 [0077.888] DeleteObject (ho=0x59050854) returned 1 [0077.888] SelectPalette (hdc=0x2010844, hPal=0x188000b, bForceBkgd=0) returned 0x13080713 [0077.888] EndPaint (hWnd=0x201da, lpPaint=0x2e9c28) returned 1 [0077.888] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.889] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0077.889] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0077.890] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0077.890] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0077.891] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x46, wParam=0x0, lParam=0x2ea710) returned 0x0 [0077.891] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x84, wParam=0x0, lParam=0x1e40318) returned 0x1 [0077.891] IsWindowUnicode (hWnd=0x201c8) returned 1 [0077.891] GetMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.891] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x84, wParam=0x0, lParam=0x1e40318) returned 0x1 [0077.891] GetDlgItem (hDlg=0x201d6, nIDDlgItem=0) returned 0x0 [0077.891] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x210, wParam=0x201, lParam=0x700123) returned 0x0 [0077.892] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x21, wParam=0x201d6, lParam=0x2010001) returned 0x1 [0077.892] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x21, wParam=0x201d6, lParam=0x2010001) returned 0x1 [0077.892] SetCursor (hCursor=0x10003) returned 0x10003 [0077.892] TranslateMessage (lpMsg=0x2ea8f0) returned 0 [0077.892] DispatchMessageW (lpMsg=0x2ea8f0) returned 0x0 [0077.893] GetKeyState (nVirtKey=1) returned -127 [0077.893] GetKeyState (nVirtKey=2) returned 0 [0077.893] GetKeyState (nVirtKey=4) returned 0 [0077.893] GetKeyState (nVirtKey=5) returned 0 [0077.893] GetKeyState (nVirtKey=6) returned 0 [0077.894] IsWindowVisible (hWnd=0x201c8) returned 1 [0077.894] IsWindowEnabled (hWnd=0x201c8) returned 1 [0077.894] SetFocus (hWnd=0x201c8) returned 0x201ce [0077.894] GetFocus () returned 0x201c8 [0077.894] IsChild (hWndParent=0x201d6, hWnd=0x201c8) returned 1 [0077.894] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x8, wParam=0x201c8, lParam=0x0) returned 0x0 [0077.896] GetCapture () returned 0x0 [0077.896] InvalidateRect (hWnd=0x201ce, lpRect=0x0, bErase=0) returned 1 [0077.896] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0077.896] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0077.896] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0077.899] InvalidateRect (hWnd=0x201ce, lpRect=0x0, bErase=0) returned 1 [0077.899] InvalidateRect (hWnd=0x201c8, lpRect=0x0, bErase=0) returned 1 [0077.899] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x7, wParam=0x201ce, lParam=0x0) returned 0x0 [0077.899] GetStockObject (i=5) returned 0x1900015 [0077.899] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x9 [0077.899] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0xd, wParam=0xa, lParam=0x1b5a4750) returned 0x9 [0077.900] SendMessageW (hWnd=0x201c8, Msg=0x202b, wParam=0x201c8, lParam=0x2e9420) returned 0x0 [0077.900] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x202b, wParam=0x201c8, lParam=0x2e9420) returned 0x0 [0077.900] InvalidateRect (hWnd=0x201c8, lpRect=0x0, bErase=0) returned 1 [0077.900] GetFocus () returned 0x201c8 [0077.900] GetFocus () returned 0x201c8 [0077.900] GetFocus () returned 0x201c8 [0077.900] GetKeyState (nVirtKey=1) returned -127 [0077.900] GetKeyState (nVirtKey=2) returned 0 [0077.900] GetKeyState (nVirtKey=4) returned 0 [0077.900] GetKeyState (nVirtKey=5) returned 0 [0077.900] GetKeyState (nVirtKey=6) returned 0 [0077.900] GetCapture () returned 0x0 [0077.901] SetCapture (hWnd=0x201c8) returned 0x0 [0077.901] GetKeyState (nVirtKey=1) returned -127 [0077.901] GetKeyState (nVirtKey=2) returned 0 [0077.901] GetKeyState (nVirtKey=4) returned 0 [0077.901] GetKeyState (nVirtKey=5) returned 0 [0077.901] GetKeyState (nVirtKey=6) returned 0 [0077.901] NotifyWinEvent (event=0x800a, hwnd=0x201c8, idObject=-4, idChild=0) [0077.901] InvalidateRect (hWnd=0x201c8, lpRect=0x2e9f70, bErase=0) returned 1 [0077.901] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.901] GetMessageA (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.901] TranslateMessage (lpMsg=0x2ea8f0) returned 0 [0077.901] DispatchMessageA (lpMsg=0x2ea8f0) returned 0x0 [0077.901] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.901] IsWindowUnicode (hWnd=0x201c8) returned 1 [0077.901] GetMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.902] TranslateMessage (lpMsg=0x2ea8f0) returned 0 [0077.902] DispatchMessageW (lpMsg=0x2ea8f0) returned 0x1 [0077.902] MapWindowPoints (in: hWndFrom=0x201c8, hWndTo=0x0, lpPoints=0x287d0a0, cPoints=0x1 | out: lpPoints=0x287d0a0) returned 31392470 [0077.903] NotifyWinEvent (event=0x800a, hwnd=0x201c8, idObject=-4, idChild=0) [0077.903] InvalidateRect (hWnd=0x201c8, lpRect=0x2e9ec0, bErase=0) returned 1 [0077.903] UpdateWindow (hWnd=0x201c8) returned 1 [0077.903] BeginPaint (in: hWnd=0x201c8, lpPaint=0x2e93d8 | out: lpPaint=0x2e93d8) returned 0x201082d [0077.903] SelectPalette (hdc=0x201082d, hPal=0x13080713, bForceBkgd=1) returned 0x188000b [0077.903] CreateCompatibleDC (hdc=0x201082d) returned 0x190107f8 [0077.903] DeleteObject (ho=0x66050816) returned 1 [0077.903] GetObjectType (h=0x201082d) returned 0x3 [0077.903] CreateCompatibleBitmap (hdc=0x201082d, cx=1, cy=1) returned 0x2b05081e [0077.903] GetDIBits (in: hdc=0x201082d, hbm=0x2b05081e, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x2e8af8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2e8af8) returned 1 [0077.903] GetDIBits (in: hdc=0x201082d, hbm=0x2b05081e, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x2e8af8, usage=0x0 | out: lpvBits=0x0, lpbmi=0x2e8af8) returned 1 [0077.903] DeleteObject (ho=0x2b05081e) returned 1 [0077.903] CreateDIBSection (in: hdc=0x201082d, lpbmi=0x2e8cd0, usage=0x0, ppvBits=0x2e8cc8, hSection=0x0, offset=0x0 | out: ppvBits=0x2e8cc8) returned 0x67050816 [0077.903] SelectObject (hdc=0x190107f8, h=0x67050816) returned 0x185000f [0077.903] GdipCreateFromHDC (hdc=0x190107f8, graphics=0x2e91e0) returned 0x0 [0077.904] GdipTranslateWorldTransform (graphics=0x1b047cc0, dx=0x0, dy=0x7fef1bbba58, order=0x0) returned 0x0 [0077.904] GdipSetClipRectI (graphics=0x1b047cc0, x=0, y=0, width=100, height=23, combineMode=0x0) returned 0x0 [0077.904] GdipCreateMatrix (matrix=0x2e9310) returned 0x0 [0077.904] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869df0) returned 0x0 [0077.904] GdipIsMatrixIdentity (matrix=0x1b869df0, result=0x2e9370) returned 0x0 [0077.904] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fa0 [0077.904] GdipGetMatrixElements (matrix=0x1b869df0, matrixOut=0x1b579fa0) returned 0x0 [0077.904] LocalFree (hMem=0x1b579fa0) returned 0x0 [0077.904] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.904] GdipDeleteMatrix (matrix=0x1b869df0) returned 0x0 [0077.904] GdipCreateRegion (region=0x2e9310) returned 0x0 [0077.904] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0 [0077.904] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e9340) returned 0x0 [0077.904] GdipSaveGraphics (graphics=0x1b047cc0, state=0x2e9410) returned 0x0 [0077.904] GdipRestoreGraphics (graphics=0x1b047cc0, state=0xfffffffffdad0dbd) returned 0x0 [0077.904] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.904] GdipDeleteRegion (region=0x1afad4d0) returned 0x0 [0077.918] SystemParametersInfoW (in: uiAction=0x42, uiParam=0x10, pvParam=0x2e8f90, fWinIni=0x0 | out: pvParam=0x2e8f90) returned 1 [0077.918] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e87f0) returned 0x0 [0077.918] GetCurrentObject (hdc=0x190107f8, type=0x1) returned 0x1b00017 [0077.918] GetCurrentObject (hdc=0x190107f8, type=0x2) returned 0x1900010 [0077.918] GetCurrentObject (hdc=0x190107f8, type=0x7) returned 0x67050816 [0077.919] GetCurrentObject (hdc=0x190107f8, type=0x6) returned 0x18a002e [0077.919] SaveDC (hdc=0x190107f8) returned 1 [0077.919] GetNearestColor (hdc=0x190107f8, color=0xf0f0f0) returned 0xf0f0f0 [0077.919] GetNearestColor (hdc=0x190107f8, color=0xa0a0a0) returned 0xa0a0a0 [0077.919] GetNearestColor (hdc=0x190107f8, color=0x696969) returned 0x696969 [0077.919] GetNearestColor (hdc=0x190107f8, color=0xa0a0a0) returned 0xa0a0a0 [0077.919] GetNearestColor (hdc=0x190107f8, color=0x0) returned 0x0 [0077.919] GetNearestColor (hdc=0x190107f8, color=0xffffff) returned 0xffffff [0077.919] GetNearestColor (hdc=0x190107f8, color=0xe5e5e5) returned 0xe5e5e5 [0077.919] GetNearestColor (hdc=0x190107f8, color=0xd8d8d8) returned 0xd8d8d8 [0077.919] GetNearestColor (hdc=0x190107f8, color=0x0) returned 0x0 [0077.919] RestoreDC (hdc=0x190107f8, nSavedDC=-1) returned 1 [0077.919] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.919] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x190107f8) returned 0x0 [0077.928] IsAppThemed () returned 0x1 [0077.928] GetThemeAppProperties () returned 0x3 [0077.928] GetThemeAppProperties () returned 0x3 [0077.929] OpenThemeData () returned 0x10003 [0077.938] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x2e8ef0, fWinIni=0x0 | out: pvParam=0x2e8ef0) returned 1 [0077.938] SendMessageW (hWnd=0x201d6, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0077.938] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0077.938] IsAppThemed () returned 0x1 [0077.938] GetThemeAppProperties () returned 0x3 [0077.938] GetThemeAppProperties () returned 0x3 [0077.941] DrawTextExW (in: hdc=0x1a01081f, lpchText="&Continue", cchText=9, lprc=0x2e8a30, format=0x102415, lpdtp=0x287efe0 | out: lpchText="&Continue", lprc=0x2e8a30) returned 13 [0077.941] IsAppThemed () returned 0x1 [0077.941] GetThemeAppProperties () returned 0x3 [0077.941] GetThemeAppProperties () returned 0x3 [0077.941] IsAppThemed () returned 0x1 [0077.941] GetThemeAppProperties () returned 0x3 [0077.941] GetThemeAppProperties () returned 0x3 [0077.943] IsAppThemed () returned 0x1 [0077.943] GetThemeAppProperties () returned 0x3 [0077.943] GetThemeAppProperties () returned 0x3 [0077.943] IsAppThemed () returned 0x1 [0077.943] GetThemeAppProperties () returned 0x3 [0077.943] GetThemeAppProperties () returned 0x3 [0077.944] IsThemePartDefined () returned 0x1 [0077.944] IsAppThemed () returned 0x1 [0077.944] GetThemeAppProperties () returned 0x3 [0077.944] GetThemeAppProperties () returned 0x3 [0077.944] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0077.944] IsAppThemed () returned 0x1 [0077.944] GetThemeAppProperties () returned 0x3 [0077.944] GetThemeAppProperties () returned 0x3 [0077.944] IsAppThemed () returned 0x1 [0077.944] GetThemeAppProperties () returned 0x3 [0077.944] GetThemeAppProperties () returned 0x3 [0077.944] IsThemePartDefined () returned 0x1 [0077.944] GdipCreateRegion (region=0x2e8b10) returned 0x0 [0077.944] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0 [0077.944] GdipCreateMatrix (matrix=0x2e8b10) returned 0x0 [0077.944] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869e30) returned 0x0 [0077.944] GdipIsMatrixIdentity (matrix=0x1b869e30, result=0x2e8b70) returned 0x0 [0077.944] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0 [0077.944] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fe0) returned 0x0 [0077.945] LocalFree (hMem=0x1b579fe0) returned 0x0 [0077.945] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0 [0077.945] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fe0) returned 0x0 [0077.945] LocalFree (hMem=0x1b579fe0) returned 0x0 [0077.945] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.945] GdipDeleteMatrix (matrix=0x1b869e30) returned 0x0 [0077.945] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e8bc0) returned 0x0 [0077.945] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e8b80) returned 0x0 [0077.945] GdipGetRegionHRgn (region=0x1afad4d0, graphics=0x1b047cc0, hRgn=0x2e8b80) returned 0x0 [0077.945] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.945] GdipDeleteRegion (region=0x1afad4d0) returned 0x0 [0077.945] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e8bf0) returned 0x0 [0077.945] GetCurrentObject (hdc=0x190107f8, type=0x1) returned 0x1b00017 [0077.945] GetCurrentObject (hdc=0x190107f8, type=0x2) returned 0x1900010 [0077.945] GetCurrentObject (hdc=0x190107f8, type=0x7) returned 0x67050816 [0077.945] GetCurrentObject (hdc=0x190107f8, type=0x6) returned 0x18a002e [0077.945] SaveDC (hdc=0x190107f8) returned 1 [0077.945] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1e040836 [0077.945] GetClipRgn (hdc=0x190107f8, hrgn=0x1e040836) returned 0 [0077.945] SelectClipRgn (hdc=0x190107f8, hrgn=0x1d040725) returned 2 [0077.945] DeleteObject (ho=0x1e040836) returned 1 [0077.945] DeleteObject (ho=0x1d040725) returned 1 [0077.945] OffsetViewportOrgEx (in: hdc=0x190107f8, x=0, y=0, lppt=0x287fa38 | out: lppt=0x287fa38) returned 1 [0077.946] DrawThemeParentBackground () returned 0x0 [0077.946] GetWindowPlacement (in: hWnd=0x201d6, lpwndpl=0x2e8680 | out: lpwndpl=0x2e8680) returned 1 [0077.946] GetClientRect (in: hWnd=0x201d6, lpRect=0x2e8530 | out: lpRect=0x2e8530) returned 1 [0077.946] GetWindowTextLengthW (hWnd=0x201d6) returned 24 [0077.946] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0077.946] GetSystemMetrics (nIndex=42) returned 0 [0077.946] CoTaskMemAlloc (cb=0x36) returned 0x1b579fe0 [0077.946] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b579fe0, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0077.946] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b579fe0) returned 0x18 [0077.946] CoTaskMemFree (pv=0x1b579fe0) [0077.946] GetClientRect (in: hWnd=0x201d6, lpRect=0x2e82d0 | out: lpRect=0x2e82d0) returned 1 [0077.946] SelectPalette (hdc=0x190107f8, hPal=0x13080713, bForceBkgd=1) returned 0x188000b [0077.946] GdipCreateFromHDC (hdc=0x190107f8, graphics=0x2e7ea0) returned 0x0 [0077.946] GdipSetPageUnit (graphics=0x1b048180, unit=0x2) returned 0x0 [0077.946] GdipCreateMatrix (matrix=0x2e7d90) returned 0x0 [0077.946] GdipGetWorldTransform (graphics=0x1b048180, matrix=0x1b869df0) returned 0x0 [0077.947] GdipIsMatrixIdentity (matrix=0x1b869df0, result=0x2e7df0) returned 0x0 [0077.947] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.947] GdipDeleteMatrix (matrix=0x1b869df0) returned 0x0 [0077.947] GdipCreateRegion (region=0x2e7d90) returned 0x0 [0077.947] GdipGetClip (graphics=0x1b048180, region=0x1afad4d0) returned 0x0 [0077.947] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b048180, result=0x2e7dc0) returned 0x0 [0077.947] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.947] GdipDeleteRegion (region=0x1afad4d0) returned 0x0 [0077.947] GdipSaveGraphics (graphics=0x1b048180, state=0x2e7e90) returned 0x0 [0077.947] GdipCreateRegion (region=0x2e7d60) returned 0x0 [0077.947] GdipGetClip (graphics=0x1b048180, region=0x1afad4d0) returned 0x0 [0077.947] GdipCreateMatrix (matrix=0x2e7d60) returned 0x0 [0077.947] GdipGetWorldTransform (graphics=0x1b048180, matrix=0x1b869e30) returned 0x0 [0077.947] GdipIsMatrixIdentity (matrix=0x1b869e30, result=0x2e7dc0) returned 0x0 [0077.947] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0 [0077.947] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fe0) returned 0x0 [0077.947] LocalFree (hMem=0x1b579fe0) returned 0x0 [0077.947] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.947] GdipDeleteMatrix (matrix=0x1b869e30) returned 0x0 [0077.947] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b048180, result=0x2e7e10) returned 0x0 [0077.947] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.947] GdipDeleteRegion (region=0x1afad4d0) returned 0x0 [0077.947] GdipGetDC (graphics=0x1b048180, hdc=0x2e7e40) returned 0x0 [0077.947] GetCurrentObject (hdc=0x190107f8, type=0x1) returned 0x1b00017 [0077.948] GetCurrentObject (hdc=0x190107f8, type=0x2) returned 0x1900010 [0077.948] GetCurrentObject (hdc=0x190107f8, type=0x7) returned 0x67050816 [0077.948] GetCurrentObject (hdc=0x190107f8, type=0x6) returned 0x18a002e [0077.948] SaveDC (hdc=0x190107f8) returned 2 [0077.948] OffsetViewportOrgEx (in: hdc=0x190107f8, x=0, y=0, lppt=0x287fea0 | out: lppt=0x287fea0) returned 1 [0077.948] GetNearestColor (hdc=0x190107f8, color=0xf0f0f0) returned 0xf0f0f0 [0077.948] CreateSolidBrush (color=0xf0f0f0) returned 0x1e100720 [0077.948] FillRect (hDC=0x190107f8, lprc=0x2e7e10, hbr=0x1e100720) returned 1 [0077.948] DeleteObject (ho=0x1e100720) returned 1 [0077.948] RestoreDC (hdc=0x190107f8, nSavedDC=-1) returned 1 [0077.948] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.948] GdipReleaseDC (graphics=0x1b048180, hdc=0x190107f8) returned 0x0 [0077.948] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.948] GdipDeleteGraphics (graphics=0x1b048180) returned 0x0 [0077.948] SelectPalette (hdc=0x190107f8, hPal=0x188000b, bForceBkgd=0) returned 0x13080713 [0077.949] GetWindowTextLengthW (hWnd=0x201d6) returned 24 [0077.949] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0077.949] GetSystemMetrics (nIndex=42) returned 0 [0077.949] CoTaskMemAlloc (cb=0x36) returned 0x1b579fe0 [0077.949] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b579fe0, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0077.949] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b579fe0) returned 0x18 [0077.949] CoTaskMemFree (pv=0x1b579fe0) [0077.949] GetClientRect (in: hWnd=0x201d6, lpRect=0x2e81a0 | out: lpRect=0x2e81a0) returned 1 [0077.949] SelectPalette (hdc=0x190107f8, hPal=0x13080713, bForceBkgd=1) returned 0x188000b [0077.949] GdipCreateFromHDC (hdc=0x190107f8, graphics=0x2e7d70) returned 0x0 [0077.949] GdipSetPageUnit (graphics=0x1b048180, unit=0x2) returned 0x0 [0077.949] GdipCreateMatrix (matrix=0x2e7c60) returned 0x0 [0077.949] GdipGetWorldTransform (graphics=0x1b048180, matrix=0x1b869df0) returned 0x0 [0077.949] GdipIsMatrixIdentity (matrix=0x1b869df0, result=0x2e7cc0) returned 0x0 [0077.949] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.949] GdipDeleteMatrix (matrix=0x1b869df0) returned 0x0 [0077.950] GdipCreateRegion (region=0x2e7c60) returned 0x0 [0077.950] GdipGetClip (graphics=0x1b048180, region=0x1afad4d0) returned 0x0 [0077.950] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b048180, result=0x2e7c90) returned 0x0 [0077.950] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.950] GdipDeleteRegion (region=0x1afad4d0) returned 0x0 [0077.950] GdipSaveGraphics (graphics=0x1b048180, state=0x2e7d60) returned 0x0 [0077.950] GdipCreateRegion (region=0x2e7c30) returned 0x0 [0077.950] GdipGetClip (graphics=0x1b048180, region=0x1afad4d0) returned 0x0 [0077.950] GdipCreateMatrix (matrix=0x2e7c30) returned 0x0 [0077.950] GdipGetWorldTransform (graphics=0x1b048180, matrix=0x1b869e30) returned 0x0 [0077.950] GdipIsMatrixIdentity (matrix=0x1b869e30, result=0x2e7c90) returned 0x0 [0077.950] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0 [0077.950] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fe0) returned 0x0 [0077.950] LocalFree (hMem=0x1b579fe0) returned 0x0 [0077.950] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.950] GdipDeleteMatrix (matrix=0x1b869e30) returned 0x0 [0077.950] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b048180, result=0x2e7ce0) returned 0x0 [0077.950] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.950] GdipDeleteRegion (region=0x1afad4d0) returned 0x0 [0077.950] GdipGetDC (graphics=0x1b048180, hdc=0x2e7d10) returned 0x0 [0077.950] GetCurrentObject (hdc=0x190107f8, type=0x1) returned 0x1b00017 [0077.950] GetCurrentObject (hdc=0x190107f8, type=0x2) returned 0x1900010 [0077.950] GetCurrentObject (hdc=0x190107f8, type=0x7) returned 0x67050816 [0077.951] GetCurrentObject (hdc=0x190107f8, type=0x6) returned 0x18a002e [0077.951] SaveDC (hdc=0x190107f8) returned 2 [0077.951] OffsetViewportOrgEx (in: hdc=0x190107f8, x=0, y=0, lppt=0x28803d0 | out: lppt=0x28803d0) returned 1 [0077.951] GetNearestColor (hdc=0x190107f8, color=0xf0f0f0) returned 0xf0f0f0 [0077.951] CreateSolidBrush (color=0xf0f0f0) returned 0x1f100720 [0077.951] FillRect (hDC=0x190107f8, lprc=0x2e7ce0, hbr=0x1f100720) returned 1 [0077.951] DeleteObject (ho=0x1f100720) returned 1 [0077.951] RestoreDC (hdc=0x190107f8, nSavedDC=-1) returned 1 [0077.951] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.951] GdipReleaseDC (graphics=0x1b048180, hdc=0x190107f8) returned 0x0 [0077.951] GdipRestoreGraphics (graphics=0x1b048180, state=0xfffffffffda90dbd) returned 0x0 [0077.951] GetWindowTextLengthW (hWnd=0x201d6) returned 24 [0077.951] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0077.951] GetSystemMetrics (nIndex=42) returned 0 [0077.951] CoTaskMemAlloc (cb=0x36) returned 0x1b579fe0 [0077.951] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b579fe0, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0077.951] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b579fe0) returned 0x18 [0077.951] CoTaskMemFree (pv=0x1b579fe0) [0077.951] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.952] GdipDeleteGraphics (graphics=0x1b048180) returned 0x0 [0077.952] SelectPalette (hdc=0x190107f8, hPal=0x188000b, bForceBkgd=0) returned 0x13080713 [0077.952] RestoreDC (hdc=0x190107f8, nSavedDC=-1) returned 1 [0077.952] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.952] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x190107f8) returned 0x0 [0077.952] IsAppThemed () returned 0x1 [0077.952] GetThemeAppProperties () returned 0x3 [0077.952] GetThemeAppProperties () returned 0x3 [0077.952] IsAppThemed () returned 0x1 [0077.952] GetThemeAppProperties () returned 0x3 [0077.952] GetThemeAppProperties () returned 0x3 [0077.952] IsThemePartDefined () returned 0x1 [0077.952] GdipCreateRegion (region=0x2e89f0) returned 0x0 [0077.952] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0 [0077.952] GdipCreateMatrix (matrix=0x2e89f0) returned 0x0 [0077.952] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869df0) returned 0x0 [0077.952] GdipIsMatrixIdentity (matrix=0x1b869df0, result=0x2e8a50) returned 0x0 [0077.952] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0 [0077.952] GdipGetMatrixElements (matrix=0x1b869df0, matrixOut=0x1b579fe0) returned 0x0 [0077.952] LocalFree (hMem=0x1b579fe0) returned 0x0 [0077.952] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0 [0077.952] GdipGetMatrixElements (matrix=0x1b869df0, matrixOut=0x1b579fe0) returned 0x0 [0077.952] LocalFree (hMem=0x1b579fe0) returned 0x0 [0077.953] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.953] GdipDeleteMatrix (matrix=0x1b869df0) returned 0x0 [0077.953] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e8aa0) returned 0x0 [0077.953] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e8a60) returned 0x0 [0077.953] GdipGetRegionHRgn (region=0x1afad4d0, graphics=0x1b047cc0, hRgn=0x2e8a60) returned 0x0 [0077.953] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.953] GdipDeleteRegion (region=0x1afad4d0) returned 0x0 [0077.953] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e8ad0) returned 0x0 [0077.953] GetCurrentObject (hdc=0x190107f8, type=0x1) returned 0x1b00017 [0077.953] GetCurrentObject (hdc=0x190107f8, type=0x2) returned 0x1900010 [0077.953] GetCurrentObject (hdc=0x190107f8, type=0x7) returned 0x67050816 [0077.953] GetCurrentObject (hdc=0x190107f8, type=0x6) returned 0x18a002e [0077.953] SaveDC (hdc=0x190107f8) returned 1 [0077.954] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1e040725 [0077.954] GetClipRgn (hdc=0x190107f8, hrgn=0x1e040725) returned 0 [0077.954] SelectClipRgn (hdc=0x190107f8, hrgn=0x20040836) returned 2 [0077.954] DeleteObject (ho=0x1e040725) returned 1 [0077.954] DeleteObject (ho=0x20040836) returned 1 [0077.954] OffsetViewportOrgEx (in: hdc=0x190107f8, x=0, y=0, lppt=0x2880aa0 | out: lppt=0x2880aa0) returned 1 [0077.954] IsAppThemed () returned 0x1 [0077.954] GetThemeAppProperties () returned 0x3 [0077.954] GetThemeAppProperties () returned 0x3 [0077.954] DrawThemeBackground () returned 0x0 [0077.954] RestoreDC (hdc=0x190107f8, nSavedDC=-1) returned 1 [0077.954] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.955] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x190107f8) returned 0x0 [0077.955] GdipCreateRegion (region=0x2e89c0) returned 0x0 [0077.955] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0 [0077.955] GdipCreateMatrix (matrix=0x2e89c0) returned 0x0 [0077.955] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869e30) returned 0x0 [0077.955] GdipIsMatrixIdentity (matrix=0x1b869e30, result=0x2e8a20) returned 0x0 [0077.955] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0 [0077.955] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fe0) returned 0x0 [0077.956] LocalFree (hMem=0x1b579fe0) returned 0x0 [0077.956] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0 [0077.956] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fe0) returned 0x0 [0077.956] LocalFree (hMem=0x1b579fe0) returned 0x0 [0077.956] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.956] GdipDeleteMatrix (matrix=0x1b869e30) returned 0x0 [0077.956] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e8a70) returned 0x0 [0077.956] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2e8a30) returned 0x0 [0077.956] GdipGetRegionHRgn (region=0x1afad4d0, graphics=0x1b047cc0, hRgn=0x2e8a30) returned 0x0 [0077.956] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.956] GdipDeleteRegion (region=0x1afad4d0) returned 0x0 [0077.956] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e8aa0) returned 0x0 [0077.956] GetCurrentObject (hdc=0x190107f8, type=0x1) returned 0x1b00017 [0077.956] GetCurrentObject (hdc=0x190107f8, type=0x2) returned 0x1900010 [0077.956] GetCurrentObject (hdc=0x190107f8, type=0x7) returned 0x67050816 [0077.956] GetCurrentObject (hdc=0x190107f8, type=0x6) returned 0x18a002e [0077.956] SaveDC (hdc=0x190107f8) returned 1 [0077.956] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x21040836 [0077.956] GetClipRgn (hdc=0x190107f8, hrgn=0x21040836) returned 0 [0077.956] SelectClipRgn (hdc=0x190107f8, hrgn=0x1f040725) returned 2 [0077.957] DeleteObject (ho=0x21040836) returned 1 [0077.957] DeleteObject (ho=0x1f040725) returned 1 [0077.957] OffsetViewportOrgEx (in: hdc=0x190107f8, x=0, y=0, lppt=0x2880fa0 | out: lppt=0x2880fa0) returned 1 [0077.957] IsAppThemed () returned 0x1 [0077.957] GetThemeAppProperties () returned 0x3 [0077.957] GetThemeAppProperties () returned 0x3 [0077.957] GetThemeBackgroundContentRect () returned 0x0 [0077.957] RestoreDC (hdc=0x190107f8, nSavedDC=-1) returned 1 [0077.957] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.957] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x190107f8) returned 0x0 [0077.957] IsAppThemed () returned 0x1 [0077.957] GetThemeAppProperties () returned 0x3 [0077.957] GetThemeAppProperties () returned 0x3 [0077.958] GdipGetTextRenderingHint (graphics=0x1b047cc0, mode=0x2e8b90) returned 0x0 [0077.958] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e8b70) returned 0x0 [0077.958] GetCurrentObject (hdc=0x190107f8, type=0x1) returned 0x1b00017 [0077.958] GetCurrentObject (hdc=0x190107f8, type=0x2) returned 0x1900010 [0077.958] GetCurrentObject (hdc=0x190107f8, type=0x7) returned 0x67050816 [0077.958] GetCurrentObject (hdc=0x190107f8, type=0x6) returned 0x18a002e [0077.958] SaveDC (hdc=0x190107f8) returned 1 [0077.958] GetTextAlign (hdc=0x190107f8) returned 0x0 [0077.958] GetTextColor (hdc=0x190107f8) returned 0x0 [0077.958] GetCurrentObject (hdc=0x190107f8, type=0x6) returned 0x18a002e [0077.958] GetObjectW (in: h=0x18a002e, c=92, pv=0x2e85e0 | out: pv=0x2e85e0) returned 92 [0077.958] SelectObject (hdc=0x190107f8, h=0xa0a0281) returned 0x18a002e [0077.958] GetBkMode (hdc=0x190107f8) returned 2 [0077.958] SetBkMode (hdc=0x190107f8, mode=1) returned 2 [0077.958] DrawTextExW (in: hdc=0x190107f8, lpchText="&Continue", cchText=9, lprc=0x2e8670, format=0x102415, lpdtp=0x28814f8 | out: lpchText="&Continue", lprc=0x2e8670) returned 13 [0077.959] DrawTextExW (in: hdc=0x190107f8, lpchText="&Continue", cchText=9, lprc=0x2e8720, format=0x102015, lpdtp=0x28814f8 | out: lpchText="&Continue", lprc=0x2e8720) returned 13 [0077.959] RestoreDC (hdc=0x190107f8, nSavedDC=-1) returned 1 [0077.959] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.959] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x190107f8) returned 0x0 [0077.959] GetFocus () returned 0x201c8 [0077.959] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x2e8f00, fWinIni=0x0 | out: pvParam=0x2e8f00) returned 1 [0077.959] SendMessageW (hWnd=0x201d6, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0077.959] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0077.959] IsAppThemed () returned 0x1 [0077.959] GetThemeAppProperties () returned 0x3 [0077.959] GetThemeAppProperties () returned 0x3 [0077.959] GdipGetDC (graphics=0x1b047cc0, hdc=0x2e92e0) returned 0x0 [0077.959] BitBlt (hdc=0x201082d, x=0, y=0, cx=100, cy=23, hdcSrc=0x190107f8, x1=0, y1=0, rop=0xcc0020) returned 1 [0077.959] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.959] GdipReleaseDC (graphics=0x1b047cc0, hdc=0x190107f8) returned 0x0 [0077.959] SelectObject (hdc=0x190107f8, h=0x185000f) returned 0x67050816 [0077.959] DeleteDC (hdc=0x190107f8) returned 1 [0077.959] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0077.960] GdipDeleteGraphics (graphics=0x1b047cc0) returned 0x0 [0077.960] SelectPalette (hdc=0x201082d, hPal=0x188000b, bForceBkgd=0) returned 0x13080713 [0077.960] EndPaint (hWnd=0x201c8, lpPaint=0x2e93e8) returned 1 [0077.961] MapWindowPoints (in: hWndFrom=0x201c8, hWndTo=0x0, lpPoints=0x2881660, cPoints=0x1 | out: lpPoints=0x2881660) returned 31392470 [0077.962] WindowFromPoint (Point=0x1e400000318) returned 0x201c8 [0077.962] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x84, wParam=0x0, lParam=0x1e40318) returned 0x1 [0077.964] NotifyWinEvent (event=0x800a, hwnd=0x201c8, idObject=-4, idChild=0) [0077.964] NotifyWinEvent (event=0x800c, hwnd=0x201c8, idObject=-4, idChild=0) [0077.964] GetCapture () returned 0x201c8 [0077.965] ReleaseCapture () returned 1 [0077.966] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0077.966] PeekMessageW (in: lpMsg=0x2ea8e0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ea8e0) returned 1 [0077.966] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x84, wParam=0x0, lParam=0x1e40318) returned 0x1 [0077.970] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-8) returned 0x0 [0077.970] IsWindow (hWnd=0x0) returned 0 [0077.970] IsWindow (hWnd=0x0) returned 0 [0077.970] IsWindow (hWnd=0x0) returned 0 [0077.971] GetFocus () returned 0x201c8 [0077.971] IsChild (hWndParent=0x201d6, hWnd=0x201c8) returned 1 [0077.971] ShowWindow (hWnd=0x201d6, nCmdShow=0) returned 1 [0077.971] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0077.971] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x46, wParam=0x0, lParam=0x2eaa50) returned 0x0 [0077.972] GetWindowPlacement (in: hWnd=0x201d6, lpwndpl=0x2ea4b0 | out: lpwndpl=0x2ea4b0) returned 1 [0077.972] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x47, wParam=0x0, lParam=0x2eaa50) returned 0x0 [0077.972] GetClientRect (in: hWnd=0x201d6, lpRect=0x2ea250 | out: lpRect=0x2ea250) returned 1 [0077.972] GetWindowRect (in: hWnd=0x201d6, lpRect=0x2ea250 | out: lpRect=0x2ea250) returned 1 [0077.973] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0077.973] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0077.973] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0077.974] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0077.974] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0077.974] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0077.974] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0077.975] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x1c, wParam=0x0, lParam=0x80c) returned 0x0 [0077.975] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x1c, wParam=0x0, lParam=0x80c) returned 0x0 [0077.975] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x1c, wParam=0x0, lParam=0x80c) returned 0x0 [0077.975] GetFocus () returned 0x0 [0077.975] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0077.975] GetCapture () returned 0x0 [0077.975] InvalidateRect (hWnd=0x201c8, lpRect=0x0, bErase=0) returned 1 [0077.975] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0077.975] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0077.977] GetWindowLongPtrW (hWnd=0x201d6, nIndex=-20) returned 0x50109 [0077.977] DestroyWindow (hWnd=0x201d6) returned 1 [0077.977] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0077.978] GetWindowTextLengthW (hWnd=0x201d6) returned 24 [0077.978] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0077.978] GetSystemMetrics (nIndex=42) returned 0 [0077.978] CoTaskMemAlloc (cb=0x36) returned 0x1b579fe0 [0077.978] GetWindowTextW (in: hWnd=0x201d6, lpString=0x1b579fe0, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0077.978] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0xd, wParam=0x19, lParam=0x1b579fe0) returned 0x18 [0077.978] CoTaskMemFree (pv=0x1b579fe0) [0077.978] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0077.979] GetWindowTextLengthW (hWnd=0x201cc) returned 0 [0077.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0077.979] GetSystemMetrics (nIndex=42) returned 0 [0077.979] CoTaskMemAlloc (cb=0x6) returned 0x1b57ec50 [0077.979] GetWindowTextW (in: hWnd=0x201cc, lpString=0x1b57ec50, nMaxCount=1 | out: lpString="") returned 0 [0077.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0xd, wParam=0x1, lParam=0x1b57ec50) returned 0x0 [0077.979] CoTaskMemFree (pv=0x1b57ec50) [0077.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0077.979] GetWindowThreadProcessId (in: hWnd=0x201d8, lpdwProcessId=0x2ea100 | out: lpdwProcessId=0x2ea100) returned 0x968 [0077.979] GetWindow (hWnd=0x201d8, uCmd=0x5) returned 0x0 [0077.979] GetWindowLongPtrW (hWnd=0x201d8, nIndex=-20) returned 0x10100 [0077.979] DestroyWindow (hWnd=0x201d8) returned 1 [0077.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0077.979] GetWindowTextLengthW (hWnd=0x201d8) returned 25 [0077.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x19 [0077.979] GetSystemMetrics (nIndex=42) returned 0 [0077.979] CoTaskMemAlloc (cb=0x38) returned 0x1b579fe0 [0077.979] GetWindowTextW (in: hWnd=0x201d8, lpString=0x1b579fe0, nMaxCount=26 | out: lpString="WindowsFormsParkingWindow") returned 25 [0077.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0xd, wParam=0x1a, lParam=0x1b579fe0) returned 0x19 [0077.979] CoTaskMemFree (pv=0x1b579fe0) [0077.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0077.979] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d8, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0077.981] GetWindowTextLengthW (hWnd=0x201da) returned 283 [0077.981] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11b [0077.981] GetSystemMetrics (nIndex=42) returned 0 [0077.981] CoTaskMemAlloc (cb=0x23c) returned 0x1b5abbb0 [0077.981] GetWindowTextW (in: hWnd=0x201da, lpString=0x1b5abbb0, nMaxCount=284 | out: lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nCould not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.") returned 283 [0077.981] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0xd, wParam=0x11c, lParam=0x1b5abbb0) returned 0x11b [0077.981] CoTaskMemFree (pv=0x1b5abbb0) [0077.981] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0077.981] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0077.982] InvalidateRect (hWnd=0x201c8, lpRect=0x0, bErase=0) returned 1 [0077.982] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0077.982] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0077.982] SendMessageW (hWnd=0x201e2, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0 [0077.982] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0 [0077.983] SendMessageW (hWnd=0x201e2, Msg=0xb0, wParam=0x2ea2c4, lParam=0x2ea2c0) returned 0x0 [0077.983] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0xb0, wParam=0x2ea2c4, lParam=0x2ea2c0) returned 0x0 [0077.983] GetWindowTextLengthW (hWnd=0x201e2) returned 4373 [0077.983] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x1115 [0077.983] GetSystemMetrics (nIndex=42) returned 0 [0077.983] CoTaskMemAlloc (cb=0x2230) returned 0x1b5ad990 [0077.983] GetWindowTextW (in: hWnd=0x201e2, lpString=0x1b5ad990, nMaxCount=4374 | out: lpString="See the end of this message for details on invoking \r\njust-in-time (JIT) debugging instead of this dialog box.\r\n\r\n************** Exception Text **************\r\nSystem.IO.DirectoryNotFoundException: Could not find a part of the path 'C:\\Users\\cerberos\\Desktop\\INSTRUCTIONS.html'.\r\n at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)\r\n at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy)\r\n at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy)\r\n at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)\r\n at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding, Int32 bufferSize)\r\n at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding)\r\n at System.IO.File.WriteAllText(String path, String contents, Encoding encoding)\r\n at get.ranran.html()\r\n at get.ranran.Form1_Load(Object sender, EventArgs e)\r\n at System.EventHandler.Invoke(Object sender, EventArgs e)\r\n at System.Windows.Forms.Form.OnLoad(EventArgs e)\r\n at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)\r\n at System.Windows.Forms.Control.CreateControl()\r\n at System.Windows.Forms.Control.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Control.WndProc(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)\r\n at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)\r\n\r\n\r\n************** Loaded Assemblies **************\r\nmscorlib\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/Microsoft.NET/Framework64/v2.0.50727/mscorlib.dll\r\n----------------------------------------\r\nget\r\n Assembly Version: 1.0.0.0\r\n Win32 Version: 1.0.0.0\r\n CodeBase: file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/KryptoTrojaner.exe\r\n----------------------------------------\r\nMicrosoft.VisualBasic\r\n Assembly Version: 8.0.0.0\r\n Win32 Version: 8.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/Microsoft.VisualBasic/8.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualBasic.dll\r\n----------------------------------------\r\nSystem\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll\r\n----------------------------------------\r\nSystem.Windows.Forms\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll\r\n----------------------------------------\r\nSystem.Drawing\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll\r\n----------------------------------------\r\nSystem.Runtime.Remoting\r\n Assembly Version: 2.0.0.0\r\n Win32 Version: 2.0.50727.5420 (Win7SP1.050727-5400)\r\n CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Runtime.Remoting/2.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll\r\n----------------------------------------\r\n9ee08ca6-3f27-4b57-b8d0-4985d08ba511\r\n Assembly Version: 1.0.0.0\r\n Win32 Version: 1.0.0.0\r\n CodeBase: file:///C:/Users/5p5NrGJn0jS%20HALPmcxz/Desktop/KryptoTrojaner.exe\r\n----------------------------------------\r\n\r\n************** JIT Debugging **************\r\nTo enable just-in-time (JIT) debugging, the .config file for this\r\napplication or computer (machine.config) must have the\r\njitDebugging value set in the system.windows.forms section.\r\nThe application must also be compiled with debugging\r\nenabled.\r\n\r\nFor example:\r\n\r\n\r\n \r\n\r\n\r\nWhen JIT debugging is enabled, any unhandled exception\r\nwill be sent to the JIT debugger registered on the computer\r\nrather than be handled by this dialog box.\r\n\r\n\r\n") returned 4373 [0077.983] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0xd, wParam=0x1116, lParam=0x1b5ad990) returned 0x1115 [0077.983] CoTaskMemFree (pv=0x1b5ad990) [0077.983] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x1 [0077.983] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201cc, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0077.984] CallWindowProcW (lpPrevWndFunc=0x7fefc7161b4, hWnd=0x201da, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0077.984] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ce, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0077.985] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201c8, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0077.985] CallWindowProcW (lpPrevWndFunc=0x7fefc713b20, hWnd=0x201ca, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0077.985] CallWindowProcW (lpPrevWndFunc=0x7fefc71975c, hWnd=0x201e2, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0077.986] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x201d6, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0077.990] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x46, wParam=0x0, lParam=0x2ee1f0) returned 0x0 [0077.993] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x46, wParam=0x0, lParam=0x2ee1f0) returned 0x0 [0077.993] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x1c, wParam=0x1, lParam=0x80c) returned 0x0 [0077.993] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x1c, wParam=0x1, lParam=0x80c) returned 0x0 [0077.993] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0077.994] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0077.994] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0077.994] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0077.994] GetParent (hWnd=0x301b8) returned 0x0 [0077.994] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0077.994] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0078.011] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0078.011] GetWindowPlacement (in: hWnd=0x301b8, lpwndpl=0x2edc70 | out: lpwndpl=0x2edc70) returned 1 [0078.011] GetClientRect (in: hWnd=0x301b8, lpRect=0x2edb20 | out: lpRect=0x2edb20) returned 1 [0078.011] GetWindowTextLengthW (hWnd=0x301b8) returned 0 [0078.011] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0078.011] GetSystemMetrics (nIndex=42) returned 0 [0078.011] CoTaskMemAlloc (cb=0x6) returned 0x1b57ec50 [0078.011] GetWindowTextW (in: hWnd=0x301b8, lpString=0x1b57ec50, nMaxCount=1 | out: lpString="") returned 0 [0078.011] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xd, wParam=0x1, lParam=0x1b57ec50) returned 0x0 [0078.011] CoTaskMemFree (pv=0x1b57ec50) [0078.011] GetClientRect (in: hWnd=0x301b8, lpRect=0x2ed8c0 | out: lpRect=0x2ed8c0) returned 1 [0078.011] SelectPalette (hdc=0xb010833, hPal=0x13080713, bForceBkgd=1) returned 0x188000b [0078.011] GdipCreateFromHDC (hdc=0xb010833, graphics=0x2ed490) returned 0x0 [0078.012] GdipSetPageUnit (graphics=0x1b047cc0, unit=0x2) returned 0x0 [0078.012] GdipCreateMatrix (matrix=0x2ed380) returned 0x0 [0078.012] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869df0) returned 0x0 [0078.012] GdipIsMatrixIdentity (matrix=0x1b869df0, result=0x2ed3e0) returned 0x0 [0078.012] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0078.012] GdipDeleteMatrix (matrix=0x1b869df0) returned 0x0 [0078.012] GdipCreateRegion (region=0x2ed380) returned 0x0 [0078.012] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0 [0078.012] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2ed3b0) returned 0x0 [0078.012] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0078.012] GdipDeleteRegion (region=0x1afad4d0) returned 0x0 [0078.012] GdipSaveGraphics (graphics=0x1b047cc0, state=0x2ed480) returned 0x0 [0078.012] GdipCreateRegion (region=0x2ed350) returned 0x0 [0078.012] GdipGetClip (graphics=0x1b047cc0, region=0x1afad4d0) returned 0x0 [0078.012] GdipCreateMatrix (matrix=0x2ed350) returned 0x0 [0078.012] GdipGetWorldTransform (graphics=0x1b047cc0, matrix=0x1b869e30) returned 0x0 [0078.012] GdipIsMatrixIdentity (matrix=0x1b869e30, result=0x2ed3b0) returned 0x0 [0078.012] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x1b579fe0 [0078.012] GdipGetMatrixElements (matrix=0x1b869e30, matrixOut=0x1b579fe0) returned 0x0 [0078.012] LocalFree (hMem=0x1b579fe0) returned 0x0 [0078.012] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0078.013] GdipDeleteMatrix (matrix=0x1b869e30) returned 0x0 [0078.013] GdipIsInfiniteRegion (region=0x1afad4d0, graphics=0x1b047cc0, result=0x2ed400) returned 0x0 [0078.013] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0078.013] GdipDeleteRegion (region=0x1afad4d0) returned 0x0 [0078.013] GdipGetDC (graphics=0x1b047cc0, hdc=0x2ed430) returned 0x0 [0078.013] GetCurrentObject (hdc=0xb010833, type=0x1) returned 0x1b00017 [0078.013] GetCurrentObject (hdc=0xb010833, type=0x2) returned 0x1900010 [0078.013] GetCurrentObject (hdc=0xb010833, type=0x7) returned 0x1050032 [0078.013] GetCurrentObject (hdc=0xb010833, type=0x6) returned 0x18a002e [0078.013] SaveDC (hdc=0xb010833) returned 1 [0078.013] OffsetViewportOrgEx (in: hdc=0xb010833, x=0, y=0, lppt=0x2885220 | out: lppt=0x2885220) returned 1 [0078.013] GetNearestColor (hdc=0xb010833, color=0xf0f0f0) returned 0xf0f0f0 [0078.013] CreateSolidBrush (color=0xf0f0f0) returned 0x20100720 [0078.013] FillRect (hDC=0xb010833, lprc=0x2ed400, hbr=0x20100720) returned 1 [0078.013] DeleteObject (ho=0x20100720) returned 1 [0078.013] RestoreDC (hdc=0xb010833, nSavedDC=-1) returned 1 [0078.013] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0078.014] GdipReleaseDC (graphics=0x1b047cc0, hdc=0xb010833) returned 0x0 [0078.014] FindAtomW (lpString="GDI+Atom_2404_1") returned 0xc000 [0078.014] GdipDeleteGraphics (graphics=0x1b047cc0) returned 0x0 [0078.014] SelectPalette (hdc=0xb010833, hPal=0x188000b, bForceBkgd=0) returned 0x13080713 [0078.014] GetWindowPlacement (in: hWnd=0x301b8, lpwndpl=0x2edc50 | out: lpwndpl=0x2edc50) returned 1 [0078.014] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x47, wParam=0x0, lParam=0x2ee1f0) returned 0x0 [0078.014] GetClientRect (in: hWnd=0x301b8, lpRect=0x2ed9f0 | out: lpRect=0x2ed9f0) returned 1 [0078.014] GetWindowRect (in: hWnd=0x301b8, lpRect=0x2ed9f0 | out: lpRect=0x2ed9f0) returned 1 [0078.014] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x5, wParam=0x0, lParam=0x260084) returned 0x0 [0078.014] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x3, wParam=0x0, lParam=0xc800c8) returned 0x0 [0078.014] GetClientRect (in: hWnd=0x301b8, lpRect=0x2edac0 | out: lpRect=0x2edac0) returned 1 [0078.014] GetWindowRect (in: hWnd=0x301b8, lpRect=0x2edac0 | out: lpRect=0x2edac0) returned 1 [0078.014] GetWindowTextLengthW (hWnd=0x301b8) returned 0 [0078.014] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0078.014] GetSystemMetrics (nIndex=42) returned 0 [0078.014] CoTaskMemAlloc (cb=0x6) returned 0x1b57ec50 [0078.014] GetWindowTextW (in: hWnd=0x301b8, lpString=0x1b57ec50, nMaxCount=1 | out: lpString="") returned 0 [0078.014] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xd, wParam=0x1, lParam=0x1b57ec50) returned 0x0 [0078.015] CoTaskMemFree (pv=0x1b57ec50) [0078.015] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 1 [0078.015] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x110189 [0078.015] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x601a1 [0078.015] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x601a1 [0078.015] IsWindowUnicode (hWnd=0x301b8) returned 1 [0078.015] GetMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ee230) returned 1 [0078.015] TranslateMessage (lpMsg=0x2ee240) returned 0 [0078.015] DispatchMessageW (lpMsg=0x2ee240) returned 0x0 [0078.015] BeginPaint (in: hWnd=0x301b8, lpPaint=0x2ed618 | out: lpPaint=0x2ed618) returned 0xb010833 [0078.015] SelectPalette (hdc=0xb010833, hPal=0x13080713, bForceBkgd=1) returned 0x188000b [0078.015] GetWindowTextLengthW (hWnd=0x301b8) returned 0 [0078.015] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0078.015] GetSystemMetrics (nIndex=42) returned 0 [0078.015] CoTaskMemAlloc (cb=0x6) returned 0x1b57ec50 [0078.015] GetWindowTextW (in: hWnd=0x301b8, lpString=0x1b57ec50, nMaxCount=1 | out: lpString="") returned 0 [0078.015] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0xd, wParam=0x1, lParam=0x1b57ec50) returned 0x0 [0078.015] CoTaskMemFree (pv=0x1b57ec50) [0078.016] EndPaint (hWnd=0x301b8, lpPaint=0x2ed628) returned 1 [0078.016] SelectPalette (hdc=0xb010833, hPal=0x188000b, bForceBkgd=0) returned 0x0 [0078.016] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0 [0078.016] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0 [0078.016] WaitMessage () returned 1 [0078.116] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 1 [0078.116] IsWindowUnicode (hWnd=0x201d0) returned 1 [0078.116] GetMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ee230) returned 1 [0078.116] TranslateMessage (lpMsg=0x2ee240) returned 0 [0078.116] DispatchMessageW (lpMsg=0x2ee240) returned 0x0 [0078.117] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0 [0078.117] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0 [0078.117] WaitMessage () returned 1 [0078.304] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 1 [0078.304] IsWindowUnicode (hWnd=0x201d2) returned 1 [0078.304] GetMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ee230) returned 1 [0078.304] TranslateMessage (lpMsg=0x2ee240) returned 0 [0078.304] DispatchMessageW (lpMsg=0x2ee240) returned 0x0 [0078.304] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0 [0078.304] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0 [0078.304] WaitMessage () returned 1 [0105.445] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0 [0105.446] CallWindowProcW (lpPrevWndFunc=0x77c7b0ac, hWnd=0x301b8, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0105.446] NtdllDefWindowProc_W (hWnd=0x301ae, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0105.446] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0 [0105.446] WaitMessage () Thread: id = 2 os_tid = 0x974 Thread: id = 3 os_tid = 0x978 [0042.791] CoGetContextToken (in: pToken=0x1af4f590 | out: pToken=0x1af4f590) returned 0x800401f0 [0042.791] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 4 os_tid = 0x97c Thread: id = 5 os_tid = 0xa34 Thread: id = 6 os_tid = 0xa38 Thread: id = 7 os_tid = 0xa3c Thread: id = 8 os_tid = 0xa40 Thread: id = 11 os_tid = 0xa54 Process: id = "2" image_name = "templanran.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\templanran.exe" page_root = "0x32e21000" os_pid = "0xa44" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x964" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:000104d7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 365 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 366 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 367 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 368 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 369 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 370 start_va = 0x190000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 371 start_va = 0x1e0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 372 start_va = 0x3a0000 end_va = 0x3adfff entry_point = 0x3a0000 region_type = mapped_file name = "templanran.exe" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\templanran.exe") Region: id = 373 start_va = 0x77c50000 end_va = 0x77df8fff entry_point = 0x77c50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 374 start_va = 0x77e30000 end_va = 0x77faffff entry_point = 0x77e30000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 375 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 376 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 377 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 378 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 379 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 380 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 381 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 382 start_va = 0x80000 end_va = 0xfffff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 383 start_va = 0x75360000 end_va = 0x75367fff entry_point = 0x75360000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 384 start_va = 0x75370000 end_va = 0x753cbfff entry_point = 0x75370000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 385 start_va = 0x753d0000 end_va = 0x7540efff entry_point = 0x753d0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 386 start_va = 0x3c0000 end_va = 0x4bffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 387 start_va = 0x75760000 end_va = 0x757a9fff entry_point = 0x75760000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 388 start_va = 0x75bb0000 end_va = 0x75bf5fff entry_point = 0x75bb0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 389 start_va = 0x75fd0000 end_va = 0x760dffff entry_point = 0x75fd0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 390 start_va = 0x77a30000 end_va = 0x77b4efff entry_point = 0x0 region_type = private name = "private_0x0000000077a30000" filename = "" Region: id = 391 start_va = 0x77b50000 end_va = 0x77c49fff entry_point = 0x0 region_type = private name = "private_0x0000000077b50000" filename = "" Region: id = 424 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 425 start_va = 0x100000 end_va = 0x166fff entry_point = 0x100000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 426 start_va = 0x300000 end_va = 0x33ffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 427 start_va = 0x590000 end_va = 0x59ffff entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 428 start_va = 0x75980000 end_va = 0x7598bfff entry_point = 0x75980000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 429 start_va = 0x75990000 end_va = 0x759effff entry_point = 0x75990000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 430 start_va = 0x75a30000 end_va = 0x75a48fff entry_point = 0x75a30000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 431 start_va = 0x760e0000 end_va = 0x7617ffff entry_point = 0x760e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 432 start_va = 0x76670000 end_va = 0x7671bfff entry_point = 0x76670000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 433 start_va = 0x775d0000 end_va = 0x776bffff entry_point = 0x775d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 434 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 435 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 446 start_va = 0x370000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 447 start_va = 0x756e0000 end_va = 0x75757fff entry_point = 0x756e0000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 448 start_va = 0x76180000 end_va = 0x761d6fff entry_point = 0x76180000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 449 start_va = 0x763c0000 end_va = 0x763c9fff entry_point = 0x763c0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 450 start_va = 0x763e0000 end_va = 0x764dffff entry_point = 0x763e0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 451 start_va = 0x77820000 end_va = 0x778affff entry_point = 0x77820000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 452 start_va = 0x77990000 end_va = 0x77a2cfff entry_point = 0x77990000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 461 start_va = 0x5a0000 end_va = 0x727fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 462 start_va = 0x76720000 end_va = 0x767ebfff entry_point = 0x76720000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 463 start_va = 0x77570000 end_va = 0x775cffff entry_point = 0x77570000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 469 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 470 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 471 start_va = 0x730000 end_va = 0x8b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 472 start_va = 0x8c0000 end_va = 0x1cbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 473 start_va = 0x756d0000 end_va = 0x756d8fff entry_point = 0x756d0000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 535 start_va = 0x70000 end_va = 0x70fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 536 start_va = 0x1e10000 end_va = 0x1e4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 537 start_va = 0x74d00000 end_va = 0x752aafff entry_point = 0x74d00000 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll") Region: id = 538 start_va = 0x75630000 end_va = 0x756cafff entry_point = 0x75630000 region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll") Region: id = 552 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 553 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 554 start_va = 0x1d0000 end_va = 0x1dffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 555 start_va = 0x2e0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 556 start_va = 0x2f0000 end_va = 0x2fffff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 557 start_va = 0x340000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 558 start_va = 0x350000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 559 start_va = 0x360000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 560 start_va = 0x540000 end_va = 0x54ffff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 561 start_va = 0x1da0000 end_va = 0x1ddffff entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 562 start_va = 0x1f50000 end_va = 0x204ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f50000" filename = "" Region: id = 563 start_va = 0x76920000 end_va = 0x77569fff entry_point = 0x76920000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 564 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 565 start_va = 0x380000 end_va = 0x380fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 566 start_va = 0x776c0000 end_va = 0x7781bfff entry_point = 0x776c0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 571 start_va = 0x2050000 end_va = 0x231efff entry_point = 0x2050000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 572 start_va = 0x75620000 end_va = 0x7562afff entry_point = 0x75620000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 575 start_va = 0x1cc0000 end_va = 0x1d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001cc0000" filename = "" Region: id = 576 start_va = 0x2320000 end_va = 0x431ffff entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 577 start_va = 0x4320000 end_va = 0x435ffff entry_point = 0x0 region_type = private name = "private_0x0000000004320000" filename = "" Region: id = 578 start_va = 0x44d0000 end_va = 0x45cffff entry_point = 0x0 region_type = private name = "private_0x00000000044d0000" filename = "" Region: id = 579 start_va = 0x73870000 end_va = 0x74367fff entry_point = 0x73870000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll") Region: id = 580 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 588 start_va = 0x752d0000 end_va = 0x7534ffff entry_point = 0x752d0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 589 start_va = 0x1e50000 end_va = 0x1f3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e50000" filename = "" Region: id = 591 start_va = 0x4360000 end_va = 0x443efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004360000" filename = "" Region: id = 593 start_va = 0x390000 end_va = 0x392fff entry_point = 0x390000 region_type = mapped_file name = "l_intl.nls" filename = "\\Windows\\SysWOW64\\l_intl.nls" (normalized: "c:\\windows\\syswow64\\l_intl.nls") Region: id = 594 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 595 start_va = 0x755c0000 end_va = 0x7561afff entry_point = 0x755c0000 region_type = mapped_file name = "mscorjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll") Region: id = 596 start_va = 0x4c0000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 597 start_va = 0x4d0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 601 start_va = 0x4620000 end_va = 0x465ffff entry_point = 0x0 region_type = private name = "private_0x0000000004620000" filename = "" Region: id = 602 start_va = 0x46e0000 end_va = 0x47dffff entry_point = 0x0 region_type = private name = "private_0x00000000046e0000" filename = "" Region: id = 603 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 604 start_va = 0x4490000 end_va = 0x44cffff entry_point = 0x0 region_type = private name = "private_0x0000000004490000" filename = "" Region: id = 605 start_va = 0x48c0000 end_va = 0x49bffff entry_point = 0x0 region_type = private name = "private_0x00000000048c0000" filename = "" Region: id = 606 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 607 start_va = 0x4e0000 end_va = 0x51ffff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 608 start_va = 0x4a00000 end_va = 0x4afffff entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 609 start_va = 0x74ce0000 end_va = 0x74cf5fff entry_point = 0x74ce0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 610 start_va = 0x7efa7000 end_va = 0x7efa9fff entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 611 start_va = 0x550000 end_va = 0x58bfff entry_point = 0x550000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 612 start_va = 0x550000 end_va = 0x58bfff entry_point = 0x550000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 613 start_va = 0x550000 end_va = 0x58bfff entry_point = 0x550000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 614 start_va = 0x550000 end_va = 0x58bfff entry_point = 0x550000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 615 start_va = 0x550000 end_va = 0x58bfff entry_point = 0x550000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 616 start_va = 0x74ca0000 end_va = 0x74cdafff entry_point = 0x74ca0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 617 start_va = 0x75410000 end_va = 0x7541dfff entry_point = 0x75410000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 618 start_va = 0x730d0000 end_va = 0x7386bfff entry_point = 0x730d0000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\9e0a3b9b9f457233a335d7fba8f95419\\system.ni.dll") Region: id = 619 start_va = 0x75420000 end_va = 0x755bafff entry_point = 0x75420000 region_type = mapped_file name = "microsoft.visualbasic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualBas#\\08d608378aa405adc844f3cf36974b8c\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualbas#\\08d608378aa405adc844f3cf36974b8c\\microsoft.visualbasic.ni.dll") Thread: id = 9 os_tid = 0xa48 [0071.465] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0072.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe", nBufferLength=0x105, lpBuffer=0x2de620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe", lpFilePart=0x0) returned 0x3a [0072.021] GetLastError () returned 0x2 [0072.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe", nBufferLength=0x105, lpBuffer=0x2de5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\TempLanRan.exe", lpFilePart=0x0) returned 0x3a [0072.071] GetLastError () returned 0x2 [0072.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x2de584, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c [0072.075] GetLastError () returned 0x2 [0072.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x2de620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c [0072.089] GetLastError () returned 0x2 [0072.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x2de5bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c [0072.089] GetLastError () returned 0x2 [0072.138] GetVersionExW (in: lpVersionInformation=0x400c88*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x400c88*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.138] GetLastError () returned 0x2 [0072.139] GetVersionExW (in: lpVersionInformation=0x400c88*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x400c88*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.139] GetLastError () returned 0x2 [0073.051] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3dc024*=0x88, lpdwindex=0x2ded90) Thread: id = 14 os_tid = 0xa90 Thread: id = 16 os_tid = 0xa98 [0071.810] CoGetContextToken (in: pToken=0x45cf788 | out: pToken=0x45cf788) returned 0x800401f0 [0071.811] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 17 os_tid = 0xa9c [0073.047] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0075.384] GetLogicalDrives () returned 0x4 [0075.384] GetLastError () returned 0x0 [0075.417] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0075.417] GetLastError () returned 0x0 [0075.445] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0075.445] GetLastError () returned 0x0 [0075.445] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0075.445] GetLastError () returned 0x0 [0075.445] GetVersionExW (in: lpVersionInformation=0x4212c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x4212c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0075.445] GetLastError () returned 0x0 [0075.446] SetErrorMode (uMode=0x1) returned 0x0 [0075.448] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0075.448] GetLastError () returned 0x0 [0075.448] SetErrorMode (uMode=0x0) returned 0x1 [0081.990] GetLogicalDrives () returned 0x4 [0081.990] GetLastError () returned 0x0 [0081.990] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0081.990] GetLastError () returned 0x0 [0081.990] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0081.990] GetLastError () returned 0x0 [0081.991] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0081.991] GetLastError () returned 0x0 [0081.991] SetErrorMode (uMode=0x1) returned 0x0 [0081.991] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0081.991] GetLastError () returned 0x0 [0081.991] SetErrorMode (uMode=0x0) returned 0x1 [0087.211] GetLogicalDrives () returned 0x4 [0087.211] GetLastError () returned 0x0 [0087.211] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0087.211] GetLastError () returned 0x0 [0087.211] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0087.211] GetLastError () returned 0x0 [0087.211] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0087.211] GetLastError () returned 0x0 [0087.211] SetErrorMode (uMode=0x1) returned 0x0 [0087.211] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0087.212] GetLastError () returned 0x0 [0087.212] SetErrorMode (uMode=0x0) returned 0x1 [0092.218] GetLogicalDrives () returned 0x4 [0092.218] GetLastError () returned 0x0 [0092.218] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0092.219] GetLastError () returned 0x0 [0092.219] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0092.219] GetLastError () returned 0x0 [0092.219] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0092.219] GetLastError () returned 0x0 [0092.219] SetErrorMode (uMode=0x1) returned 0x0 [0092.219] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0092.219] GetLastError () returned 0x0 [0092.219] SetErrorMode (uMode=0x0) returned 0x1 [0100.236] GetLogicalDrives () returned 0x4 [0100.236] GetLastError () returned 0x0 [0100.236] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0100.236] GetLastError () returned 0x0 [0100.236] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0100.236] GetLastError () returned 0x0 [0100.236] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0100.236] GetLastError () returned 0x0 [0100.236] SetErrorMode (uMode=0x1) returned 0x0 [0100.236] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0100.245] GetLastError () returned 0x0 [0100.245] SetErrorMode (uMode=0x0) returned 0x1 [0105.411] GetLogicalDrives () returned 0x4 [0105.411] GetLastError () returned 0x0 [0105.411] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0105.411] GetLastError () returned 0x0 [0105.412] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0105.412] GetLastError () returned 0x0 [0105.412] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0105.412] GetLastError () returned 0x0 [0105.412] SetErrorMode (uMode=0x1) returned 0x0 [0105.412] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0105.412] GetLastError () returned 0x0 [0105.412] SetErrorMode (uMode=0x0) returned 0x1 [0110.438] GetLogicalDrives () returned 0x4 [0110.439] GetLastError () returned 0x0 [0110.439] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0110.439] GetLastError () returned 0x0 [0110.439] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0110.439] GetLastError () returned 0x0 [0110.439] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0110.439] GetLastError () returned 0x0 [0110.439] SetErrorMode (uMode=0x1) returned 0x0 [0110.439] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0110.439] GetLastError () returned 0x0 [0110.439] SetErrorMode (uMode=0x0) returned 0x1 [0115.449] GetLogicalDrives () returned 0x4 [0115.449] GetLastError () returned 0x0 [0115.450] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0115.450] GetLastError () returned 0x0 [0115.450] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0115.450] GetLastError () returned 0x0 [0115.450] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0115.450] GetLastError () returned 0x0 [0115.450] SetErrorMode (uMode=0x1) returned 0x0 [0115.450] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0115.450] GetLastError () returned 0x0 [0115.450] SetErrorMode (uMode=0x0) returned 0x1 [0120.460] GetLogicalDrives () returned 0x4 [0120.460] GetLastError () returned 0x0 [0120.460] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0120.460] GetLastError () returned 0x0 [0120.460] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0120.460] GetLastError () returned 0x0 [0120.460] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0120.460] GetLastError () returned 0x0 [0120.460] SetErrorMode (uMode=0x1) returned 0x0 [0120.460] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0120.460] GetLastError () returned 0x0 [0120.460] SetErrorMode (uMode=0x0) returned 0x1 [0125.459] GetLogicalDrives () returned 0x4 [0125.460] GetLastError () returned 0x0 [0125.460] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0125.460] GetLastError () returned 0x0 [0125.460] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0125.460] GetLastError () returned 0x0 [0125.460] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0125.460] GetLastError () returned 0x0 [0125.460] SetErrorMode (uMode=0x1) returned 0x0 [0125.460] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0125.460] GetLastError () returned 0x0 [0125.460] SetErrorMode (uMode=0x0) returned 0x1 [0130.469] GetLogicalDrives () returned 0x4 [0130.469] GetLastError () returned 0x0 [0130.469] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0130.469] GetLastError () returned 0x0 [0130.469] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0130.469] GetLastError () returned 0x0 [0130.469] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0130.469] GetLastError () returned 0x0 [0130.469] SetErrorMode (uMode=0x1) returned 0x0 [0130.469] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0130.469] GetLastError () returned 0x0 [0130.469] SetErrorMode (uMode=0x0) returned 0x1 [0135.476] GetLogicalDrives () returned 0x4 [0135.476] GetLastError () returned 0x0 [0135.476] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0135.476] GetLastError () returned 0x0 [0135.476] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0135.476] GetLastError () returned 0x0 [0135.476] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0135.477] GetLastError () returned 0x0 [0135.477] SetErrorMode (uMode=0x1) returned 0x0 [0135.477] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0135.477] GetLastError () returned 0x0 [0135.477] SetErrorMode (uMode=0x0) returned 0x1 [0140.484] GetLogicalDrives () returned 0x4 [0140.484] GetLastError () returned 0x0 [0140.484] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0140.484] GetLastError () returned 0x0 [0140.484] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0140.484] GetLastError () returned 0x0 [0140.484] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0140.484] GetLastError () returned 0x0 [0140.484] SetErrorMode (uMode=0x1) returned 0x0 [0140.484] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0140.484] GetLastError () returned 0x0 [0140.484] SetErrorMode (uMode=0x0) returned 0x1 [0145.491] GetLogicalDrives () returned 0x4 [0145.491] GetLastError () returned 0x0 [0145.492] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0145.492] GetLastError () returned 0x0 [0145.492] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0145.492] GetLastError () returned 0x0 [0145.492] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0145.492] GetLastError () returned 0x0 [0145.492] SetErrorMode (uMode=0x1) returned 0x0 [0145.492] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0145.492] GetLastError () returned 0x0 [0145.492] SetErrorMode (uMode=0x0) returned 0x1 [0150.499] GetLogicalDrives () returned 0x4 [0150.499] GetLastError () returned 0x0 [0150.499] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0150.500] GetLastError () returned 0x0 [0150.500] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0150.500] GetLastError () returned 0x0 [0150.500] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0150.500] GetLastError () returned 0x0 [0150.500] SetErrorMode (uMode=0x1) returned 0x0 [0150.500] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0150.500] GetLastError () returned 0x0 [0150.500] SetErrorMode (uMode=0x0) returned 0x1 [0155.507] GetLogicalDrives () returned 0x4 [0155.507] GetLastError () returned 0x0 [0155.507] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x47deb6c, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0155.507] GetLastError () returned 0x0 [0155.507] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0155.507] GetLastError () returned 0x0 [0155.507] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x47debe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0155.507] GetLastError () returned 0x0 [0155.507] SetErrorMode (uMode=0x1) returned 0x0 [0155.507] GetFileAttributesExW (in: lpFileName="C:\\Windows" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x47df060 | out: lpFileInformation=0x47df060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89a56640, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89a56640, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0155.507] GetLastError () returned 0x0 [0155.507] SetErrorMode (uMode=0x0) returned 0x1 Thread: id = 18 os_tid = 0xaa0 Thread: id = 19 os_tid = 0xaa4 Thread: id = 20 os_tid = 0xaa8 Thread: id = 21 os_tid = 0xaac Process: id = "3" image_name = "temprunsom.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temprunsom.exe" page_root = "0x31e66000" os_pid = "0xa4c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x964" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:000104d7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 393 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 394 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 395 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 396 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 397 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 398 start_va = 0x1d0000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 399 start_va = 0x2a0000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 400 start_va = 0xc80000 end_va = 0xc9ffff entry_point = 0xc80000 region_type = mapped_file name = "temprunsom.exe" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temprunsom.exe") Region: id = 401 start_va = 0x77c50000 end_va = 0x77df8fff entry_point = 0x77c50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 402 start_va = 0x77e30000 end_va = 0x77faffff entry_point = 0x77e30000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 403 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 404 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 405 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 406 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 407 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 408 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 409 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 410 start_va = 0xb0000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 411 start_va = 0x75360000 end_va = 0x75367fff entry_point = 0x75360000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 412 start_va = 0x75370000 end_va = 0x753cbfff entry_point = 0x75370000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 413 start_va = 0x753d0000 end_va = 0x7540efff entry_point = 0x753d0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 414 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 415 start_va = 0x130000 end_va = 0x196fff entry_point = 0x130000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 416 start_va = 0x3e0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 417 start_va = 0x75760000 end_va = 0x757a9fff entry_point = 0x75760000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 418 start_va = 0x75bb0000 end_va = 0x75bf5fff entry_point = 0x75bb0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 419 start_va = 0x75fd0000 end_va = 0x760dffff entry_point = 0x75fd0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 420 start_va = 0x77a30000 end_va = 0x77b4efff entry_point = 0x0 region_type = private name = "private_0x0000000077a30000" filename = "" Region: id = 421 start_va = 0x77b50000 end_va = 0x77c49fff entry_point = 0x0 region_type = private name = "private_0x0000000077b50000" filename = "" Region: id = 422 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 423 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 436 start_va = 0x70000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 437 start_va = 0x6b0000 end_va = 0x6bffff entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 438 start_va = 0x75980000 end_va = 0x7598bfff entry_point = 0x75980000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 439 start_va = 0x75990000 end_va = 0x759effff entry_point = 0x75990000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 440 start_va = 0x75a30000 end_va = 0x75a48fff entry_point = 0x75a30000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 441 start_va = 0x760e0000 end_va = 0x7617ffff entry_point = 0x760e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 442 start_va = 0x76670000 end_va = 0x7671bfff entry_point = 0x76670000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 443 start_va = 0x775d0000 end_va = 0x776bffff entry_point = 0x775d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 444 start_va = 0x690000 end_va = 0x69ffff entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 445 start_va = 0x756e0000 end_va = 0x75757fff entry_point = 0x756e0000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 453 start_va = 0x76180000 end_va = 0x761d6fff entry_point = 0x76180000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 454 start_va = 0x763c0000 end_va = 0x763c9fff entry_point = 0x763c0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 455 start_va = 0x763e0000 end_va = 0x764dffff entry_point = 0x763e0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 456 start_va = 0x77820000 end_va = 0x778affff entry_point = 0x77820000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 457 start_va = 0x77990000 end_va = 0x77a2cfff entry_point = 0x77990000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 458 start_va = 0x4e0000 end_va = 0x667fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 459 start_va = 0x76720000 end_va = 0x767ebfff entry_point = 0x76720000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 460 start_va = 0x77570000 end_va = 0x775cffff entry_point = 0x77570000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 464 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 465 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 466 start_va = 0x6c0000 end_va = 0x840fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 467 start_va = 0xca0000 end_va = 0x209ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ca0000" filename = "" Region: id = 468 start_va = 0x756d0000 end_va = 0x756d8fff entry_point = 0x756d0000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 531 start_va = 0x1a0000 end_va = 0x1a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 532 start_va = 0x920000 end_va = 0x95ffff entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 533 start_va = 0x74d00000 end_va = 0x752aafff entry_point = 0x74d00000 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll") Region: id = 534 start_va = 0x75630000 end_va = 0x756cafff entry_point = 0x75630000 region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll") Region: id = 539 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 540 start_va = 0x1c0000 end_va = 0x1c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 541 start_va = 0x210000 end_va = 0x21ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 542 start_va = 0x220000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 543 start_va = 0x230000 end_va = 0x23ffff entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 544 start_va = 0x240000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 545 start_va = 0x250000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 546 start_va = 0x260000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 547 start_va = 0xa50000 end_va = 0xa5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 548 start_va = 0xad0000 end_va = 0xb0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 549 start_va = 0x20c0000 end_va = 0x21bffff entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 550 start_va = 0x76920000 end_va = 0x77569fff entry_point = 0x76920000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 551 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 567 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 568 start_va = 0x776c0000 end_va = 0x7781bfff entry_point = 0x776c0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 569 start_va = 0x21c0000 end_va = 0x248efff entry_point = 0x21c0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 570 start_va = 0x75620000 end_va = 0x7562afff entry_point = 0x75620000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 581 start_va = 0x850000 end_va = 0x8effff entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 582 start_va = 0xa10000 end_va = 0xa4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 583 start_va = 0xb50000 end_va = 0xc4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 584 start_va = 0x2490000 end_va = 0x448ffff entry_point = 0x0 region_type = private name = "private_0x0000000002490000" filename = "" Region: id = 585 start_va = 0x73870000 end_va = 0x74367fff entry_point = 0x73870000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll") Region: id = 586 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 587 start_va = 0x752d0000 end_va = 0x7534ffff entry_point = 0x752d0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 590 start_va = 0x960000 end_va = 0x9affff entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 592 start_va = 0x4490000 end_va = 0x456efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004490000" filename = "" Region: id = 621 start_va = 0x280000 end_va = 0x282fff entry_point = 0x280000 region_type = mapped_file name = "l_intl.nls" filename = "\\Windows\\SysWOW64\\l_intl.nls" (normalized: "c:\\windows\\syswow64\\l_intl.nls") Region: id = 622 start_va = 0x290000 end_va = 0x290fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 623 start_va = 0x730d0000 end_va = 0x7386bfff entry_point = 0x730d0000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\9e0a3b9b9f457233a335d7fba8f95419\\system.ni.dll") Region: id = 624 start_va = 0x75420000 end_va = 0x755bafff entry_point = 0x75420000 region_type = mapped_file name = "microsoft.visualbasic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualBas#\\08d608378aa405adc844f3cf36974b8c\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualbas#\\08d608378aa405adc844f3cf36974b8c\\microsoft.visualbasic.ni.dll") Region: id = 625 start_va = 0x755c0000 end_va = 0x7561afff entry_point = 0x755c0000 region_type = mapped_file name = "mscorjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll") Region: id = 626 start_va = 0x3a0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 627 start_va = 0x3b0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 628 start_va = 0x724f0000 end_va = 0x730cdfff entry_point = 0x724f0000 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\3afcd5168c7a6cb02eab99d7fd71e102\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.forms\\3afcd5168c7a6cb02eab99d7fd71e102\\system.windows.forms.ni.dll") Region: id = 629 start_va = 0x74b10000 end_va = 0x74c97fff entry_point = 0x74b10000 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\system.drawing.ni.dll") Region: id = 630 start_va = 0x3c0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 641 start_va = 0x71b50000 end_va = 0x7201dfff entry_point = 0x71b50000 region_type = mapped_file name = "system.windows.forms.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.windows.forms\\2.0.0.0__b77a5c561934e089\\system.windows.forms.dll") Region: id = 642 start_va = 0x74a40000 end_va = 0x74b00fff entry_point = 0x74a40000 region_type = mapped_file name = "system.runtime.remoting.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Runtime.Remo#\\5cae93d923c8378370758489e5535820\\System.Runtime.Remoting.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.runtime.remo#\\5cae93d923c8378370758489e5535820\\system.runtime.remoting.ni.dll") Region: id = 643 start_va = 0x3d0000 end_va = 0x3d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 649 start_va = 0x7ef50000 end_va = 0x7ef5ffff entry_point = 0x0 region_type = private name = "private_0x000000007ef50000" filename = "" Region: id = 650 start_va = 0x7ef60000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007ef60000" filename = "" Region: id = 651 start_va = 0x670000 end_va = 0x674fff entry_point = 0x670000 region_type = mapped_file name = "sorttbls.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") Region: id = 652 start_va = 0x9b0000 end_va = 0x9f0fff entry_point = 0x9b0000 region_type = mapped_file name = "sortkey.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") Region: id = 653 start_va = 0x680000 end_va = 0x680fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 654 start_va = 0x60340000 end_va = 0x60347fff entry_point = 0x60340000 region_type = mapped_file name = "culture.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\culture.dll") Region: id = 655 start_va = 0x8f0000 end_va = 0x90ffff entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 656 start_va = 0xa60000 end_va = 0xab3fff entry_point = 0xa60000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorrc.dll") Region: id = 657 start_va = 0x748b0000 end_va = 0x74a3ffff entry_point = 0x748b0000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll") Region: id = 658 start_va = 0x680000 end_va = 0x68ffff entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 659 start_va = 0x6a0000 end_va = 0x6affff entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 660 start_va = 0x4640000 end_va = 0x467ffff entry_point = 0x0 region_type = private name = "private_0x0000000004640000" filename = "" Region: id = 661 start_va = 0x47c0000 end_va = 0x48bffff entry_point = 0x0 region_type = private name = "private_0x00000000047c0000" filename = "" Region: id = 662 start_va = 0x747b0000 end_va = 0x748aafff entry_point = 0x747b0000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 663 start_va = 0x7ef4d000 end_va = 0x7ef4ffff entry_point = 0x0 region_type = private name = "private_0x000000007ef4d000" filename = "" Region: id = 664 start_va = 0x910000 end_va = 0x910fff entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 665 start_va = 0x960000 end_va = 0x960fff entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 666 start_va = 0x970000 end_va = 0x9affff entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 667 start_va = 0x48c0000 end_va = 0x4abefff entry_point = 0x0 region_type = private name = "private_0x00000000048c0000" filename = "" Region: id = 668 start_va = 0xb10000 end_va = 0xb2afff entry_point = 0xb10000 region_type = mapped_file name = "gdipfontcachev1.dat" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat") Region: id = 669 start_va = 0x4680000 end_va = 0x477ffff entry_point = 0x0 region_type = private name = "private_0x0000000004680000" filename = "" Region: id = 670 start_va = 0x4570000 end_va = 0x461afff entry_point = 0x4570000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 671 start_va = 0x4570000 end_va = 0x461afff entry_point = 0x4570000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 672 start_va = 0x4ac0000 end_va = 0x5f68fff entry_point = 0x4ac0000 region_type = mapped_file name = "msjh.ttf" filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf") Region: id = 673 start_va = 0x4ac0000 end_va = 0x5f68fff entry_point = 0x4ac0000 region_type = mapped_file name = "msjh.ttf" filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf") Region: id = 674 start_va = 0x4ac0000 end_va = 0x5f82fff entry_point = 0x4ac0000 region_type = mapped_file name = "msyh.ttf" filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf") Region: id = 675 start_va = 0x4ac0000 end_va = 0x5f82fff entry_point = 0x4ac0000 region_type = mapped_file name = "msyh.ttf" filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf") Region: id = 676 start_va = 0x4ac0000 end_va = 0x4ee2fff entry_point = 0x4ac0000 region_type = mapped_file name = "malgun.ttf" filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf") Region: id = 677 start_va = 0x4ac0000 end_va = 0x4ee2fff entry_point = 0x4ac0000 region_type = mapped_file name = "malgun.ttf" filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf") Region: id = 678 start_va = 0x4570000 end_va = 0x460ffff entry_point = 0x4570000 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 679 start_va = 0x4570000 end_va = 0x460ffff entry_point = 0x4570000 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 680 start_va = 0x4570000 end_va = 0x45eefff entry_point = 0x4570000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 681 start_va = 0x4570000 end_va = 0x45eefff entry_point = 0x4570000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 682 start_va = 0x4ac0000 end_va = 0x4cbffff entry_point = 0x0 region_type = private name = "private_0x0000000004ac0000" filename = "" Region: id = 683 start_va = 0xa00000 end_va = 0xa0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 684 start_va = 0xb10000 end_va = 0xb4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 685 start_va = 0x752b0000 end_va = 0x752c2fff entry_point = 0x752b0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 686 start_va = 0x747a0000 end_va = 0x747a4fff entry_point = 0x747a0000 region_type = mapped_file name = "shfolder.dll" filename = "\\Windows\\SysWOW64\\shfolder.dll" (normalized: "c:\\windows\\syswow64\\shfolder.dll") Region: id = 687 start_va = 0x74780000 end_va = 0x74796fff entry_point = 0x74780000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 688 start_va = 0x74ce0000 end_va = 0x74cf5fff entry_point = 0x74ce0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 689 start_va = 0x4570000 end_va = 0x45abfff entry_point = 0x4570000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 690 start_va = 0x4570000 end_va = 0x45abfff entry_point = 0x4570000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 691 start_va = 0x4570000 end_va = 0x45abfff entry_point = 0x4570000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 692 start_va = 0x4570000 end_va = 0x45abfff entry_point = 0x4570000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 693 start_va = 0x4570000 end_va = 0x45abfff entry_point = 0x4570000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 694 start_va = 0x74ca0000 end_va = 0x74cdafff entry_point = 0x74ca0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 695 start_va = 0x764e0000 end_va = 0x7656efff entry_point = 0x764e0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 696 start_va = 0x4570000 end_va = 0x45effff entry_point = 0x0 region_type = private name = "private_0x0000000004570000" filename = "" Region: id = 697 start_va = 0xac0000 end_va = 0xac0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ac0000" filename = "" Region: id = 698 start_va = 0x76890000 end_va = 0x76912fff entry_point = 0x76890000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 699 start_va = 0xc50000 end_va = 0xc50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c50000" filename = "" Region: id = 700 start_va = 0x74740000 end_va = 0x74772fff entry_point = 0x74740000 region_type = mapped_file name = "windowscodecsext.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecsExt.dll" (normalized: "c:\\windows\\syswow64\\windowscodecsext.dll") Region: id = 701 start_va = 0x72390000 end_va = 0x724e7fff entry_point = 0x72390000 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\SysWOW64\\msxml6.dll" (normalized: "c:\\windows\\syswow64\\msxml6.dll") Region: id = 702 start_va = 0x4cc0000 end_va = 0x4d2ffff entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 703 start_va = 0x4d30000 end_va = 0x4ddffff entry_point = 0x0 region_type = private name = "private_0x0000000004d30000" filename = "" Region: id = 704 start_va = 0x4de0000 end_va = 0x4e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 705 start_va = 0x4ea0000 end_va = 0x4f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000004ea0000" filename = "" Region: id = 706 start_va = 0x4f90000 end_va = 0x50affff entry_point = 0x0 region_type = private name = "private_0x0000000004f90000" filename = "" Region: id = 707 start_va = 0xc60000 end_va = 0xc66fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c60000" filename = "" Region: id = 708 start_va = 0xc70000 end_va = 0xc71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c70000" filename = "" Region: id = 709 start_va = 0x4f90000 end_va = 0x504ffff entry_point = 0x4f90000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 710 start_va = 0x5070000 end_va = 0x50affff entry_point = 0x0 region_type = private name = "private_0x0000000005070000" filename = "" Region: id = 711 start_va = 0x50b0000 end_va = 0x54affff entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 712 start_va = 0x20a0000 end_va = 0x20a0fff entry_point = 0x20a0000 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\SysWOW64\\msxml6r.dll" (normalized: "c:\\windows\\syswow64\\msxml6r.dll") Region: id = 713 start_va = 0x45f0000 end_va = 0x460ffff entry_point = 0x0 region_type = private name = "private_0x00000000045f0000" filename = "" Region: id = 714 start_va = 0x20b0000 end_va = 0x20bffff entry_point = 0x20b0000 region_type = mapped_file name = "img.jpg" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\img.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\img.jpg") Region: id = 715 start_va = 0x74730000 end_va = 0x74735fff entry_point = 0x74730000 region_type = mapped_file name = "iconcodecservice.dll" filename = "\\Windows\\SysWOW64\\IconCodecService.dll" (normalized: "c:\\windows\\syswow64\\iconcodecservice.dll") Region: id = 716 start_va = 0x54b0000 end_va = 0x56aefff entry_point = 0x0 region_type = private name = "private_0x00000000054b0000" filename = "" Region: id = 717 start_va = 0x56b0000 end_va = 0x58aefff entry_point = 0x0 region_type = private name = "private_0x00000000056b0000" filename = "" Region: id = 718 start_va = 0x54b0000 end_va = 0x56aefff entry_point = 0x0 region_type = private name = "private_0x00000000054b0000" filename = "" Region: id = 719 start_va = 0x56b0000 end_va = 0x5a85fff entry_point = 0x0 region_type = private name = "private_0x00000000056b0000" filename = "" Region: id = 720 start_va = 0x5a90000 end_va = 0x5e66fff entry_point = 0x0 region_type = private name = "private_0x0000000005a90000" filename = "" Region: id = 721 start_va = 0x746d0000 end_va = 0x7472efff entry_point = 0x746d0000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Region: id = 722 start_va = 0x72260000 end_va = 0x72389fff entry_point = 0x72260000 region_type = mapped_file name = "sapi.dll" filename = "\\Windows\\SysWOW64\\Speech\\Common\\sapi.dll" (normalized: "c:\\windows\\syswow64\\speech\\common\\sapi.dll") Region: id = 723 start_va = 0x74690000 end_va = 0x746c1fff entry_point = 0x74690000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 724 start_va = 0x74670000 end_va = 0x74683fff entry_point = 0x74670000 region_type = mapped_file name = "msacm32.dll" filename = "\\Windows\\SysWOW64\\msacm32.dll" (normalized: "c:\\windows\\syswow64\\msacm32.dll") Region: id = 725 start_va = 0x74660000 end_va = 0x7466afff entry_point = 0x74660000 region_type = mapped_file name = "msdmo.dll" filename = "\\Windows\\SysWOW64\\msdmo.dll" (normalized: "c:\\windows\\syswow64\\msdmo.dll") Region: id = 726 start_va = 0x54b0000 end_va = 0x566ffff entry_point = 0x0 region_type = private name = "private_0x00000000054b0000" filename = "" Region: id = 727 start_va = 0x74620000 end_va = 0x74658fff entry_point = 0x74620000 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\SysWOW64\\MMDevAPI.dll" (normalized: "c:\\windows\\syswow64\\mmdevapi.dll") Region: id = 728 start_va = 0x72160000 end_va = 0x72254fff entry_point = 0x72160000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 729 start_va = 0x75c30000 end_va = 0x75dccfff entry_point = 0x75c30000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 730 start_va = 0x75c00000 end_va = 0x75c26fff entry_point = 0x75c00000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 731 start_va = 0x76870000 end_va = 0x76881fff entry_point = 0x76870000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 732 start_va = 0x5670000 end_va = 0x5a62fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005670000" filename = "" Region: id = 733 start_va = 0x4df0000 end_va = 0x4e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 734 start_va = 0x4e60000 end_va = 0x4e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e60000" filename = "" Region: id = 735 start_va = 0x4f10000 end_va = 0x4f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000004f10000" filename = "" Region: id = 736 start_va = 0x4f50000 end_va = 0x4f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 737 start_va = 0x54b0000 end_va = 0x55affff entry_point = 0x0 region_type = private name = "private_0x00000000054b0000" filename = "" Region: id = 738 start_va = 0x5660000 end_va = 0x566ffff entry_point = 0x0 region_type = private name = "private_0x0000000005660000" filename = "" Region: id = 739 start_va = 0x5a90000 end_va = 0x5b8ffff entry_point = 0x0 region_type = private name = "private_0x0000000005a90000" filename = "" Region: id = 740 start_va = 0x5be0000 end_va = 0x5c1ffff entry_point = 0x0 region_type = private name = "private_0x0000000005be0000" filename = "" Region: id = 741 start_va = 0x5c50000 end_va = 0x5d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000005c50000" filename = "" Region: id = 742 start_va = 0x5d90000 end_va = 0x5dcffff entry_point = 0x0 region_type = private name = "private_0x0000000005d90000" filename = "" Region: id = 743 start_va = 0x5f50000 end_va = 0x604ffff entry_point = 0x0 region_type = private name = "private_0x0000000005f50000" filename = "" Region: id = 744 start_va = 0x60e0000 end_va = 0x61dffff entry_point = 0x0 region_type = private name = "private_0x00000000060e0000" filename = "" Region: id = 745 start_va = 0x743f0000 end_va = 0x74417fff entry_point = 0x743f0000 region_type = mapped_file name = "msttsengine.dll" filename = "\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll") Region: id = 746 start_va = 0x7ef41000 end_va = 0x7ef43fff entry_point = 0x0 region_type = private name = "private_0x000000007ef41000" filename = "" Region: id = 747 start_va = 0x7ef44000 end_va = 0x7ef46fff entry_point = 0x0 region_type = private name = "private_0x000000007ef44000" filename = "" Region: id = 748 start_va = 0x7ef47000 end_va = 0x7ef49fff entry_point = 0x0 region_type = private name = "private_0x000000007ef47000" filename = "" Region: id = 749 start_va = 0x7ef4a000 end_va = 0x7ef4cfff entry_point = 0x0 region_type = private name = "private_0x000000007ef4a000" filename = "" Region: id = 750 start_va = 0x55e0000 end_va = 0x561ffff entry_point = 0x0 region_type = private name = "private_0x00000000055e0000" filename = "" Region: id = 751 start_va = 0x6310000 end_va = 0x640ffff entry_point = 0x0 region_type = private name = "private_0x0000000006310000" filename = "" Region: id = 752 start_va = 0x743a0000 end_va = 0x743e5fff entry_point = 0x743a0000 region_type = mapped_file name = "msttsfrontendenu.dll" filename = "\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll") Region: id = 753 start_va = 0x7ef3e000 end_va = 0x7ef40fff entry_point = 0x0 region_type = private name = "private_0x000000007ef3e000" filename = "" Region: id = 754 start_va = 0x74610000 end_va = 0x7461afff entry_point = 0x74610000 region_type = mapped_file name = "msttscommon.dll" filename = "\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll") Region: id = 755 start_va = 0x6410000 end_va = 0x6661fff entry_point = 0x6410000 region_type = mapped_file name = "m1033dsk.tts" filename = "\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.TTS" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.tts") Region: id = 756 start_va = 0x72130000 end_va = 0x72150fff entry_point = 0x72130000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 757 start_va = 0x77940000 end_va = 0x77984fff entry_point = 0x77940000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 758 start_va = 0x6670000 end_va = 0x6a6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006670000" filename = "" Region: id = 759 start_va = 0x5dd0000 end_va = 0x5ecffff entry_point = 0x0 region_type = private name = "private_0x0000000005dd0000" filename = "" Region: id = 760 start_va = 0x6a70000 end_va = 0x6d78fff entry_point = 0x0 region_type = private name = "private_0x0000000006a70000" filename = "" Region: id = 761 start_va = 0x6d80000 end_va = 0x6f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000006d80000" filename = "" Region: id = 762 start_va = 0x75410000 end_va = 0x7541dfff entry_point = 0x75410000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 763 start_va = 0x4d40000 end_va = 0x4d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d40000" filename = "" Region: id = 764 start_va = 0x4da0000 end_va = 0x4ddffff entry_point = 0x0 region_type = private name = "private_0x0000000004da0000" filename = "" Region: id = 765 start_va = 0x7120000 end_va = 0x721ffff entry_point = 0x0 region_type = private name = "private_0x0000000007120000" filename = "" Region: id = 766 start_va = 0x7ef3b000 end_va = 0x7ef3dfff entry_point = 0x0 region_type = private name = "private_0x000000007ef3b000" filename = "" Region: id = 767 start_va = 0x20b0000 end_va = 0x20bafff entry_point = 0x20b0000 region_type = mapped_file name = "msttsdecwrp.dll" filename = "\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSDecWrp.dll" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\msttsdecwrp.dll") Region: id = 768 start_va = 0x4610000 end_va = 0x4613fff entry_point = 0x4610000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb") Region: id = 849 start_va = 0x4780000 end_va = 0x47b8fff entry_point = 0x4780000 region_type = mapped_file name = "sapi.dll" filename = "\\Windows\\SysWOW64\\Speech\\Common\\sapi.dll" (normalized: "c:\\windows\\syswow64\\speech\\common\\sapi.dll") Region: id = 850 start_va = 0x20b0000 end_va = 0x20b3fff entry_point = 0x20b0000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb") Region: id = 851 start_va = 0x4610000 end_va = 0x4610fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004610000" filename = "" Region: id = 852 start_va = 0x71fe0000 end_va = 0x7200ffff entry_point = 0x71fe0000 region_type = mapped_file name = "wdmaud.drv" filename = "\\Windows\\SysWOW64\\wdmaud.drv" (normalized: "c:\\windows\\syswow64\\wdmaud.drv") Region: id = 853 start_va = 0x74380000 end_va = 0x74383fff entry_point = 0x74380000 region_type = mapped_file name = "ksuser.dll" filename = "\\Windows\\SysWOW64\\ksuser.dll" (normalized: "c:\\windows\\syswow64\\ksuser.dll") Region: id = 854 start_va = 0x74390000 end_va = 0x74396fff entry_point = 0x74390000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\SysWOW64\\avrt.dll" (normalized: "c:\\windows\\syswow64\\avrt.dll") Region: id = 855 start_va = 0x4620000 end_va = 0x4620fff entry_point = 0x4620000 region_type = mapped_file name = "wdmaud.drv.mui" filename = "\\Windows\\SysWOW64\\en-US\\wdmaud.drv.mui" (normalized: "c:\\windows\\syswow64\\en-us\\wdmaud.drv.mui") Region: id = 856 start_va = 0x4630000 end_va = 0x4630fff entry_point = 0x4630000 region_type = mapped_file name = "mmdevapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\MMDevAPI.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mmdevapi.dll.mui") Region: id = 857 start_va = 0x71fa0000 end_va = 0x71fd5fff entry_point = 0x71fa0000 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\SysWOW64\\AudioSes.dll" (normalized: "c:\\windows\\syswow64\\audioses.dll") Region: id = 858 start_va = 0x4cc0000 end_va = 0x4cc1fff entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 859 start_va = 0x4cf0000 end_va = 0x4d2ffff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 860 start_va = 0x7220000 end_va = 0x7621fff entry_point = 0x0 region_type = private name = "private_0x0000000007220000" filename = "" Region: id = 861 start_va = 0x71f90000 end_va = 0x71f97fff entry_point = 0x71f90000 region_type = mapped_file name = "msacm32.drv" filename = "\\Windows\\SysWOW64\\msacm32.drv" (normalized: "c:\\windows\\syswow64\\msacm32.drv") Region: id = 862 start_va = 0x71f80000 end_va = 0x71f86fff entry_point = 0x71f80000 region_type = mapped_file name = "midimap.dll" filename = "\\Windows\\SysWOW64\\midimap.dll" (normalized: "c:\\windows\\syswow64\\midimap.dll") Region: id = 863 start_va = 0x71f70000 end_va = 0x71f7cfff entry_point = 0x71f70000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 864 start_va = 0x5f10000 end_va = 0x5f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 865 start_va = 0x7720000 end_va = 0x781ffff entry_point = 0x0 region_type = private name = "private_0x0000000007720000" filename = "" Region: id = 866 start_va = 0x71f40000 end_va = 0x71f68fff entry_point = 0x71f40000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 867 start_va = 0x7ef38000 end_va = 0x7ef3afff entry_point = 0x0 region_type = private name = "private_0x000000007ef38000" filename = "" Region: id = 868 start_va = 0x4cd0000 end_va = 0x4cd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004cd0000" filename = "" Region: id = 869 start_va = 0x4ce0000 end_va = 0x4ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000004ce0000" filename = "" Region: id = 870 start_va = 0x5ed0000 end_va = 0x5f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000005ed0000" filename = "" Region: id = 871 start_va = 0x78d0000 end_va = 0x79cffff entry_point = 0x0 region_type = private name = "private_0x00000000078d0000" filename = "" Region: id = 872 start_va = 0x7ef35000 end_va = 0x7ef37fff entry_point = 0x0 region_type = private name = "private_0x000000007ef35000" filename = "" Region: id = 873 start_va = 0x4d30000 end_va = 0x4d35fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004d30000" filename = "" Region: id = 874 start_va = 0x61e0000 end_va = 0x62dffff entry_point = 0x0 region_type = private name = "private_0x00000000061e0000" filename = "" Region: id = 875 start_va = 0x7040000 end_va = 0x707ffff entry_point = 0x0 region_type = private name = "private_0x0000000007040000" filename = "" Region: id = 876 start_va = 0x7b50000 end_va = 0x7c4ffff entry_point = 0x0 region_type = private name = "private_0x0000000007b50000" filename = "" Region: id = 877 start_va = 0x7ef32000 end_va = 0x7ef34fff entry_point = 0x0 region_type = private name = "private_0x000000007ef32000" filename = "" Region: id = 878 start_va = 0x7c50000 end_va = 0x804ffff entry_point = 0x0 region_type = private name = "private_0x0000000007c50000" filename = "" Region: id = 879 start_va = 0x4d30000 end_va = 0x4d35fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004d30000" filename = "" Region: id = 880 start_va = 0x4ec0000 end_va = 0x4efffff entry_point = 0x0 region_type = private name = "private_0x0000000004ec0000" filename = "" Region: id = 881 start_va = 0x7940000 end_va = 0x7a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000007940000" filename = "" Region: id = 882 start_va = 0x7ef35000 end_va = 0x7ef37fff entry_point = 0x0 region_type = private name = "private_0x000000007ef35000" filename = "" Thread: id = 10 os_tid = 0xa50 [0071.486] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0072.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", nBufferLength=0x105, lpBuffer=0x39ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", lpFilePart=0x0) returned 0x3a [0072.006] GetLastError () returned 0x2 [0072.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", nBufferLength=0x105, lpBuffer=0x39ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", lpFilePart=0x0) returned 0x3a [0072.013] GetLastError () returned 0x2 [0072.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x39ebf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c [0072.038] GetLastError () returned 0x2 [0072.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x39ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c [0072.068] GetLastError () returned 0x2 [0072.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x39ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c [0072.068] GetLastError () returned 0x2 [0072.128] GetVersionExW (in: lpVersionInformation=0x420c78*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x420c78*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.128] GetLastError () returned 0x2 [0072.130] GetVersionExW (in: lpVersionInformation=0x420c78*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x420c78*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.130] GetLastError () returned 0x2 [0075.186] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc13e [0075.186] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc140 [0075.497] GetVersionExW (in: lpVersionInformation=0x42ee90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x42ee90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0075.497] GetLastError () returned 0x2 [0075.500] GetCurrentProcess () returned 0xffffffff [0075.500] GetLastError () returned 0x3f0 [0075.503] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x39ed70 | out: TokenHandle=0x39ed70*=0x194) returned 1 [0075.503] GetLastError () returned 0x3f0 [0075.558] GetCurrentProcess () returned 0xffffffff [0075.558] GetCurrentThread () returned 0xfffffffe [0075.558] GetCurrentProcess () returned 0xffffffff [0075.560] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x39edf8, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x39edf8*=0x198) returned 1 [0075.560] GetLastError () returned 0x3f0 [0075.562] GetCurrentThreadId () returned 0xa50 [0075.565] GetSystemMetrics (nIndex=75) returned 1 [0075.890] lstrlenW (lpString="䅁") returned 1 [0075.899] GetModuleHandleW (lpModuleName="user32.dll") returned 0x763e0000 [0075.900] GetProcAddress (hModule=0x763e0000, lpProcName="DefWindowProcW") returned 0x77e625dd [0075.901] GetStockObject (i=5) returned 0x1900015 [0075.901] GetLastError () returned 0x3f0 [0075.942] GetModuleHandleW (lpModuleName=0x0) returned 0xc80000 [0075.965] CoTaskMemAlloc (cb=0x4c) returned 0x41d200 [0075.965] RegisterClassW (lpWndClass=0x42ee90) returned 0xc141 [0075.966] GetLastError () returned 0x2 [0075.966] CoTaskMemFree (pv=0x41d200) [0075.966] GetModuleHandleW (lpModuleName=0x0) returned 0xc80000 [0075.967] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0xc80000, lpParam=0x0) returned 0x201d4 [0075.968] SetWindowLongW (hWnd=0x201d4, nIndex=-4, dwNewLong=2011571677) returned 9570634 [0075.969] GetWindowLongW (hWnd=0x201d4, nIndex=-4) returned 2011571677 [0075.972] lstrlenW (lpString="䅁") returned 1 [0075.973] GetVersionExW (in: lpVersionInformation=0x42eeb0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x42eeb0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0075.973] GetLastError () returned 0x2 [0075.975] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x39e4ec | out: phkResult=0x39e4ec*=0x19c) returned 0x0 [0075.977] RegQueryValueExW (in: hKey=0x19c, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x39e534, lpData=0x0, lpcbData=0x39e530*=0x0 | out: lpType=0x39e534*=0x0, lpData=0x0, lpcbData=0x39e530*=0x0) returned 0x2 [0075.977] RegQueryValueExW (in: hKey=0x19c, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x39e534, lpData=0x0, lpcbData=0x39e530*=0x0 | out: lpType=0x39e534*=0x0, lpData=0x0, lpcbData=0x39e530*=0x0) returned 0x2 [0075.977] RegCloseKey (hKey=0x19c) returned 0x0 [0075.980] SetWindowLongW (hWnd=0x201d4, nIndex=-4, dwNewLong=9570954) returned 2011571677 [0075.980] GetWindowLongW (hWnd=0x201d4, nIndex=-4) returned 9570954 [0075.980] GetWindowLongW (hWnd=0x201d4, nIndex=-16) returned 113311744 [0075.982] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc137 [0075.982] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x201d4, Msg=0x24, wParam=0x0, lParam=0x39e7c8) returned 0x0 [0075.983] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc138 [0075.983] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x201d4, Msg=0x81, wParam=0x0, lParam=0x39e7bc) returned 0x1 [0075.983] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x201d4, Msg=0x83, wParam=0x0, lParam=0x39e7a8) returned 0x0 [0075.983] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x201d4, Msg=0x1, wParam=0x0, lParam=0x39e7bc) returned 0x0 [0075.984] GetClientRect (in: hWnd=0x201d4, lpRect=0x39e538 | out: lpRect=0x39e538) returned 1 [0075.984] GetWindowRect (in: hWnd=0x201d4, lpRect=0x39e538 | out: lpRect=0x39e538) returned 1 [0075.985] GetLastError () returned 0x7f [0075.986] GetParent (hWnd=0x201d4) returned 0x0 [0077.607] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x39ed18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x64 [0077.607] GetLastError () returned 0x7f [0077.686] IsAppThemed () returned 0x1 [0077.688] CoTaskMemAlloc (cb=0xca) returned 0x421338 [0077.688] CreateActCtxA (pActCtx=0x42ee78) returned 0x43b7cc [0077.698] CoTaskMemFree (pv=0x421338) [0078.269] _finite (_X=0x0) returned 1 [0078.559] AdjustWindowRectEx (in: lpRect=0x39ecec, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x39ecec) returned 1 [0078.573] GetUserNameW (in: lpBuffer=0x42ee78, pcbBuffer=0x39ed54 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x39ed54) returned 1 [0078.576] GetComputerNameW (in: lpBuffer=0x42ee78, nSize=0x39ed54 | out: lpBuffer="XDUWTFONO", nSize=0x39ed54) returned 1 [0079.796] AdjustWindowRectEx (in: lpRect=0x39ed10, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x39ed10) returned 1 [0079.932] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.config", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.config", lpFilePart=0x0) returned 0x3d [0079.932] GetLastError () returned 0x0 [0079.932] SetErrorMode (uMode=0x1) returned 0x0 [0079.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temprunsom.config"), fInfoLevelId=0x0, lpFileInformation=0x39ebf8 | out: lpFileInformation=0x39ebf8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0079.934] GetLastError () returned 0x2 [0079.934] SetErrorMode (uMode=0x0) returned 0x1 [0080.575] GetCurrentProcessId () returned 0xa4c [0080.575] GetLastError () returned 0x57 [0080.577] FindAtomW (lpString="GDI+Atom_2636_1") returned 0x0 [0080.577] GetLastError () returned 0x2 [0080.578] AddAtomW (lpString="GDI+Atom_2636_1") returned 0xc000 [0080.580] GetLastError () returned 0x2 [0080.730] GdiplusStartup (in: token=0x235b68, input=0x42ee78, output=0x39de30 | out: token=0x235b68, output=0x39de30) returned 0x0 [0080.774] GetLastError () returned 0x0 [0080.786] GdipLoadImageFromStream (stream=0x6a0030, image=0x39e62c) returned 0x0 [0081.170] GetLastError () returned 0x0 [0081.171] GdipImageForceValidation (image=0x682230) returned 0x0 [0081.208] GetLastError () returned 0x0 [0081.209] GdipGetImageType (image=0x682230, type=0x39e628) returned 0x0 [0081.209] GetLastError () returned 0x0 [0081.209] GdipGetImageRawFormat (image=0x682230, format=0x39e594*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0081.209] GetLastError () returned 0x0 [0081.238] AdjustWindowRectEx (in: lpRect=0x39ec8c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x39ec8c) returned 1 [0081.295] GetProcessWindowStation () returned 0x5c [0081.296] GetUserObjectInformationA (in: hObj=0x5c, nIndex=1, pvInfo=0x24d9948, nLength=0xc, lpnLengthNeeded=0x39eb64 | out: pvInfo=0x24d9948, lpnLengthNeeded=0x39eb64) returned 1 [0081.296] GetLastError () returned 0x0 [0081.299] SetConsoleCtrlHandler (HandlerRoutine=0x92143a, Add=1) returned 1 [0081.299] GetModuleHandleW (lpModuleName=0x0) returned 0xc80000 [0081.300] GetModuleHandleW (lpModuleName=0x0) returned 0xc80000 [0081.304] GetClassInfoW (in: hInstance=0xc80000, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", lpWndClass=0x24d9990 | out: lpWndClass=0x24d9990) returned 0 [0081.306] CoTaskMemAlloc (cb=0x58) returned 0x42d590 [0081.307] RegisterClassW (lpWndClass=0x42ee90) returned 0xc144 [0081.307] GetLastError () returned 0x583 [0081.307] CoTaskMemFree (pv=0x42d590) [0081.308] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", lpWindowName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0xc80000, lpParam=0x0) returned 0x301ca [0081.309] NtdllDefWindowProc_W () returned 0x1 [0081.310] NtdllDefWindowProc_W () returned 0x0 [0081.310] NtdllDefWindowProc_W () returned 0x0 [0081.310] NtdllDefWindowProc_W () returned 0x0 [0081.310] NtdllDefWindowProc_W () returned 0x0 [0081.310] GetLastError () returned 0x0 [0081.324] GetSysColor (nIndex=10) returned 0xb4b4b4 [0081.324] GetLastError () returned 0x0 [0081.324] GetSysColor (nIndex=2) returned 0xd1b499 [0081.324] GetLastError () returned 0x0 [0081.324] GetSysColor (nIndex=9) returned 0x0 [0081.324] GetLastError () returned 0x0 [0081.324] GetSysColor (nIndex=12) returned 0xababab [0081.324] GetLastError () returned 0x0 [0081.324] GetSysColor (nIndex=15) returned 0xf0f0f0 [0081.324] GetLastError () returned 0x0 [0081.324] GetSysColor (nIndex=20) returned 0xffffff [0081.324] GetLastError () returned 0x0 [0081.324] GetSysColor (nIndex=16) returned 0xa0a0a0 [0081.324] GetLastError () returned 0x0 [0081.324] GetSysColor (nIndex=15) returned 0xf0f0f0 [0081.324] GetLastError () returned 0x0 [0081.324] GetSysColor (nIndex=16) returned 0xa0a0a0 [0081.324] GetLastError () returned 0x0 [0081.324] GetSysColor (nIndex=21) returned 0x696969 [0081.324] GetLastError () returned 0x0 [0081.324] GetSysColor (nIndex=22) returned 0xe3e3e3 [0081.324] GetLastError () returned 0x0 [0081.324] GetSysColor (nIndex=20) returned 0xffffff [0081.324] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=18) returned 0x0 [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=1) returned 0x0 [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=27) returned 0xead1b9 [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=28) returned 0xf2e4d7 [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=17) returned 0x6d6d6d [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=13) returned 0xff9933 [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=14) returned 0xffffff [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=26) returned 0xcc6600 [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=11) returned 0xfcf7f4 [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=3) returned 0xdbcdbf [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=19) returned 0x544e43 [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=24) returned 0xe1ffff [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=23) returned 0x0 [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=4) returned 0xf0f0f0 [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=30) returned 0xf0f0f0 [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=29) returned 0xff9933 [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=7) returned 0x0 [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=0) returned 0xc8c8c8 [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=5) returned 0xffffff [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=6) returned 0x646464 [0081.325] GetLastError () returned 0x0 [0081.325] GetSysColor (nIndex=8) returned 0x0 [0081.325] GetLastError () returned 0x0 [0081.348] AdjustWindowRectEx (in: lpRect=0x39ec8c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x39ec8c) returned 1 [0081.388] AdjustWindowRectEx (in: lpRect=0x39ecb4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39ecb4) returned 1 [0081.388] GetSystemMetrics (nIndex=59) returned 1460 [0081.388] GetSystemMetrics (nIndex=60) returned 920 [0081.388] GetSystemMetrics (nIndex=34) returned 132 [0081.388] GetSystemMetrics (nIndex=35) returned 38 [0081.417] AdjustWindowRectEx (in: lpRect=0x39ebb8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39ebb8) returned 1 [0081.418] GetCurrentThreadId () returned 0xa50 [0081.418] GetCurrentThreadId () returned 0xa50 [0081.419] GetSystemDefaultLCID () returned 0x409 [0081.419] GetLastError () returned 0x0 [0081.419] GetStockObject (i=17) returned 0x18a0025 [0081.419] GetLastError () returned 0x0 [0081.421] GetObjectW (in: h=0x18a0025, c=92, pv=0x42ee90 | out: pv=0x42ee90) returned 92 [0081.421] GetLastError () returned 0x0 [0081.421] GetDC (hWnd=0x0) returned 0x201082d [0081.421] GetLastError () returned 0x0 [0081.477] GdipCreateFontFromLogfontW (hdc=0x201082d, logfont=0x42ee90, font=0x39ebfc) returned 0x0 [0081.665] GetLastError () returned 0x0 [0081.666] GdipGetFontUnit (font=0x682f20, unit=0x39ebc0) returned 0x0 [0081.666] GetLastError () returned 0x7f [0081.667] GdipGetFontSize (font=0x682f20, size=0x39ebc4) returned 0x0 [0081.667] GetLastError () returned 0x7f [0081.667] GdipGetFontStyle (font=0x682f20, style=0x39ebbc) returned 0x0 [0081.667] GetLastError () returned 0x7f [0081.667] GdipGetFamily (font=0x682f20, family=0x39ebb8) returned 0x0 [0081.667] GetLastError () returned 0x7f [0081.667] GdipGetFontSize (font=0x682f20, size=0x24da6d0) returned 0x0 [0081.667] GetLastError () returned 0x7f [0081.668] ReleaseDC (hWnd=0x0, hDC=0x201082d) returned 1 [0081.668] GetLastError () returned 0x7f [0081.668] GetDC (hWnd=0x0) returned 0x201082d [0081.668] GetLastError () returned 0x7f [0081.668] GdipCreateFromHDC (hdc=0x201082d, graphics=0x39ebf4) returned 0x0 [0081.669] GetLastError () returned 0x7f [0081.670] GdipGetDpiY (graphics=0x47691f0, dpi=0x24da7d8) returned 0x0 [0081.670] GetLastError () returned 0x7f [0081.670] GdipGetFontHeight (font=0x682f20, graphics=0x47691f0, height=0x39ebec) returned 0x0 [0081.670] GetLastError () returned 0x7f [0081.671] GdipGetEmHeight (family=0x469cbc0, style=0, EmHeight=0x39ebf4) returned 0x0 [0081.671] GetLastError () returned 0x7f [0081.671] GdipGetLineSpacing (family=0x469cbc0, style=0, LineSpacing=0x39ebf4) returned 0x0 [0081.671] GetLastError () returned 0x7f [0081.672] FindAtomW (lpString="GDI+Atom_2636_1") returned 0xc000 [0081.672] GetLastError () returned 0x7f [0081.672] GdipDeleteGraphics (graphics=0x47691f0) returned 0x0 [0081.672] GetLastError () returned 0x7f [0081.672] ReleaseDC (hWnd=0x0, hDC=0x201082d) returned 1 [0081.672] GetLastError () returned 0x7f [0081.673] GdipCreateFont (fontFamily=0x469cbc0, emSize=0x41040000, style=0, unit=0x3, font=0x24da798) returned 0x0 [0081.673] GetLastError () returned 0x7f [0081.673] GdipGetFontSize (font=0x4722a10, size=0x24da79c) returned 0x0 [0081.673] GetLastError () returned 0x7f [0081.673] FindAtomW (lpString="GDI+Atom_2636_1") returned 0xc000 [0081.673] GetLastError () returned 0x7f [0081.673] GdipDeleteFont (font=0x682f20) returned 0x0 [0081.674] GetLastError () returned 0x7f [0081.676] AdjustWindowRectEx (in: lpRect=0x39ebd4, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39ebd4) returned 1 [0081.676] AdjustWindowRectEx (in: lpRect=0x39ec8c, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39ec8c) returned 1 [0081.676] GetSystemMetrics (nIndex=59) returned 1460 [0081.676] GetSystemMetrics (nIndex=60) returned 920 [0081.676] AdjustWindowRectEx (in: lpRect=0x39eae0, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39eae0) returned 1 [0081.676] AdjustWindowRectEx (in: lpRect=0x39eb90, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39eb90) returned 1 [0082.297] GetSystemMetrics (nIndex=11) returned 32 [0082.297] GetLastError () returned 0x57 [0082.297] GetSystemMetrics (nIndex=12) returned 32 [0082.297] GetLastError () returned 0x57 [0082.298] GetDC (hWnd=0x0) returned 0x201082d [0082.298] GetLastError () returned 0x57 [0082.300] GetDeviceCaps (hdc=0x201082d, index=12) returned 32 [0082.300] GetLastError () returned 0x57 [0082.300] GetDeviceCaps (hdc=0x201082d, index=14) returned 1 [0082.300] GetLastError () returned 0x57 [0082.300] ReleaseDC (hWnd=0x0, hDC=0x201082d) returned 1 [0082.300] GetLastError () returned 0x57 [0082.301] CreateIconFromResourceEx (presbits=0x24e15b4, dwResSize=0x2e8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x11019f [0082.302] GetLastError () returned 0x57 [0082.304] CreateCompatibleDC (hdc=0x0) returned 0x23010828 [0082.305] GetLastError () returned 0x57 [0082.305] GetDC (hWnd=0x0) returned 0x201082d [0082.305] GetLastError () returned 0x57 [0082.305] GdipCreateFromHDC (hdc=0x201082d, graphics=0x39eb1c) returned 0x0 [0082.305] GetLastError () returned 0x57 [0082.308] GdipGetLogFontW (font=0x4722a10, graphics=0x47691f0, logfontW=0x42ee90) returned 0x0 [0082.308] GetLastError () returned 0x57 [0082.311] FindAtomW (lpString="GDI+Atom_2636_1") returned 0xc000 [0082.311] GetLastError () returned 0x7f [0082.311] GdipDeleteGraphics (graphics=0x47691f0) returned 0x0 [0082.311] GetLastError () returned 0x7f [0082.311] ReleaseDC (hWnd=0x0, hDC=0x201082d) returned 1 [0082.312] GetLastError () returned 0x7f [0082.313] CreateFontIndirectW (lplf=0x42ee90) returned 0xe0a0284 [0082.313] GetLastError () returned 0x7f [0082.314] SelectObject (hdc=0x23010828, h=0xe0a0284) returned 0x18a002e [0082.314] GetLastError () returned 0x7f [0082.346] GetTextMetricsW (in: hdc=0x23010828, lptm=0x39ec08 | out: lptm=0x39ec08) returned 1 [0082.346] GetLastError () returned 0x7f [0082.350] GetTextExtentPoint32W (in: hdc=0x23010828, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x24e1ba0 | out: psizl=0x24e1ba0) returned 1 [0082.353] GetLastError () returned 0x0 [0082.353] SelectObject (hdc=0x23010828, h=0x18a002e) returned 0xe0a0284 [0082.353] GetLastError () returned 0x0 [0082.355] DeleteDC (hdc=0x23010828) returned 1 [0082.355] GetLastError () returned 0x0 [0082.356] AdjustWindowRectEx (in: lpRect=0x39ea28, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39ea28) returned 1 [0082.356] AdjustWindowRectEx (in: lpRect=0x39eb9c, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39eb9c) returned 1 [0082.356] AdjustWindowRectEx (in: lpRect=0x39e994, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39e994) returned 1 [0082.356] AdjustWindowRectEx (in: lpRect=0x39ea68, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39ea68) returned 1 [0082.358] AdjustWindowRectEx (in: lpRect=0x39eb80, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x39eb80) returned 1 [0082.358] AdjustWindowRectEx (in: lpRect=0x39ea7c, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x39ea7c) returned 1 [0082.373] GetCurrentActCtx (in: lphActCtx=0x39f208 | out: lphActCtx=0x39f208*=0x0) returned 1 [0082.375] ActivateActCtx (in: hActCtx=0x43b7cc, lpCookie=0x39f21c | out: hActCtx=0x43b7cc, lpCookie=0x39f21c) returned 1 [0082.375] GetCurrentActCtx (in: lphActCtx=0x39f048 | out: lphActCtx=0x39f048*=0x43b7cc) returned 1 [0082.375] AdjustWindowRectEx (in: lpRect=0x39efbc, dwStyle=0x2010000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x39efbc) returned 1 [0082.376] GetModuleHandleW (lpModuleName=0x0) returned 0xc80000 [0082.376] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName=0x0, dwStyle=0x2010000, X=-2147483648, Y=-2147483648, nWidth=10, nHeight=10, hWndParent=0x0, hMenu=0x0, hInstance=0xc80000, lpParam=0x0) returned 0x301ce [0082.376] SetWindowLongW (hWnd=0x301ce, nIndex=-4, dwNewLong=2011571677) returned 9570634 [0082.376] GetWindowLongW (hWnd=0x301ce, nIndex=-4) returned 2011571677 [0082.377] SetWindowLongW (hWnd=0x301ce, nIndex=-4, dwNewLong=9573530) returned 2011571677 [0082.377] GetWindowLongW (hWnd=0x301ce, nIndex=-4) returned 9573530 [0082.377] GetWindowLongW (hWnd=0x301ce, nIndex=-16) returned 113311744 [0082.377] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x81, wParam=0x0, lParam=0x39eaac) returned 0x1 [0082.378] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x83, wParam=0x0, lParam=0x39ea98) returned 0x0 [0082.517] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x1, wParam=0x0, lParam=0x39eaac) returned 0x0 [0082.517] GetClientRect (in: hWnd=0x301ce, lpRect=0x39e7f0 | out: lpRect=0x39e7f0) returned 1 [0082.517] GetWindowRect (in: hWnd=0x301ce, lpRect=0x39e7f0 | out: lpRect=0x39e7f0) returned 1 [0082.518] GetWindowTextLengthW (hWnd=0x301ce) returned 0 [0082.518] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0082.518] GetSystemMetrics (nIndex=42) returned 0 [0082.519] GetWindowTextW (in: hWnd=0x301ce, lpString=0x42ee98, nMaxCount=1 | out: lpString="") returned 0 [0082.519] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0xd, wParam=0x1, lParam=0x42ee98) returned 0x0 [0082.520] GetStartupInfoW (in: lpStartupInfo=0x24e1f4c | out: lpStartupInfo=0x24e1f4c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temprunsom.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0082.521] GetLastError () returned 0x0 [0082.521] GetParent (hWnd=0x301ce) returned 0x0 [0082.521] SetWindowLongW (hWnd=0x301ce, nIndex=-8, dwNewLong=0) returned 0 [0082.521] GetSystemMetrics (nIndex=49) returned 16 [0082.521] GetSystemMetrics (nIndex=50) returned 16 [0082.521] CreateIconFromResourceEx (presbits=0x24e1fc4, dwResSize=0x2e8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x700f9 [0082.522] GetLastError () returned 0x578 [0082.523] SendMessageW (hWnd=0x301ce, Msg=0x80, wParam=0x0, lParam=0x700f9) returned 0x0 [0082.523] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x80, wParam=0x0, lParam=0x700f9) returned 0x0 [0082.524] SendMessageW (hWnd=0x301ce, Msg=0x80, wParam=0x1, lParam=0x11019f) returned 0x0 [0082.524] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x80, wParam=0x1, lParam=0x11019f) returned 0x0 [0082.524] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0xd, wParam=0x104, lParam=0x97c5e0) returned 0x0 [0082.525] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0xd, wParam=0x104, lParam=0x97c5e0) returned 0x0 [0082.525] GetSystemMenu (hWnd=0x301ce, bRevert=0) returned 0x0 [0082.526] GetWindowPlacement (in: hWnd=0x301ce, lpwndpl=0x39f058 | out: lpwndpl=0x39f058) returned 1 [0082.527] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0082.527] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0082.527] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1 [0082.527] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0082.527] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0082.527] GetClientRect (in: hWnd=0x301ce, lpRect=0x39f098 | out: lpRect=0x39f098) returned 1 [0082.527] GetClientRect (in: hWnd=0x301ce, lpRect=0x39f04c | out: lpRect=0x39f04c) returned 1 [0082.527] GetWindowRect (in: hWnd=0x301ce, lpRect=0x39f04c | out: lpRect=0x39f04c) returned 1 [0082.527] GetWindowLongW (hWnd=0x301ce, nIndex=-16) returned 113311744 [0082.527] GetWindowLongW (hWnd=0x301ce, nIndex=-16) returned 113311744 [0082.527] GetWindowLongW (hWnd=0x301ce, nIndex=-20) returned 327936 [0082.527] SetWindowLongW (hWnd=0x301ce, nIndex=-16, dwNewLong=33619968) returned 113311744 [0082.527] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x7c, wParam=0xfffffff0, lParam=0x39efcc) returned 0x0 [0082.527] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x7d, wParam=0xfffffff0, lParam=0x39efcc) returned 0x0 [0082.528] SetWindowLongW (hWnd=0x301ce, nIndex=-20, dwNewLong=327680) returned 327680 [0082.528] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x7c, wParam=0xffffffec, lParam=0x39efcc) returned 0x0 [0082.528] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x7d, wParam=0xffffffec, lParam=0x39efcc) returned 0x0 [0082.529] SetWindowPos (hWnd=0x301ce, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0082.529] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x46, wParam=0x0, lParam=0x39f004) returned 0x0 [0082.529] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x83, wParam=0x1, lParam=0x39efdc) returned 0x0 [0082.529] GetWindowPlacement (in: hWnd=0x301ce, lpwndpl=0x39edc4 | out: lpwndpl=0x39edc4) returned 1 [0082.529] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x47, wParam=0x0, lParam=0x39f004) returned 0x0 [0082.529] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x3, wParam=0x0, lParam=0x190019) returned 0x0 [0082.529] GetClientRect (in: hWnd=0x301ce, lpRect=0x39e8b0 | out: lpRect=0x39e8b0) returned 1 [0082.529] GetWindowRect (in: hWnd=0x301ce, lpRect=0x39e8b0 | out: lpRect=0x39e8b0) returned 1 [0082.530] GetWindowTextLengthW (hWnd=0x301ce) returned 0 [0082.530] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0082.530] GetSystemMetrics (nIndex=42) returned 0 [0082.530] GetWindowTextW (in: hWnd=0x301ce, lpString=0x42ee78, nMaxCount=1 | out: lpString="") returned 0 [0082.530] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0xd, wParam=0x1, lParam=0x42ee78) returned 0x0 [0082.530] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x5, wParam=0x0, lParam=0x260084) returned 0x0 [0082.530] GetClientRect (in: hWnd=0x301ce, lpRect=0x39ed60 | out: lpRect=0x39ed60) returned 1 [0082.530] GetWindowRect (in: hWnd=0x301ce, lpRect=0x39ed60 | out: lpRect=0x39ed60) returned 1 [0082.531] RedrawWindow (hWnd=0x301ce, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0082.531] GetSystemMenu (hWnd=0x301ce, bRevert=0) returned 0x0 [0082.531] GetWindowPlacement (in: hWnd=0x301ce, lpwndpl=0x39f03c | out: lpwndpl=0x39f03c) returned 1 [0082.531] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x0) returned 1 [0082.531] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf030, uEnable=0x0) returned 1 [0082.531] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf060, uEnable=0x0) returned 1 [0082.531] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0082.531] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0082.532] ShowWindow (hWnd=0x301ce, nCmdShow=5) returned 0 [0082.532] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0082.532] GetCurrentActCtx (in: lphActCtx=0x39ed14 | out: lphActCtx=0x39ed14*=0x43b7cc) returned 1 [0082.532] GetModuleHandleW (lpModuleName=0x0) returned 0xc80000 [0082.532] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName=0x0, dwStyle=0x56000000, X=292, Y=321, nWidth=10, nHeight=10, hWndParent=0x301ce, hMenu=0x0, hInstance=0xc80000, lpParam=0x0) returned 0x301da [0082.532] SetWindowLongW (hWnd=0x301da, nIndex=-4, dwNewLong=2011571677) returned 9570634 [0082.533] GetWindowLongW (hWnd=0x301da, nIndex=-4) returned 2011571677 [0082.533] SetWindowLongW (hWnd=0x301da, nIndex=-4, dwNewLong=9573578) returned 2011571677 [0082.533] GetWindowLongW (hWnd=0x301da, nIndex=-4) returned 9573578 [0082.533] GetWindowLongW (hWnd=0x301da, nIndex=-16) returned 1174405120 [0082.533] GetWindowLongW (hWnd=0x301da, nIndex=-12) returned 0 [0082.533] SetWindowLongW (hWnd=0x301da, nIndex=-12, dwNewLong=197082) returned 0 [0082.533] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x81, wParam=0x0, lParam=0x39e778) returned 0x1 [0082.533] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x83, wParam=0x0, lParam=0x39e764) returned 0x0 [0082.533] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x1, wParam=0x0, lParam=0x39e778) returned 0x0 [0082.534] GetWindow (hWnd=0x301da, uCmd=0x3) returned 0x0 [0082.534] GetClientRect (in: hWnd=0x301da, lpRect=0x39e4f4 | out: lpRect=0x39e4f4) returned 1 [0082.534] GetWindowRect (in: hWnd=0x301da, lpRect=0x39e4f4 | out: lpRect=0x39e4f4) returned 1 [0082.534] GetParent (hWnd=0x301da) returned 0x301ce [0082.535] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x301ce, lpPoints=0x39e4f4, cPoints=0x2 | out: lpPoints=0x39e4f4) returned -1572889 [0082.535] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x5, wParam=0x0, lParam=0xa000a) returned 0x0 [0082.535] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x3, wParam=0x0, lParam=0x1410124) returned 0x0 [0082.535] GetClientRect (in: hWnd=0x301da, lpRect=0x39e54c | out: lpRect=0x39e54c) returned 1 [0082.535] GetWindowRect (in: hWnd=0x301da, lpRect=0x39e54c | out: lpRect=0x39e54c) returned 1 [0082.535] GetParent (hWnd=0x301da) returned 0x301ce [0082.535] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x301ce, lpPoints=0x39e54c, cPoints=0x2 | out: lpPoints=0x39e54c) returned -1572889 [0082.535] SendMessageW (hWnd=0x301da, Msg=0x2210, wParam=0x1da0001, lParam=0x301da) returned 0x0 [0082.535] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x2210, wParam=0x1da0001, lParam=0x301da) returned 0x0 [0082.535] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0082.535] GetLastError () returned 0x0 [0082.535] GetParent (hWnd=0x301da) returned 0x301ce [0082.536] GetWindowTextLengthW (hWnd=0x301ce) returned 0 [0082.536] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0082.536] GetSystemMetrics (nIndex=42) returned 0 [0082.536] GetWindowTextW (in: hWnd=0x301ce, lpString=0x42ee78, nMaxCount=1 | out: lpString="") returned 0 [0082.536] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0xd, wParam=0x1, lParam=0x42ee78) returned 0x0 [0082.601] GetUserNameW (in: lpBuffer=0x42ee78, pcbBuffer=0x39ed0c | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x39ed0c) returned 1 [0082.672] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned 0x0 [0082.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0082.673] GetLastError () returned 0x3f0 [0082.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28 [0082.698] GetLastError () returned 0x3f0 [0082.700] SetErrorMode (uMode=0x1) returned 0x0 [0082.703] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c2b0 [0082.703] GetLastError () returned 0x3f0 [0082.704] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.704] GetLastError () returned 0x3f0 [0082.704] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.704] GetLastError () returned 0x3f0 [0082.705] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.705] GetLastError () returned 0x3f0 [0082.705] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.705] GetLastError () returned 0x3f0 [0082.705] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.705] GetLastError () returned 0x3f0 [0082.705] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.705] GetLastError () returned 0x3f0 [0082.705] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.705] GetLastError () returned 0x3f0 [0082.706] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.706] GetLastError () returned 0x3f0 [0082.706] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.706] GetLastError () returned 0x3f0 [0082.706] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.706] GetLastError () returned 0x3f0 [0082.706] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.706] GetLastError () returned 0x3f0 [0082.707] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.707] GetLastError () returned 0x3f0 [0082.707] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.707] GetLastError () returned 0x3f0 [0082.707] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.707] GetLastError () returned 0x3f0 [0082.707] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.707] GetLastError () returned 0x3f0 [0082.707] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.707] GetLastError () returned 0x3f0 [0082.708] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.708] GetLastError () returned 0x3f0 [0082.708] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.708] GetLastError () returned 0x3f0 [0082.708] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.708] GetLastError () returned 0x3f0 [0082.708] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.708] GetLastError () returned 0x3f0 [0082.709] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.709] GetLastError () returned 0x3f0 [0082.709] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.709] GetLastError () returned 0x3f0 [0082.709] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.709] GetLastError () returned 0x3f0 [0082.709] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.709] GetLastError () returned 0x3f0 [0082.709] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.709] GetLastError () returned 0x3f0 [0082.710] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.710] GetLastError () returned 0x3f0 [0082.710] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.710] GetLastError () returned 0x3f0 [0082.710] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.710] GetLastError () returned 0x3f0 [0082.710] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0082.710] GetLastError () returned 0x12 [0082.711] FindClose (in: hFindFile=0x42c2b0 | out: hFindFile=0x42c2b0) returned 1 [0082.711] SetErrorMode (uMode=0x0) returned 0x1 [0082.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28 [0082.711] GetLastError () returned 0x12 [0082.711] SetErrorMode (uMode=0x1) returned 0x0 [0082.711] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c2b0 [0082.711] GetLastError () returned 0x12 [0082.712] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.712] GetLastError () returned 0x12 [0082.712] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.712] GetLastError () returned 0x12 [0082.712] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.712] GetLastError () returned 0x12 [0082.712] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.712] GetLastError () returned 0x12 [0082.712] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.712] GetLastError () returned 0x12 [0082.713] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.713] GetLastError () returned 0x12 [0082.713] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.713] GetLastError () returned 0x12 [0082.713] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.713] GetLastError () returned 0x12 [0082.713] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.713] GetLastError () returned 0x12 [0082.714] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.714] GetLastError () returned 0x12 [0082.714] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.714] GetLastError () returned 0x12 [0082.714] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.714] GetLastError () returned 0x12 [0082.714] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.714] GetLastError () returned 0x12 [0082.714] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.714] GetLastError () returned 0x12 [0082.715] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.715] GetLastError () returned 0x12 [0082.715] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.715] GetLastError () returned 0x12 [0082.715] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.715] GetLastError () returned 0x12 [0082.715] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.715] GetLastError () returned 0x12 [0082.716] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.716] GetLastError () returned 0x12 [0082.716] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.716] GetLastError () returned 0x12 [0082.716] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.716] GetLastError () returned 0x12 [0082.716] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.716] GetLastError () returned 0x12 [0082.717] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.717] GetLastError () returned 0x12 [0082.717] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.717] GetLastError () returned 0x12 [0082.717] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.717] GetLastError () returned 0x12 [0082.717] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.717] GetLastError () returned 0x12 [0082.717] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.717] GetLastError () returned 0x12 [0082.717] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0082.718] GetLastError () returned 0x12 [0082.718] FindNextFileW (in: hFindFile=0x42c2b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0082.718] GetLastError () returned 0x12 [0082.718] FindClose (in: hFindFile=0x42c2b0 | out: hFindFile=0x42c2b0) returned 1 [0082.718] SetErrorMode (uMode=0x0) returned 0x1 [0082.858] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx", lpFilePart=0x0) returned 0x31 [0082.858] GetLastError () returned 0x12 [0082.858] SetErrorMode (uMode=0x1) returned 0x0 [0082.860] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0xz6.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x204 [0082.860] GetLastError () returned 0x0 [0082.861] GetFileType (hFile=0x204) returned 0x1 [0082.861] SetErrorMode (uMode=0x0) returned 0x1 [0082.861] GetFileType (hFile=0x204) returned 0x1 [0082.863] GetFileSize (in: hFile=0x204, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0x12db6 [0082.863] GetLastError () returned 0x0 [0082.865] ReadFile (in: hFile=0x204, lpBuffer=0x24e6bb4, nNumberOfBytesToRead=0x12db6, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x24e6bb4*, lpNumberOfBytesRead=0x39ec18*=0x12db6, lpOverlapped=0x0) returned 1 [0082.865] GetLastError () returned 0x0 [0082.866] CloseHandle (hObject=0x204) returned 1 [0082.866] GetLastError () returned 0x0 [0082.894] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x39e6a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0082.894] GetLastError () returned 0xb7 [0082.894] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0082.894] GetLastError () returned 0xb7 [0082.894] SetErrorMode (uMode=0x1) returned 0x0 [0082.895] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x39eb70 | out: lpFileInformation=0x39eb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf973529, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf973529, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xc2c74ba0, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x60ed)) returned 1 [0082.895] GetLastError () returned 0xb7 [0082.895] SetErrorMode (uMode=0x0) returned 0x1 [0082.895] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x39e6cc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0082.895] GetLastError () returned 0xb7 [0082.895] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x39e658, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0082.896] GetLastError () returned 0xb7 [0083.147] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x39e67c | out: pfEnabled=0x39e67c) returned 0x0 [0083.210] GetVersionExW (in: lpVersionInformation=0x42ee90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x42ee90*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0083.210] GetLastError () returned 0x0 [0083.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx", lpFilePart=0x0) returned 0x31 [0083.303] GetLastError () returned 0x0 [0083.303] SetErrorMode (uMode=0x1) returned 0x0 [0083.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0xz6.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.304] GetLastError () returned 0xb7 [0083.304] GetFileType (hFile=0x214) returned 0x1 [0083.304] GetFileType (hFile=0x214) returned 0x1 [0083.304] WriteFile (in: hFile=0x214, lpBuffer=0x25cead4*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x39ec24, lpOverlapped=0x0 | out: lpBuffer=0x25cead4*, lpNumberOfBytesWritten=0x39ec24*=0x12dc0, lpOverlapped=0x0) returned 1 [0083.306] GetLastError () returned 0xb7 [0083.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx", lpFilePart=0x0) returned 0x31 [0083.306] GetLastError () returned 0xb7 [0083.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x3d [0083.306] GetLastError () returned 0xb7 [0083.306] SetErrorMode (uMode=0x1) returned 0x0 [0083.306] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0xz6.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f83a4a0, ftCreationTime.dwHighDateTime=0x1d3fd6d, ftLastAccessTime.dwLowDateTime=0x3680eb00, ftLastAccessTime.dwHighDateTime=0x1d386d9, ftLastWriteTime.dwLowDateTime=0x7d3980, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x12dc0)) returned 1 [0083.306] GetLastError () returned 0xb7 [0083.306] SetErrorMode (uMode=0x0) returned 0x1 [0083.308] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0xz6.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0xZ6.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0xz6.docx.lanran2.0.5")) returned 1 [0083.310] GetLastError () returned 0xb7 [0083.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx", lpFilePart=0x0) returned 0x32 [0083.310] GetLastError () returned 0xb7 [0083.310] SetErrorMode (uMode=0x1) returned 0x0 [0083.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5aqvg.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.310] GetLastError () returned 0x0 [0083.310] GetFileType (hFile=0x214) returned 0x1 [0083.310] SetErrorMode (uMode=0x0) returned 0x1 [0083.310] GetFileType (hFile=0x214) returned 0x1 [0083.310] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0xc98c [0083.310] GetLastError () returned 0x0 [0083.311] ReadFile (in: hFile=0x214, lpBuffer=0x25e212c, nNumberOfBytesToRead=0xc98c, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25e212c*, lpNumberOfBytesRead=0x39ec18*=0xc98c, lpOverlapped=0x0) returned 1 [0083.312] GetLastError () returned 0x0 [0083.312] CloseHandle (hObject=0x214) returned 1 [0083.312] GetLastError () returned 0x0 [0083.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx", lpFilePart=0x0) returned 0x32 [0083.381] GetLastError () returned 0x0 [0083.381] SetErrorMode (uMode=0x1) returned 0x0 [0083.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5aqvg.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.382] GetLastError () returned 0xb7 [0083.382] GetFileType (hFile=0x214) returned 0x1 [0083.382] GetFileType (hFile=0x214) returned 0x1 [0083.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx", lpFilePart=0x0) returned 0x32 [0083.384] GetLastError () returned 0xb7 [0083.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x3e [0083.384] GetLastError () returned 0xb7 [0083.384] SetErrorMode (uMode=0x1) returned 0x0 [0083.384] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5aqvg.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49536e50, ftCreationTime.dwHighDateTime=0x1d3bf5b, ftLastAccessTime.dwLowDateTime=0xde8c3610, ftLastAccessTime.dwHighDateTime=0x1d3f70e, ftLastWriteTime.dwLowDateTime=0x892060, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xc990)) returned 1 [0083.384] GetLastError () returned 0xb7 [0083.384] SetErrorMode (uMode=0x0) returned 0x1 [0083.384] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5aqvg.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AQVg.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5aqvg.docx.lanran2.0.5")) returned 1 [0083.385] GetLastError () returned 0xb7 [0083.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx", lpFilePart=0x0) returned 0x3f [0083.385] GetLastError () returned 0xb7 [0083.385] SetErrorMode (uMode=0x1) returned 0x0 [0083.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9xfuxm 1vtcblypynm.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.385] GetLastError () returned 0x0 [0083.385] GetFileType (hFile=0x214) returned 0x1 [0083.385] GetFileType (hFile=0x214) returned 0x1 [0083.514] ReadFile (in: hFile=0x214, lpBuffer=0x24bdcdc, nNumberOfBytesToRead=0xda8e, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x24bdcdc*, lpNumberOfBytesRead=0x39ec18*=0xda8e, lpOverlapped=0x0) returned 1 [0083.515] GetLastError () returned 0x0 [0083.515] CloseHandle (hObject=0x214) returned 1 [0083.515] GetLastError () returned 0x0 [0083.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx", lpFilePart=0x0) returned 0x3f [0083.577] GetLastError () returned 0x0 [0083.577] SetErrorMode (uMode=0x1) returned 0x0 [0083.577] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9xfuxm 1vtcblypynm.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.578] GetLastError () returned 0xb7 [0083.578] GetFileType (hFile=0x214) returned 0x1 [0083.578] GetFileType (hFile=0x214) returned 0x1 [0083.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx", lpFilePart=0x0) returned 0x3f [0083.580] GetLastError () returned 0xb7 [0083.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x4b [0083.580] GetLastError () returned 0xb7 [0083.580] SetErrorMode (uMode=0x1) returned 0x0 [0083.580] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9xfuxm 1vtcblypynm.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2333d360, ftCreationTime.dwHighDateTime=0x1d3bbda, ftLastAccessTime.dwLowDateTime=0xca950830, ftLastAccessTime.dwHighDateTime=0x1d3bd34, ftLastWriteTime.dwLowDateTime=0xa81240, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xda90)) returned 1 [0083.580] GetLastError () returned 0xb7 [0083.580] SetErrorMode (uMode=0x0) returned 0x1 [0083.580] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9xfuxm 1vtcblypynm.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9XFUXM 1vTcBLyPYnm.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9xfuxm 1vtcblypynm.docx.lanran2.0.5")) returned 1 [0083.581] GetLastError () returned 0xb7 [0083.581] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx", lpFilePart=0x0) returned 0x37 [0083.581] GetLastError () returned 0xb7 [0083.581] SetErrorMode (uMode=0x1) returned 0x0 [0083.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aa_k6kqhwa.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.581] GetLastError () returned 0x0 [0083.581] GetFileType (hFile=0x214) returned 0x1 [0083.581] GetFileType (hFile=0x214) returned 0x1 [0083.581] ReadFile (in: hFile=0x214, lpBuffer=0x257c964, nNumberOfBytesToRead=0x14b8e, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x257c964*, lpNumberOfBytesRead=0x39ec18*=0x14b8e, lpOverlapped=0x0) returned 1 [0083.582] GetLastError () returned 0x0 [0083.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx", lpFilePart=0x0) returned 0x37 [0083.609] GetLastError () returned 0x0 [0083.609] SetErrorMode (uMode=0x1) returned 0x0 [0083.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aa_k6kqhwa.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.612] GetLastError () returned 0xb7 [0083.612] GetFileType (hFile=0x214) returned 0x1 [0083.612] GetFileType (hFile=0x214) returned 0x1 [0083.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx", lpFilePart=0x0) returned 0x37 [0083.614] GetLastError () returned 0xb7 [0083.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx.LanRan2.0.5", lpFilePart=0x0) returned 0x43 [0083.614] GetLastError () returned 0xb7 [0083.614] SetErrorMode (uMode=0x1) returned 0x0 [0083.614] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aa_k6kqhwa.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa447dfe0, ftCreationTime.dwHighDateTime=0x1d3efb1, ftLastAccessTime.dwLowDateTime=0x67ccd2d0, ftLastAccessTime.dwHighDateTime=0x1d3bbce, ftLastWriteTime.dwLowDateTime=0xacd500, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x14b90)) returned 1 [0083.614] GetLastError () returned 0xb7 [0083.614] SetErrorMode (uMode=0x0) returned 0x1 [0083.614] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aa_k6kqhwa.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Aa_K6KQHWA.xlsx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aa_k6kqhwa.xlsx.lanran2.0.5")) returned 1 [0083.615] GetLastError () returned 0xb7 [0083.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx", lpFilePart=0x0) returned 0x38 [0083.615] GetLastError () returned 0xb7 [0083.615] SetErrorMode (uMode=0x1) returned 0x0 [0083.615] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gspnh93gcri.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.615] GetLastError () returned 0x0 [0083.615] GetFileType (hFile=0x214) returned 0x1 [0083.615] GetFileType (hFile=0x214) returned 0x1 [0083.615] ReadFile (in: hFile=0x214, lpBuffer=0x2657838, nNumberOfBytesToRead=0x13432, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2657838*, lpNumberOfBytesRead=0x39ec18*=0x13432, lpOverlapped=0x0) returned 1 [0083.616] GetLastError () returned 0x0 [0083.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx", lpFilePart=0x0) returned 0x38 [0083.654] GetLastError () returned 0x0 [0083.654] SetErrorMode (uMode=0x1) returned 0x0 [0083.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gspnh93gcri.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.656] GetLastError () returned 0xb7 [0083.656] GetFileType (hFile=0x214) returned 0x1 [0083.656] SetErrorMode (uMode=0x0) returned 0x1 [0083.656] GetFileType (hFile=0x214) returned 0x1 [0083.656] WriteFile (in: hFile=0x214, lpBuffer=0x252c494*, nNumberOfBytesToWrite=0x13440, lpNumberOfBytesWritten=0x39ec24, lpOverlapped=0x0 | out: lpBuffer=0x252c494*, lpNumberOfBytesWritten=0x39ec24*=0x13440, lpOverlapped=0x0) returned 1 [0083.658] GetLastError () returned 0xb7 [0083.658] CloseHandle (hObject=0x214) returned 1 [0083.659] GetLastError () returned 0xb7 [0083.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx", lpFilePart=0x0) returned 0x38 [0083.659] GetLastError () returned 0xb7 [0083.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x44 [0083.659] GetLastError () returned 0xb7 [0083.659] SetErrorMode (uMode=0x1) returned 0x0 [0083.659] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gspnh93gcri.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37f066a0, ftCreationTime.dwHighDateTime=0x1d3d553, ftLastAccessTime.dwLowDateTime=0x862ed00, ftLastAccessTime.dwHighDateTime=0x1d38499, ftLastWriteTime.dwLowDateTime=0xb3f920, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x13440)) returned 1 [0083.659] GetLastError () returned 0xb7 [0083.659] SetErrorMode (uMode=0x0) returned 0x1 [0083.659] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gspnh93gcri.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GsPNH93GCRi.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gspnh93gcri.pptx.lanran2.0.5")) returned 1 [0083.660] GetLastError () returned 0xb7 [0083.660] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx", lpFilePart=0x0) returned 0x40 [0083.660] GetLastError () returned 0xb7 [0083.660] SetErrorMode (uMode=0x1) returned 0x0 [0083.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\joza9ejryoprehlv0-r.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.660] GetLastError () returned 0x0 [0083.660] GetFileType (hFile=0x214) returned 0x1 [0083.660] SetErrorMode (uMode=0x0) returned 0x1 [0083.660] GetFileType (hFile=0x214) returned 0x1 [0083.660] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0x49e7 [0083.660] GetLastError () returned 0x0 [0083.660] ReadFile (in: hFile=0x214, lpBuffer=0x2540174, nNumberOfBytesToRead=0x49e7, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2540174*, lpNumberOfBytesRead=0x39ec18*=0x49e7, lpOverlapped=0x0) returned 1 [0083.661] GetLastError () returned 0x0 [0083.661] CloseHandle (hObject=0x214) returned 1 [0083.661] GetLastError () returned 0x0 [0083.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx", lpFilePart=0x0) returned 0x40 [0083.716] GetLastError () returned 0x0 [0083.716] SetErrorMode (uMode=0x1) returned 0x0 [0083.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\joza9ejryoprehlv0-r.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.717] GetLastError () returned 0xb7 [0083.717] GetFileType (hFile=0x214) returned 0x1 [0083.718] GetFileType (hFile=0x214) returned 0x1 [0083.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx", lpFilePart=0x0) returned 0x40 [0083.719] GetLastError () returned 0xb7 [0083.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x4c [0083.719] GetLastError () returned 0xb7 [0083.719] SetErrorMode (uMode=0x1) returned 0x0 [0083.719] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\joza9ejryoprehlv0-r.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x420eb4a0, ftCreationTime.dwHighDateTime=0x1d3ff21, ftLastAccessTime.dwLowDateTime=0x4a8310, ftLastAccessTime.dwHighDateTime=0x1d3d31a, ftLastWriteTime.dwLowDateTime=0xbd7ea0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x49f0)) returned 1 [0083.719] GetLastError () returned 0xb7 [0083.719] SetErrorMode (uMode=0x0) returned 0x1 [0083.719] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\joza9ejryoprehlv0-r.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\JOza9ejrYOPRehLv0-R.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\joza9ejryoprehlv0-r.pptx.lanran2.0.5")) returned 1 [0083.720] GetLastError () returned 0xb7 [0083.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx", lpFilePart=0x0) returned 0x35 [0083.720] GetLastError () returned 0xb7 [0083.720] SetErrorMode (uMode=0x1) returned 0x0 [0083.720] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kxh8rnph.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.720] GetLastError () returned 0x0 [0083.720] GetFileType (hFile=0x214) returned 0x1 [0083.720] GetFileType (hFile=0x214) returned 0x1 [0083.720] ReadFile (in: hFile=0x214, lpBuffer=0x25e3f54, nNumberOfBytesToRead=0xd2a7, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25e3f54*, lpNumberOfBytesRead=0x39ec18*=0xd2a7, lpOverlapped=0x0) returned 1 [0083.721] GetLastError () returned 0x0 [0083.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx", lpFilePart=0x0) returned 0x35 [0083.749] GetLastError () returned 0x0 [0083.749] SetErrorMode (uMode=0x1) returned 0x0 [0083.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kxh8rnph.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.751] GetLastError () returned 0xb7 [0083.751] GetFileType (hFile=0x214) returned 0x1 [0083.751] GetFileType (hFile=0x214) returned 0x1 [0083.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx", lpFilePart=0x0) returned 0x35 [0083.752] GetLastError () returned 0xb7 [0083.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x41 [0083.752] GetLastError () returned 0xb7 [0083.752] SetErrorMode (uMode=0x1) returned 0x0 [0083.752] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kxh8rnph.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363f8c60, ftCreationTime.dwHighDateTime=0x1d3be28, ftLastAccessTime.dwLowDateTime=0x5023d000, ftLastAccessTime.dwHighDateTime=0x1d40dab, ftLastWriteTime.dwLowDateTime=0xc24160, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xd2b0)) returned 1 [0083.752] GetLastError () returned 0xb7 [0083.752] SetErrorMode (uMode=0x0) returned 0x1 [0083.752] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kxh8rnph.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KXH8rnPH.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kxh8rnph.docx.lanran2.0.5")) returned 1 [0083.753] GetLastError () returned 0xb7 [0083.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx", lpFilePart=0x0) returned 0x31 [0083.753] GetLastError () returned 0xb7 [0083.753] SetErrorMode (uMode=0x1) returned 0x0 [0083.753] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\msvk.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.753] GetLastError () returned 0x0 [0083.753] GetFileType (hFile=0x214) returned 0x1 [0083.753] GetFileType (hFile=0x214) returned 0x1 [0083.753] ReadFile (in: hFile=0x214, lpBuffer=0x26a0a3c, nNumberOfBytesToRead=0xed9e, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26a0a3c*, lpNumberOfBytesRead=0x39ec18*=0xed9e, lpOverlapped=0x0) returned 1 [0083.754] GetLastError () returned 0x0 [0083.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx", lpFilePart=0x0) returned 0x31 [0083.822] GetLastError () returned 0x0 [0083.822] SetErrorMode (uMode=0x1) returned 0x0 [0083.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\msvk.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.823] GetLastError () returned 0xb7 [0083.823] GetFileType (hFile=0x214) returned 0x1 [0083.823] GetFileType (hFile=0x214) returned 0x1 [0083.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx", lpFilePart=0x0) returned 0x31 [0083.824] GetLastError () returned 0xb7 [0083.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x3d [0083.824] GetLastError () returned 0xb7 [0083.824] SetErrorMode (uMode=0x1) returned 0x0 [0083.824] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\msvk.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x754cbf10, ftCreationTime.dwHighDateTime=0x1d3f837, ftLastAccessTime.dwLowDateTime=0x28e69a60, ftLastAccessTime.dwHighDateTime=0x1d386f4, ftLastWriteTime.dwLowDateTime=0xcbc6e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xeda0)) returned 1 [0083.824] GetLastError () returned 0xb7 [0083.825] SetErrorMode (uMode=0x0) returned 0x1 [0083.825] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\msvk.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mSvK.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\msvk.pptx.lanran2.0.5")) returned 1 [0083.825] GetLastError () returned 0xb7 [0083.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx", lpFilePart=0x0) returned 0x32 [0083.825] GetLastError () returned 0xb7 [0083.825] SetErrorMode (uMode=0x1) returned 0x0 [0083.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\osafg.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.826] GetLastError () returned 0x0 [0083.826] GetFileType (hFile=0x214) returned 0x1 [0083.826] GetFileType (hFile=0x214) returned 0x1 [0083.826] ReadFile (in: hFile=0x214, lpBuffer=0x35791f0, nNumberOfBytesToRead=0x1668e, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x35791f0*, lpNumberOfBytesRead=0x39ec18*=0x1668e, lpOverlapped=0x0) returned 1 [0083.827] GetLastError () returned 0x0 [0083.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx", lpFilePart=0x0) returned 0x32 [0083.890] GetLastError () returned 0x0 [0083.890] SetErrorMode (uMode=0x1) returned 0x0 [0083.891] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\osafg.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.892] GetLastError () returned 0xb7 [0083.892] GetFileType (hFile=0x214) returned 0x1 [0083.892] GetFileType (hFile=0x214) returned 0x1 [0083.894] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx", lpFilePart=0x0) returned 0x32 [0083.894] GetLastError () returned 0xb7 [0083.894] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx.LanRan2.0.5", lpFilePart=0x0) returned 0x3e [0083.894] GetLastError () returned 0xb7 [0083.894] SetErrorMode (uMode=0x1) returned 0x0 [0083.894] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\osafg.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbeed2b0, ftCreationTime.dwHighDateTime=0x1d40f75, ftLastAccessTime.dwLowDateTime=0x823f09d0, ftLastAccessTime.dwHighDateTime=0x1d3a13e, ftLastWriteTime.dwLowDateTime=0xd7adc0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x16690)) returned 1 [0083.894] GetLastError () returned 0xb7 [0083.894] SetErrorMode (uMode=0x0) returned 0x1 [0083.894] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\osafg.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\OSaFg.xlsx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\osafg.xlsx.lanran2.0.5")) returned 1 [0083.895] GetLastError () returned 0xb7 [0083.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx", lpFilePart=0x0) returned 0x34 [0083.895] GetLastError () returned 0xb7 [0083.895] SetErrorMode (uMode=0x1) returned 0x0 [0083.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qohwpoo.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.895] GetLastError () returned 0x0 [0083.896] GetFileType (hFile=0x214) returned 0x1 [0083.896] GetFileType (hFile=0x214) returned 0x1 [0083.896] ReadFile (in: hFile=0x214, lpBuffer=0x25e7a80, nNumberOfBytesToRead=0x10cd3, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25e7a80*, lpNumberOfBytesRead=0x39ec18*=0x10cd3, lpOverlapped=0x0) returned 1 [0083.896] GetLastError () returned 0x0 [0083.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx", lpFilePart=0x0) returned 0x34 [0083.928] GetLastError () returned 0x0 [0083.928] SetErrorMode (uMode=0x1) returned 0x0 [0083.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qohwpoo.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.929] GetLastError () returned 0xb7 [0083.929] GetFileType (hFile=0x214) returned 0x1 [0083.929] GetFileType (hFile=0x214) returned 0x1 [0083.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx", lpFilePart=0x0) returned 0x34 [0083.931] GetLastError () returned 0xb7 [0083.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx.LanRan2.0.5", lpFilePart=0x0) returned 0x40 [0083.931] GetLastError () returned 0xb7 [0083.931] SetErrorMode (uMode=0x1) returned 0x0 [0083.931] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qohwpoo.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60ae6a20, ftCreationTime.dwHighDateTime=0x1d3a221, ftLastAccessTime.dwLowDateTime=0xc8f9c1c0, ftLastAccessTime.dwHighDateTime=0x1d3f379, ftLastWriteTime.dwLowDateTime=0xdc7080, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x10ce0)) returned 1 [0083.931] GetLastError () returned 0xb7 [0083.931] SetErrorMode (uMode=0x0) returned 0x1 [0083.931] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qohwpoo.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QohWPOo.xlsx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qohwpoo.xlsx.lanran2.0.5")) returned 1 [0083.934] GetLastError () returned 0xb7 [0083.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx", lpFilePart=0x0) returned 0x31 [0083.934] GetLastError () returned 0xb7 [0083.934] SetErrorMode (uMode=0x1) returned 0x0 [0083.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tcca.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.934] GetLastError () returned 0x0 [0083.934] GetFileType (hFile=0x214) returned 0x1 [0083.934] GetFileType (hFile=0x214) returned 0x1 [0083.935] ReadFile (in: hFile=0x214, lpBuffer=0x26b3348, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26b3348*, lpNumberOfBytesRead=0x39ec18*=0x511, lpOverlapped=0x0) returned 1 [0083.935] GetLastError () returned 0x0 [0083.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx", lpFilePart=0x0) returned 0x31 [0083.967] GetLastError () returned 0x0 [0083.967] SetErrorMode (uMode=0x1) returned 0x0 [0083.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tcca.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.968] GetLastError () returned 0xb7 [0083.968] GetFileType (hFile=0x214) returned 0x1 [0083.968] SetErrorMode (uMode=0x0) returned 0x1 [0083.968] GetFileType (hFile=0x214) returned 0x1 [0083.969] WriteFile (in: hFile=0x214, lpBuffer=0x253dfa8*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x39ebec, lpOverlapped=0x0 | out: lpBuffer=0x253dfa8*, lpNumberOfBytesWritten=0x39ebec*=0x520, lpOverlapped=0x0) returned 1 [0083.969] GetLastError () returned 0xb7 [0083.969] CloseHandle (hObject=0x214) returned 1 [0083.970] GetLastError () returned 0xb7 [0083.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx", lpFilePart=0x0) returned 0x31 [0083.970] GetLastError () returned 0xb7 [0083.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx.LanRan2.0.5", lpFilePart=0x0) returned 0x3d [0083.970] GetLastError () returned 0xb7 [0083.970] SetErrorMode (uMode=0x1) returned 0x0 [0083.970] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tcca.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbebe42d0, ftCreationTime.dwHighDateTime=0x1d3bb89, ftLastAccessTime.dwLowDateTime=0x301e5680, ftLastAccessTime.dwHighDateTime=0x1d3877e, ftLastWriteTime.dwLowDateTime=0xe394a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x520)) returned 1 [0083.970] GetLastError () returned 0xb7 [0083.971] SetErrorMode (uMode=0x0) returned 0x1 [0083.971] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tcca.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TCcA.xlsx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tcca.xlsx.lanran2.0.5")) returned 1 [0083.971] GetLastError () returned 0xb7 [0083.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv", lpFilePart=0x0) returned 0x35 [0083.971] GetLastError () returned 0xb7 [0083.971] SetErrorMode (uMode=0x1) returned 0x0 [0083.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vaotvcj53.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0083.972] GetLastError () returned 0x0 [0083.972] GetFileType (hFile=0x214) returned 0x1 [0083.972] SetErrorMode (uMode=0x0) returned 0x1 [0083.972] GetFileType (hFile=0x214) returned 0x1 [0083.972] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0x14cc8 [0083.972] GetLastError () returned 0x0 [0083.973] ReadFile (in: hFile=0x214, lpBuffer=0x3621370, nNumberOfBytesToRead=0x14cc8, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x3621370*, lpNumberOfBytesRead=0x39ec18*=0x14cc8, lpOverlapped=0x0) returned 1 [0083.975] GetLastError () returned 0x0 [0083.975] CloseHandle (hObject=0x214) returned 1 [0083.975] GetLastError () returned 0x0 [0084.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv", lpFilePart=0x0) returned 0x35 [0084.056] GetLastError () returned 0x0 [0084.056] SetErrorMode (uMode=0x1) returned 0x0 [0084.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vaotvcj53.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.057] GetLastError () returned 0xb7 [0084.057] GetFileType (hFile=0x214) returned 0x1 [0084.057] GetFileType (hFile=0x214) returned 0x1 [0084.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv", lpFilePart=0x0) returned 0x35 [0084.059] GetLastError () returned 0xb7 [0084.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv.LanRan2.0.5", lpFilePart=0x0) returned 0x41 [0084.059] GetLastError () returned 0xb7 [0084.059] SetErrorMode (uMode=0x1) returned 0x0 [0084.059] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vaotvcj53.csv"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c751890, ftCreationTime.dwHighDateTime=0x1d3ae28, ftLastAccessTime.dwLowDateTime=0xccc10030, ftLastAccessTime.dwHighDateTime=0x1d3a26a, ftLastWriteTime.dwLowDateTime=0xef7b80, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x14cd0)) returned 1 [0084.059] GetLastError () returned 0xb7 [0084.059] SetErrorMode (uMode=0x0) returned 0x1 [0084.059] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vaotvcj53.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VaOTVcj53.csv.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vaotvcj53.csv.lanran2.0.5")) returned 1 [0084.060] GetLastError () returned 0xb7 [0084.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv", lpFilePart=0x0) returned 0x3e [0084.060] GetLastError () returned 0xb7 [0084.060] SetErrorMode (uMode=0x1) returned 0x0 [0084.060] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvim8uklhfcnysa9mi.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.060] GetLastError () returned 0x0 [0084.060] GetFileType (hFile=0x214) returned 0x1 [0084.061] GetFileType (hFile=0x214) returned 0x1 [0084.061] ReadFile (in: hFile=0x214, lpBuffer=0x25c77b0, nNumberOfBytesToRead=0xa6c9, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25c77b0*, lpNumberOfBytesRead=0x39ec18*=0xa6c9, lpOverlapped=0x0) returned 1 [0084.061] GetLastError () returned 0x0 [0084.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv", lpFilePart=0x0) returned 0x3e [0084.090] GetLastError () returned 0x0 [0084.090] SetErrorMode (uMode=0x1) returned 0x0 [0084.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvim8uklhfcnysa9mi.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.091] GetLastError () returned 0xb7 [0084.092] GetFileType (hFile=0x214) returned 0x1 [0084.092] GetFileType (hFile=0x214) returned 0x1 [0084.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv", lpFilePart=0x0) returned 0x3e [0084.093] GetLastError () returned 0xb7 [0084.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv.LanRan2.0.5", lpFilePart=0x0) returned 0x4a [0084.093] GetLastError () returned 0xb7 [0084.093] SetErrorMode (uMode=0x1) returned 0x0 [0084.093] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvim8uklhfcnysa9mi.csv"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1aaa500, ftCreationTime.dwHighDateTime=0x1d3a5eb, ftLastAccessTime.dwLowDateTime=0x32734c90, ftLastAccessTime.dwHighDateTime=0x1d3ae9a, ftLastWriteTime.dwLowDateTime=0xf69fa0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xa6d0)) returned 1 [0084.093] GetLastError () returned 0xb7 [0084.093] SetErrorMode (uMode=0x0) returned 0x1 [0084.093] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvim8uklhfcnysa9mi.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\vViM8UKlhfCNYsa9mI.csv.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvim8uklhfcnysa9mi.csv.lanran2.0.5")) returned 1 [0084.094] GetLastError () returned 0xb7 [0084.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx", lpFilePart=0x0) returned 0x39 [0084.094] GetLastError () returned 0xb7 [0084.094] SetErrorMode (uMode=0x1) returned 0x0 [0084.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvsqepacekks.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.094] GetLastError () returned 0x0 [0084.094] GetFileType (hFile=0x214) returned 0x1 [0084.094] GetFileType (hFile=0x214) returned 0x1 [0084.094] ReadFile (in: hFile=0x214, lpBuffer=0x267939c, nNumberOfBytesToRead=0x3de3, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x267939c*, lpNumberOfBytesRead=0x39ec18*=0x3de3, lpOverlapped=0x0) returned 1 [0084.095] GetLastError () returned 0x0 [0084.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx", lpFilePart=0x0) returned 0x39 [0084.120] GetLastError () returned 0x0 [0084.120] SetErrorMode (uMode=0x1) returned 0x0 [0084.120] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvsqepacekks.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.121] GetLastError () returned 0xb7 [0084.121] GetFileType (hFile=0x214) returned 0x1 [0084.121] SetErrorMode (uMode=0x0) returned 0x1 [0084.121] GetFileType (hFile=0x214) returned 0x1 [0084.121] WriteFile (in: hFile=0x214, lpBuffer=0x2518d1c*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x39ec24, lpOverlapped=0x0 | out: lpBuffer=0x2518d1c*, lpNumberOfBytesWritten=0x39ec24*=0x3df0, lpOverlapped=0x0) returned 1 [0084.122] GetLastError () returned 0xb7 [0084.122] CloseHandle (hObject=0x214) returned 1 [0084.123] GetLastError () returned 0xb7 [0084.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx", lpFilePart=0x0) returned 0x39 [0084.123] GetLastError () returned 0xb7 [0084.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x45 [0084.123] GetLastError () returned 0xb7 [0084.123] SetErrorMode (uMode=0x1) returned 0x0 [0084.123] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvsqepacekks.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fc52840, ftCreationTime.dwHighDateTime=0x1d3975c, ftLastAccessTime.dwLowDateTime=0x465b3b90, ftLastAccessTime.dwHighDateTime=0x1d3fc25, ftLastWriteTime.dwLowDateTime=0xfb6260, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x3df0)) returned 1 [0084.123] GetLastError () returned 0xb7 [0084.123] SetErrorMode (uMode=0x0) returned 0x1 [0084.123] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvsqepacekks.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VVsQEpacEkkS.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vvsqepacekks.docx.lanran2.0.5")) returned 1 [0084.123] GetLastError () returned 0xb7 [0084.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx", lpFilePart=0x0) returned 0x41 [0084.123] GetLastError () returned 0xb7 [0084.123] SetErrorMode (uMode=0x1) returned 0x0 [0084.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wibix_1nev11d6kwm05l.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.124] GetLastError () returned 0x0 [0084.124] GetFileType (hFile=0x214) returned 0x1 [0084.124] SetErrorMode (uMode=0x0) returned 0x1 [0084.124] GetFileType (hFile=0x214) returned 0x1 [0084.124] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0xb062 [0084.124] GetLastError () returned 0x0 [0084.124] ReadFile (in: hFile=0x214, lpBuffer=0x251d390, nNumberOfBytesToRead=0xb062, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x251d390*, lpNumberOfBytesRead=0x39ec18*=0xb062, lpOverlapped=0x0) returned 1 [0084.124] GetLastError () returned 0x0 [0084.124] CloseHandle (hObject=0x214) returned 1 [0084.124] GetLastError () returned 0x0 [0084.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx", lpFilePart=0x0) returned 0x41 [0084.181] GetLastError () returned 0x0 [0084.181] SetErrorMode (uMode=0x1) returned 0x0 [0084.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wibix_1nev11d6kwm05l.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.182] GetLastError () returned 0xb7 [0084.182] GetFileType (hFile=0x214) returned 0x1 [0084.182] GetFileType (hFile=0x214) returned 0x1 [0084.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx", lpFilePart=0x0) returned 0x41 [0084.184] GetLastError () returned 0xb7 [0084.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x4d [0084.184] GetLastError () returned 0xb7 [0084.184] SetErrorMode (uMode=0x1) returned 0x0 [0084.184] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wibix_1nev11d6kwm05l.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a2d88c0, ftCreationTime.dwHighDateTime=0x1d3d5f1, ftLastAccessTime.dwLowDateTime=0xe494d3d0, ftLastAccessTime.dwHighDateTime=0x1d3f431, ftLastWriteTime.dwLowDateTime=0x1028680, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xb070)) returned 1 [0084.184] GetLastError () returned 0xb7 [0084.184] SetErrorMode (uMode=0x0) returned 0x1 [0084.184] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wibix_1nev11d6kwm05l.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WIbix_1nEv11d6KWm05L.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wibix_1nev11d6kwm05l.pptx.lanran2.0.5")) returned 1 [0084.184] GetLastError () returned 0xb7 [0084.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx", lpFilePart=0x0) returned 0x33 [0084.185] GetLastError () returned 0xb7 [0084.185] SetErrorMode (uMode=0x1) returned 0x0 [0084.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x7thqq.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.185] GetLastError () returned 0x0 [0084.185] GetFileType (hFile=0x214) returned 0x1 [0084.185] GetFileType (hFile=0x214) returned 0x1 [0084.185] ReadFile (in: hFile=0x214, lpBuffer=0x25d179c, nNumberOfBytesToRead=0x122ee, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25d179c*, lpNumberOfBytesRead=0x39ec18*=0x122ee, lpOverlapped=0x0) returned 1 [0084.186] GetLastError () returned 0x0 [0084.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx", lpFilePart=0x0) returned 0x33 [0084.210] GetLastError () returned 0x0 [0084.210] SetErrorMode (uMode=0x1) returned 0x0 [0084.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x7thqq.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.211] GetLastError () returned 0xb7 [0084.211] GetFileType (hFile=0x214) returned 0x1 [0084.211] GetFileType (hFile=0x214) returned 0x1 [0084.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx", lpFilePart=0x0) returned 0x33 [0084.213] GetLastError () returned 0xb7 [0084.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx.LanRan2.0.5", lpFilePart=0x0) returned 0x3f [0084.213] GetLastError () returned 0xb7 [0084.213] SetErrorMode (uMode=0x1) returned 0x0 [0084.213] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x7thqq.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cc67d10, ftCreationTime.dwHighDateTime=0x1d3adc4, ftLastAccessTime.dwLowDateTime=0x93a800e0, ftLastAccessTime.dwHighDateTime=0x1d3b5b7, ftLastWriteTime.dwLowDateTime=0x1074940, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x122f0)) returned 1 [0084.213] GetLastError () returned 0xb7 [0084.213] SetErrorMode (uMode=0x0) returned 0x1 [0084.213] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x7thqq.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X7thqq.xlsx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x7thqq.xlsx.lanran2.0.5")) returned 1 [0084.213] GetLastError () returned 0xb7 [0084.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx", lpFilePart=0x0) returned 0x40 [0084.213] GetLastError () returned 0xb7 [0084.213] SetErrorMode (uMode=0x1) returned 0x0 [0084.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xsyb4due828s75ucs t.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.214] GetLastError () returned 0x0 [0084.214] GetFileType (hFile=0x214) returned 0x1 [0084.214] GetFileType (hFile=0x214) returned 0x1 [0084.214] ReadFile (in: hFile=0x214, lpBuffer=0x26a23b0, nNumberOfBytesToRead=0x1330d, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26a23b0*, lpNumberOfBytesRead=0x39ec18*=0x1330d, lpOverlapped=0x0) returned 1 [0084.214] GetLastError () returned 0x0 [0084.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx", lpFilePart=0x0) returned 0x40 [0084.262] GetLastError () returned 0x0 [0084.262] SetErrorMode (uMode=0x1) returned 0x0 [0084.262] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xsyb4due828s75ucs t.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.263] GetLastError () returned 0xb7 [0084.263] GetFileType (hFile=0x214) returned 0x1 [0084.263] GetFileType (hFile=0x214) returned 0x1 [0084.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx", lpFilePart=0x0) returned 0x40 [0084.264] GetLastError () returned 0xb7 [0084.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x4c [0084.264] GetLastError () returned 0xb7 [0084.264] SetErrorMode (uMode=0x1) returned 0x0 [0084.264] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xsyb4due828s75ucs t.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9acd930, ftCreationTime.dwHighDateTime=0x1d3f165, ftLastAccessTime.dwLowDateTime=0x9dfa1fa0, ftLastAccessTime.dwHighDateTime=0x1d3d53e, ftLastWriteTime.dwLowDateTime=0x110cec0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x13310)) returned 1 [0084.265] GetLastError () returned 0xb7 [0084.265] SetErrorMode (uMode=0x0) returned 0x1 [0084.265] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xsyb4due828s75ucs t.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XSYB4DUe828s75uCS t.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xsyb4due828s75ucs t.pptx.lanran2.0.5")) returned 1 [0084.265] GetLastError () returned 0xb7 [0084.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF", lpFilePart=0x0) returned 0x37 [0084.265] GetLastError () returned 0xb7 [0084.265] SetErrorMode (uMode=0x1) returned 0x0 [0084.265] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0 [0084.265] GetLastError () returned 0xb7 [0084.265] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.265] GetLastError () returned 0xb7 [0084.265] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.265] GetLastError () returned 0xb7 [0084.265] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.265] GetLastError () returned 0xb7 [0084.265] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.265] GetLastError () returned 0xb7 [0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.266] GetLastError () returned 0xb7 [0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.266] GetLastError () returned 0xb7 [0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.266] GetLastError () returned 0xb7 [0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.266] GetLastError () returned 0xb7 [0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.266] GetLastError () returned 0xb7 [0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0084.266] GetLastError () returned 0x12 [0084.266] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1 [0084.266] SetErrorMode (uMode=0x0) returned 0x1 [0084.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF", lpFilePart=0x0) returned 0x37 [0084.266] GetLastError () returned 0x12 [0084.266] SetErrorMode (uMode=0x1) returned 0x0 [0084.266] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0 [0084.266] GetLastError () returned 0x12 [0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.266] GetLastError () returned 0x12 [0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.266] GetLastError () returned 0x12 [0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.266] GetLastError () returned 0x12 [0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.266] GetLastError () returned 0x12 [0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.266] GetLastError () returned 0x12 [0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.266] GetLastError () returned 0x12 [0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.266] GetLastError () returned 0x12 [0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.266] GetLastError () returned 0x12 [0084.266] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.267] GetLastError () returned 0x12 [0084.267] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0084.267] GetLastError () returned 0x12 [0084.267] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1 [0084.267] SetErrorMode (uMode=0x0) returned 0x1 [0084.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv", lpFilePart=0x0) returned 0x42 [0084.267] GetLastError () returned 0x12 [0084.267] SetErrorMode (uMode=0x1) returned 0x0 [0084.267] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\9ohwcx.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.267] GetLastError () returned 0x0 [0084.267] GetFileType (hFile=0x214) returned 0x1 [0084.267] GetFileType (hFile=0x214) returned 0x1 [0084.267] ReadFile (in: hFile=0x214, lpBuffer=0x2593f3c, nNumberOfBytesToRead=0xb9a3, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x2593f3c*, lpNumberOfBytesRead=0x39ebb8*=0xb9a3, lpOverlapped=0x0) returned 1 [0084.268] GetLastError () returned 0x0 [0084.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv", lpFilePart=0x0) returned 0x42 [0084.285] GetLastError () returned 0x0 [0084.285] SetErrorMode (uMode=0x1) returned 0x0 [0084.285] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\9ohwcx.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.286] GetLastError () returned 0xb7 [0084.286] GetFileType (hFile=0x214) returned 0x1 [0084.286] SetErrorMode (uMode=0x0) returned 0x1 [0084.286] GetFileType (hFile=0x214) returned 0x1 [0084.286] WriteFile (in: hFile=0x214, lpBuffer=0x263e5fc*, nNumberOfBytesToWrite=0xb9b0, lpNumberOfBytesWritten=0x39ebc4, lpOverlapped=0x0 | out: lpBuffer=0x263e5fc*, lpNumberOfBytesWritten=0x39ebc4*=0xb9b0, lpOverlapped=0x0) returned 1 [0084.287] GetLastError () returned 0xb7 [0084.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv", lpFilePart=0x0) returned 0x42 [0084.287] GetLastError () returned 0xb7 [0084.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv.LanRan2.0.5", lpFilePart=0x0) returned 0x4e [0084.287] GetLastError () returned 0xb7 [0084.287] SetErrorMode (uMode=0x1) returned 0x0 [0084.287] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\9ohwcx.csv"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd24744d0, ftCreationTime.dwHighDateTime=0x1d3a1cd, ftLastAccessTime.dwLowDateTime=0x1e5b7f70, ftLastAccessTime.dwHighDateTime=0x1d3a143, ftLastWriteTime.dwLowDateTime=0x1133020, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xb9b0)) returned 1 [0084.287] GetLastError () returned 0xb7 [0084.287] SetErrorMode (uMode=0x0) returned 0x1 [0084.287] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\9ohwcx.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\9ohWCx.csv.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\9ohwcx.csv.lanran2.0.5")) returned 1 [0084.289] GetLastError () returned 0xb7 [0084.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc", lpFilePart=0x0) returned 0x4d [0084.289] GetLastError () returned 0xb7 [0084.289] SetErrorMode (uMode=0x1) returned 0x0 [0084.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\is2fbgoyb_drve2 p.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.289] GetLastError () returned 0x0 [0084.289] GetFileType (hFile=0x214) returned 0x1 [0084.289] SetErrorMode (uMode=0x0) returned 0x1 [0084.289] GetFileType (hFile=0x214) returned 0x1 [0084.289] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ec10 | out: lpFileSizeHigh=0x39ec10*=0x0) returned 0x939f [0084.289] GetLastError () returned 0x0 [0084.289] ReadFile (in: hFile=0x214, lpBuffer=0x264a8a0, nNumberOfBytesToRead=0x939f, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x264a8a0*, lpNumberOfBytesRead=0x39ebb8*=0x939f, lpOverlapped=0x0) returned 1 [0084.290] GetLastError () returned 0x0 [0084.290] CloseHandle (hObject=0x214) returned 1 [0084.290] GetLastError () returned 0x0 [0084.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc", lpFilePart=0x0) returned 0x4d [0084.403] GetLastError () returned 0x0 [0084.403] SetErrorMode (uMode=0x1) returned 0x0 [0084.403] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\is2fbgoyb_drve2 p.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.404] GetLastError () returned 0xb7 [0084.404] GetFileType (hFile=0x214) returned 0x1 [0084.404] GetFileType (hFile=0x214) returned 0x1 [0084.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc", lpFilePart=0x0) returned 0x4d [0084.405] GetLastError () returned 0xb7 [0084.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc.LanRan2.0.5", lpFilePart=0x0) returned 0x59 [0084.405] GetLastError () returned 0xb7 [0084.405] SetErrorMode (uMode=0x1) returned 0x0 [0084.405] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\is2fbgoyb_drve2 p.doc"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71cbb0d0, ftCreationTime.dwHighDateTime=0x1d3a7b5, ftLastAccessTime.dwLowDateTime=0xe4bb8310, ftLastAccessTime.dwHighDateTime=0x1d3a24a, ftLastWriteTime.dwLowDateTime=0x1263b20, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x93a0)) returned 1 [0084.405] GetLastError () returned 0xb7 [0084.405] SetErrorMode (uMode=0x0) returned 0x1 [0084.406] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\is2fbgoyb_drve2 p.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\Is2FbGOyb_drVe2 P.doc.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\is2fbgoyb_drve2 p.doc.lanran2.0.5")) returned 1 [0084.406] GetLastError () returned 0xb7 [0084.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls", lpFilePart=0x0) returned 0x4f [0084.406] GetLastError () returned 0xb7 [0084.406] SetErrorMode (uMode=0x1) returned 0x0 [0084.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\lwxjfvxbet 7vcegygl.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.406] GetLastError () returned 0x0 [0084.406] GetFileType (hFile=0x214) returned 0x1 [0084.406] SetErrorMode (uMode=0x0) returned 0x1 [0084.406] GetFileType (hFile=0x214) returned 0x1 [0084.407] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ec10 | out: lpFileSizeHigh=0x39ec10*=0x0) returned 0xc8e4 [0084.407] GetLastError () returned 0x0 [0084.407] ReadFile (in: hFile=0x214, lpBuffer=0x251361c, nNumberOfBytesToRead=0xc8e4, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x251361c*, lpNumberOfBytesRead=0x39ebb8*=0xc8e4, lpOverlapped=0x0) returned 1 [0084.407] GetLastError () returned 0x0 [0084.407] CloseHandle (hObject=0x214) returned 1 [0084.407] GetLastError () returned 0x0 [0084.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls", lpFilePart=0x0) returned 0x4f [0084.456] GetLastError () returned 0x0 [0084.456] SetErrorMode (uMode=0x1) returned 0x0 [0084.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\lwxjfvxbet 7vcegygl.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.457] GetLastError () returned 0xb7 [0084.457] GetFileType (hFile=0x214) returned 0x1 [0084.457] GetFileType (hFile=0x214) returned 0x1 [0084.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls", lpFilePart=0x0) returned 0x4f [0084.458] GetLastError () returned 0xb7 [0084.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls.LanRan2.0.5", lpFilePart=0x0) returned 0x5b [0084.458] GetLastError () returned 0xb7 [0084.458] SetErrorMode (uMode=0x1) returned 0x0 [0084.458] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\lwxjfvxbet 7vcegygl.xls"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c5ddce0, ftCreationTime.dwHighDateTime=0x1d3ae71, ftLastAccessTime.dwLowDateTime=0xeb7bb670, ftLastAccessTime.dwHighDateTime=0x1d3a12d, ftLastWriteTime.dwLowDateTime=0x12d5f40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xc8f0)) returned 1 [0084.458] GetLastError () returned 0xb7 [0084.458] SetErrorMode (uMode=0x0) returned 0x1 [0084.458] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\lwxjfvxbet 7vcegygl.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\lwxjfVxbeT 7vCeGygl.xls.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\lwxjfvxbet 7vcegygl.xls.lanran2.0.5")) returned 1 [0084.459] GetLastError () returned 0xb7 [0084.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc", lpFilePart=0x0) returned 0x4e [0084.459] GetLastError () returned 0xb7 [0084.459] SetErrorMode (uMode=0x1) returned 0x0 [0084.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\uuqj2vsov--zktoa9e.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.459] GetLastError () returned 0x0 [0084.459] GetFileType (hFile=0x214) returned 0x1 [0084.459] GetFileType (hFile=0x214) returned 0x1 [0084.459] ReadFile (in: hFile=0x214, lpBuffer=0x25cdce0, nNumberOfBytesToRead=0x1a59, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x25cdce0*, lpNumberOfBytesRead=0x39ebb8*=0x1a59, lpOverlapped=0x0) returned 1 [0084.460] GetLastError () returned 0x0 [0084.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc", lpFilePart=0x0) returned 0x4e [0084.477] GetLastError () returned 0x0 [0084.477] SetErrorMode (uMode=0x1) returned 0x0 [0084.477] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\uuqj2vsov--zktoa9e.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.477] GetLastError () returned 0xb7 [0084.477] GetFileType (hFile=0x214) returned 0x1 [0084.477] GetFileType (hFile=0x214) returned 0x1 [0084.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc", lpFilePart=0x0) returned 0x4e [0084.478] GetLastError () returned 0xb7 [0084.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc.LanRan2.0.5", lpFilePart=0x0) returned 0x5a [0084.478] GetLastError () returned 0xb7 [0084.478] SetErrorMode (uMode=0x1) returned 0x0 [0084.478] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\uuqj2vsov--zktoa9e.doc"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec817740, ftCreationTime.dwHighDateTime=0x1d3a50a, ftLastAccessTime.dwLowDateTime=0x54ae98b0, ftLastAccessTime.dwHighDateTime=0x1d3a5f7, ftLastWriteTime.dwLowDateTime=0x12fc0a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x1a60)) returned 1 [0084.478] GetLastError () returned 0xb7 [0084.478] SetErrorMode (uMode=0x0) returned 0x1 [0084.478] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\uuqj2vsov--zktoa9e.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\UuQJ2vSOV--ZKtOA9E.doc.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\uuqj2vsov--zktoa9e.doc.lanran2.0.5")) returned 1 [0084.479] GetLastError () returned 0xb7 [0084.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx", lpFilePart=0x0) returned 0x43 [0084.479] GetLastError () returned 0xb7 [0084.479] SetErrorMode (uMode=0x1) returned 0x0 [0084.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\vcksfe.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.479] GetLastError () returned 0x0 [0084.479] GetFileType (hFile=0x214) returned 0x1 [0084.479] GetFileType (hFile=0x214) returned 0x1 [0084.479] ReadFile (in: hFile=0x214, lpBuffer=0x3744068, nNumberOfBytesToRead=0x15766, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x3744068*, lpNumberOfBytesRead=0x39ebb8*=0x15766, lpOverlapped=0x0) returned 1 [0084.480] GetLastError () returned 0x0 [0084.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx", lpFilePart=0x0) returned 0x43 [0084.515] GetLastError () returned 0x0 [0084.515] SetErrorMode (uMode=0x1) returned 0x0 [0084.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\vcksfe.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.516] GetLastError () returned 0xb7 [0084.516] GetFileType (hFile=0x214) returned 0x1 [0084.516] SetErrorMode (uMode=0x0) returned 0x1 [0084.516] GetFileType (hFile=0x214) returned 0x1 [0084.516] WriteFile (in: hFile=0x214, lpBuffer=0x3496de0*, nNumberOfBytesToWrite=0x15770, lpNumberOfBytesWritten=0x39ebc4, lpOverlapped=0x0 | out: lpBuffer=0x3496de0*, lpNumberOfBytesWritten=0x39ebc4*=0x15770, lpOverlapped=0x0) returned 1 [0084.517] GetLastError () returned 0xb7 [0084.518] CloseHandle (hObject=0x214) returned 1 [0084.519] GetLastError () returned 0xb7 [0084.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx", lpFilePart=0x0) returned 0x43 [0084.519] GetLastError () returned 0xb7 [0084.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx.LanRan2.0.5", lpFilePart=0x0) returned 0x4f [0084.519] GetLastError () returned 0xb7 [0084.519] SetErrorMode (uMode=0x1) returned 0x0 [0084.519] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\vcksfe.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5ee9530, ftCreationTime.dwHighDateTime=0x1d3abcf, ftLastAccessTime.dwLowDateTime=0xacc6f00, ftLastAccessTime.dwHighDateTime=0x1d3aff3, ftLastWriteTime.dwLowDateTime=0x136e4c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x15770)) returned 1 [0084.519] GetLastError () returned 0xb7 [0084.519] SetErrorMode (uMode=0x0) returned 0x1 [0084.519] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\vcksfe.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\VCkSFE.xlsx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\vcksfe.xlsx.lanran2.0.5")) returned 1 [0084.520] GetLastError () returned 0xb7 [0084.520] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO", lpFilePart=0x0) returned 0x4a [0084.520] GetLastError () returned 0xb7 [0084.520] SetErrorMode (uMode=0x1) returned 0x0 [0084.520] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570 [0084.520] GetLastError () returned 0xb7 [0084.521] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.521] GetLastError () returned 0xb7 [0084.521] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.521] GetLastError () returned 0xb7 [0084.521] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.521] GetLastError () returned 0xb7 [0084.521] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.521] GetLastError () returned 0xb7 [0084.521] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.521] GetLastError () returned 0xb7 [0084.522] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.522] GetLastError () returned 0xb7 [0084.522] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.522] GetLastError () returned 0xb7 [0084.522] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.522] GetLastError () returned 0xb7 [0084.522] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0084.522] GetLastError () returned 0x12 [0084.522] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1 [0084.523] SetErrorMode (uMode=0x0) returned 0x1 [0084.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO", lpFilePart=0x0) returned 0x4a [0084.523] GetLastError () returned 0x12 [0084.523] SetErrorMode (uMode=0x1) returned 0x0 [0084.523] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570 [0084.523] GetLastError () returned 0x12 [0084.523] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.523] GetLastError () returned 0x12 [0084.523] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.523] GetLastError () returned 0x12 [0084.524] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.524] GetLastError () returned 0x12 [0084.524] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.524] GetLastError () returned 0x12 [0084.524] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.524] GetLastError () returned 0x12 [0084.524] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.524] GetLastError () returned 0x12 [0084.524] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.524] GetLastError () returned 0x12 [0084.525] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.525] GetLastError () returned 0x12 [0084.525] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0084.525] GetLastError () returned 0x12 [0084.525] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1 [0084.525] SetErrorMode (uMode=0x0) returned 0x1 [0084.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls", lpFilePart=0x0) returned 0x61 [0084.525] GetLastError () returned 0x12 [0084.525] SetErrorMode (uMode=0x1) returned 0x0 [0084.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\9x4ox9zi66worq566n.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.526] GetLastError () returned 0x0 [0084.526] GetFileType (hFile=0x214) returned 0x1 [0084.526] SetErrorMode (uMode=0x0) returned 0x1 [0084.526] GetFileType (hFile=0x214) returned 0x1 [0084.526] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0x15590 [0084.526] GetLastError () returned 0x0 [0084.527] ReadFile (in: hFile=0x214, lpBuffer=0x34ac570, nNumberOfBytesToRead=0x15590, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x34ac570*, lpNumberOfBytesRead=0x39eb58*=0x15590, lpOverlapped=0x0) returned 1 [0084.528] GetLastError () returned 0x0 [0084.528] CloseHandle (hObject=0x214) returned 1 [0084.528] GetLastError () returned 0x0 [0084.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls", lpFilePart=0x0) returned 0x61 [0084.608] GetLastError () returned 0x0 [0084.608] SetErrorMode (uMode=0x1) returned 0x0 [0084.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\9x4ox9zi66worq566n.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.609] GetLastError () returned 0xb7 [0084.609] GetFileType (hFile=0x214) returned 0x1 [0084.610] GetFileType (hFile=0x214) returned 0x1 [0084.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls", lpFilePart=0x0) returned 0x61 [0084.611] GetLastError () returned 0xb7 [0084.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls.LanRan2.0.5", lpFilePart=0x0) returned 0x6d [0084.611] GetLastError () returned 0xb7 [0084.611] SetErrorMode (uMode=0x1) returned 0x0 [0084.611] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\9x4ox9zi66worq566n.xls"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6fde9b0, ftCreationTime.dwHighDateTime=0x1d3a8bf, ftLastAccessTime.dwLowDateTime=0xf64b85e0, ftLastAccessTime.dwHighDateTime=0x1d3a406, ftLastWriteTime.dwLowDateTime=0x1452d00, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x155a0)) returned 1 [0084.611] GetLastError () returned 0xb7 [0084.611] SetErrorMode (uMode=0x0) returned 0x1 [0084.612] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\9x4ox9zi66worq566n.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\9x4Ox9Zi66WORq566n.xls.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\9x4ox9zi66worq566n.xls.lanran2.0.5")) returned 1 [0084.612] GetLastError () returned 0xb7 [0084.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt", lpFilePart=0x0) returned 0x5a [0084.612] GetLastError () returned 0xb7 [0084.612] SetErrorMode (uMode=0x1) returned 0x0 [0084.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\mxzhtw exvo.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.612] GetLastError () returned 0x0 [0084.612] GetFileType (hFile=0x214) returned 0x1 [0084.612] GetFileType (hFile=0x214) returned 0x1 [0084.612] ReadFile (in: hFile=0x214, lpBuffer=0x25449f4, nNumberOfBytesToRead=0x10c7d, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25449f4*, lpNumberOfBytesRead=0x39eb58*=0x10c7d, lpOverlapped=0x0) returned 1 [0084.613] GetLastError () returned 0x0 [0084.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt", lpFilePart=0x0) returned 0x5a [0084.647] GetLastError () returned 0x0 [0084.647] SetErrorMode (uMode=0x1) returned 0x0 [0084.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\mxzhtw exvo.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.648] GetLastError () returned 0xb7 [0084.648] GetFileType (hFile=0x214) returned 0x1 [0084.649] GetFileType (hFile=0x214) returned 0x1 [0084.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt", lpFilePart=0x0) returned 0x5a [0084.650] GetLastError () returned 0xb7 [0084.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt.LanRan2.0.5", lpFilePart=0x0) returned 0x66 [0084.650] GetLastError () returned 0xb7 [0084.650] SetErrorMode (uMode=0x1) returned 0x0 [0084.650] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\mxzhtw exvo.odt"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10a9b160, ftCreationTime.dwHighDateTime=0x1d3b013, ftLastAccessTime.dwLowDateTime=0xb2968ac0, ftLastAccessTime.dwHighDateTime=0x1d3ab9a, ftLastWriteTime.dwLowDateTime=0x149efc0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x10c80)) returned 1 [0084.650] GetLastError () returned 0xb7 [0084.650] SetErrorMode (uMode=0x0) returned 0x1 [0084.650] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\mxzhtw exvo.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\mxzhTw EXVo.odt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\mxzhtw exvo.odt.lanran2.0.5")) returned 1 [0084.651] GetLastError () returned 0xb7 [0084.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc", lpFilePart=0x0) returned 0x58 [0084.651] GetLastError () returned 0xb7 [0084.651] SetErrorMode (uMode=0x1) returned 0x0 [0084.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\qcfc96mjr.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.651] GetLastError () returned 0x0 [0084.651] GetFileType (hFile=0x214) returned 0x1 [0084.651] GetFileType (hFile=0x214) returned 0x1 [0084.652] ReadFile (in: hFile=0x214, lpBuffer=0x354e080, nNumberOfBytesToRead=0x18855, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x354e080*, lpNumberOfBytesRead=0x39eb58*=0x18855, lpOverlapped=0x0) returned 1 [0084.653] GetLastError () returned 0x0 [0084.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc", lpFilePart=0x0) returned 0x58 [0084.681] GetLastError () returned 0x0 [0084.681] SetErrorMode (uMode=0x1) returned 0x0 [0084.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\qcfc96mjr.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.682] GetLastError () returned 0xb7 [0084.682] GetFileType (hFile=0x214) returned 0x1 [0084.682] GetFileType (hFile=0x214) returned 0x1 [0084.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc", lpFilePart=0x0) returned 0x58 [0084.684] GetLastError () returned 0xb7 [0084.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc.LanRan2.0.5", lpFilePart=0x0) returned 0x64 [0084.684] GetLastError () returned 0xb7 [0084.684] SetErrorMode (uMode=0x1) returned 0x0 [0084.684] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\qcfc96mjr.doc"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbc95710, ftCreationTime.dwHighDateTime=0x1d3a40e, ftLastAccessTime.dwLowDateTime=0x8ba4ef20, ftLastAccessTime.dwHighDateTime=0x1d3a72f, ftLastWriteTime.dwLowDateTime=0x15113e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x18860)) returned 1 [0084.684] GetLastError () returned 0xb7 [0084.684] SetErrorMode (uMode=0x0) returned 0x1 [0084.684] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\qcfc96mjr.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\QcfC96Mjr.doc.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\qcfc96mjr.doc.lanran2.0.5")) returned 1 [0084.685] GetLastError () returned 0xb7 [0084.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6", lpFilePart=0x0) returned 0x5e [0084.685] GetLastError () returned 0xb7 [0084.685] SetErrorMode (uMode=0x1) returned 0x0 [0084.685] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3b0 [0084.685] GetLastError () returned 0xb7 [0084.685] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.685] GetLastError () returned 0xb7 [0084.685] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.685] GetLastError () returned 0xb7 [0084.686] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.686] GetLastError () returned 0xb7 [0084.686] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.686] GetLastError () returned 0xb7 [0084.686] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0084.686] GetLastError () returned 0x12 [0084.686] FindClose (in: hFindFile=0x42c3b0 | out: hFindFile=0x42c3b0) returned 1 [0084.686] SetErrorMode (uMode=0x0) returned 0x1 [0084.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6", lpFilePart=0x0) returned 0x5e [0084.686] GetLastError () returned 0x12 [0084.686] SetErrorMode (uMode=0x1) returned 0x0 [0084.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3b0 [0084.686] GetLastError () returned 0x12 [0084.686] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.686] GetLastError () returned 0x12 [0084.686] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.686] GetLastError () returned 0x12 [0084.686] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.686] GetLastError () returned 0x12 [0084.687] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.687] GetLastError () returned 0x12 [0084.687] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0084.687] GetLastError () returned 0x12 [0084.687] FindClose (in: hFindFile=0x42c3b0 | out: hFindFile=0x42c3b0) returned 1 [0084.687] SetErrorMode (uMode=0x0) returned 0x1 [0084.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf", lpFilePart=0x0) returned 0x72 [0084.687] GetLastError () returned 0x12 [0084.687] SetErrorMode (uMode=0x1) returned 0x0 [0084.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\7mo7p2ajxryjr9e.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.687] GetLastError () returned 0x0 [0084.687] GetFileType (hFile=0x214) returned 0x1 [0084.687] SetErrorMode (uMode=0x0) returned 0x1 [0084.687] GetFileType (hFile=0x214) returned 0x1 [0084.687] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39eb50 | out: lpFileSizeHigh=0x39eb50*=0x0) returned 0x142f1 [0084.688] GetLastError () returned 0x0 [0084.688] ReadFile (in: hFile=0x214, lpBuffer=0x2699764, nNumberOfBytesToRead=0x142f1, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x2699764*, lpNumberOfBytesRead=0x39eaf8*=0x142f1, lpOverlapped=0x0) returned 1 [0084.688] GetLastError () returned 0x0 [0084.689] CloseHandle (hObject=0x214) returned 1 [0084.689] GetLastError () returned 0x0 [0084.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf", lpFilePart=0x0) returned 0x72 [0084.747] GetLastError () returned 0x0 [0084.747] SetErrorMode (uMode=0x1) returned 0x0 [0084.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\7mo7p2ajxryjr9e.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.748] GetLastError () returned 0xb7 [0084.748] GetFileType (hFile=0x214) returned 0x1 [0084.748] GetFileType (hFile=0x214) returned 0x1 [0084.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf", lpFilePart=0x0) returned 0x72 [0084.749] GetLastError () returned 0xb7 [0084.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf.LanRan2.0.5", lpFilePart=0x0) returned 0x7e [0084.749] GetLastError () returned 0xb7 [0084.749] SetErrorMode (uMode=0x1) returned 0x0 [0084.749] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\7mo7p2ajxryjr9e.rtf"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e4b1620, ftCreationTime.dwHighDateTime=0x1d3a899, ftLastAccessTime.dwLowDateTime=0x7684afe0, ftLastAccessTime.dwHighDateTime=0x1d3a653, ftLastWriteTime.dwLowDateTime=0x15a9960, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x14300)) returned 1 [0084.750] GetLastError () returned 0xb7 [0084.750] SetErrorMode (uMode=0x0) returned 0x1 [0084.750] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\7mo7p2ajxryjr9e.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\7Mo7p2ajXrYJR9E.rtf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\7mo7p2ajxryjr9e.rtf.lanran2.0.5")) returned 1 [0084.750] GetLastError () returned 0xb7 [0084.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf", lpFilePart=0x0) returned 0x6d [0084.750] GetLastError () returned 0xb7 [0084.750] SetErrorMode (uMode=0x1) returned 0x0 [0084.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\vhpzchnm-9.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.750] GetLastError () returned 0x0 [0084.750] GetFileType (hFile=0x214) returned 0x1 [0084.750] SetErrorMode (uMode=0x0) returned 0x1 [0084.750] GetFileType (hFile=0x214) returned 0x1 [0084.750] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39eb50 | out: lpFileSizeHigh=0x39eb50*=0x0) returned 0x9263 [0084.750] GetLastError () returned 0x0 [0084.750] ReadFile (in: hFile=0x214, lpBuffer=0x2587564, nNumberOfBytesToRead=0x9263, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x2587564*, lpNumberOfBytesRead=0x39eaf8*=0x9263, lpOverlapped=0x0) returned 1 [0084.751] GetLastError () returned 0x0 [0084.751] CloseHandle (hObject=0x214) returned 1 [0084.751] GetLastError () returned 0x0 [0084.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf", lpFilePart=0x0) returned 0x6d [0084.817] GetLastError () returned 0x0 [0084.817] SetErrorMode (uMode=0x1) returned 0x0 [0084.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\vhpzchnm-9.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.826] GetLastError () returned 0xb7 [0084.826] GetFileType (hFile=0x214) returned 0x1 [0084.826] GetFileType (hFile=0x214) returned 0x1 [0084.832] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf", lpFilePart=0x0) returned 0x6d [0084.832] GetLastError () returned 0xb7 [0084.832] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf.LanRan2.0.5", lpFilePart=0x0) returned 0x79 [0084.832] GetLastError () returned 0xb7 [0084.832] SetErrorMode (uMode=0x1) returned 0x0 [0084.832] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\vhpzchnm-9.pdf"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dc68ea0, ftCreationTime.dwHighDateTime=0x1d3a6c4, ftLastAccessTime.dwLowDateTime=0xc90cdd00, ftLastAccessTime.dwHighDateTime=0x1d3abda, ftLastWriteTime.dwLowDateTime=0x1668040, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x9270)) returned 1 [0084.832] GetLastError () returned 0xb7 [0084.832] SetErrorMode (uMode=0x0) returned 0x1 [0084.832] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\vhpzchnm-9.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\gfYOriKcxDMvbjAlTO\\Zx_H419X-lWtnXsKpv6\\vHPzCHNm-9.pdf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\gfyorikcxdmvbjalto\\zx_h419x-lwtnxskpv6\\vhpzchnm-9.pdf.lanran2.0.5")) returned 1 [0084.832] GetLastError () returned 0xb7 [0084.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44", lpFilePart=0x0) returned 0x47 [0084.833] GetLastError () returned 0xb7 [0084.833] SetErrorMode (uMode=0x1) returned 0x0 [0084.833] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0 [0084.833] GetLastError () returned 0xb7 [0084.833] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.833] GetLastError () returned 0xb7 [0084.833] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.833] GetLastError () returned 0xb7 [0084.833] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.833] GetLastError () returned 0xb7 [0084.833] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.833] GetLastError () returned 0xb7 [0084.833] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.833] GetLastError () returned 0xb7 [0084.833] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.833] GetLastError () returned 0xb7 [0084.833] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.834] GetLastError () returned 0xb7 [0084.834] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.834] GetLastError () returned 0xb7 [0084.834] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0084.834] GetLastError () returned 0x12 [0084.834] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1 [0084.834] SetErrorMode (uMode=0x0) returned 0x1 [0084.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44", lpFilePart=0x0) returned 0x47 [0084.834] GetLastError () returned 0x12 [0084.834] SetErrorMode (uMode=0x1) returned 0x0 [0084.834] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0 [0084.834] GetLastError () returned 0x12 [0084.834] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.834] GetLastError () returned 0x12 [0084.834] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.834] GetLastError () returned 0x12 [0084.835] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.835] GetLastError () returned 0x12 [0084.835] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.835] GetLastError () returned 0x12 [0084.835] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.835] GetLastError () returned 0x12 [0084.835] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.835] GetLastError () returned 0x12 [0084.835] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.835] GetLastError () returned 0x12 [0084.835] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.835] GetLastError () returned 0x12 [0084.835] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0084.835] GetLastError () returned 0x12 [0084.835] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1 [0084.835] SetErrorMode (uMode=0x0) returned 0x1 [0084.835] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx", lpFilePart=0x0) returned 0x52 [0084.835] GetLastError () returned 0x12 [0084.835] SetErrorMode (uMode=0x1) returned 0x0 [0084.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\hlmh4.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.836] GetLastError () returned 0x0 [0084.836] GetFileType (hFile=0x214) returned 0x1 [0084.836] GetFileType (hFile=0x214) returned 0x1 [0084.836] ReadFile (in: hFile=0x214, lpBuffer=0x3609918, nNumberOfBytesToRead=0x160c3, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x3609918*, lpNumberOfBytesRead=0x39eb58*=0x160c3, lpOverlapped=0x0) returned 1 [0084.837] GetLastError () returned 0x0 [0084.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx", lpFilePart=0x0) returned 0x52 [0084.881] GetLastError () returned 0x0 [0084.881] SetErrorMode (uMode=0x1) returned 0x0 [0084.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\hlmh4.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.882] GetLastError () returned 0xb7 [0084.882] GetFileType (hFile=0x214) returned 0x1 [0084.882] SetErrorMode (uMode=0x0) returned 0x1 [0084.882] GetFileType (hFile=0x214) returned 0x1 [0084.884] CloseHandle (hObject=0x214) returned 1 [0084.884] GetLastError () returned 0xb7 [0084.884] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx", lpFilePart=0x0) returned 0x52 [0084.884] GetLastError () returned 0xb7 [0084.884] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx.LanRan2.0.5", lpFilePart=0x0) returned 0x5e [0084.884] GetLastError () returned 0xb7 [0084.884] SetErrorMode (uMode=0x1) returned 0x0 [0084.884] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\hlmh4.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4920d10, ftCreationTime.dwHighDateTime=0x1d3ab6e, ftLastAccessTime.dwLowDateTime=0xb2fe4de0, ftLastAccessTime.dwHighDateTime=0x1d3ab45, ftLastWriteTime.dwLowDateTime=0x16da460, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x160d0)) returned 1 [0084.884] GetLastError () returned 0xb7 [0084.884] SetErrorMode (uMode=0x0) returned 0x1 [0084.884] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\hlmh4.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\HLmH4.xlsx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\hlmh4.xlsx.lanran2.0.5")) returned 1 [0084.885] GetLastError () returned 0xb7 [0084.885] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf", lpFilePart=0x0) returned 0x50 [0084.885] GetLastError () returned 0xb7 [0084.885] SetErrorMode (uMode=0x1) returned 0x0 [0084.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\jdzs.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.885] GetLastError () returned 0x0 [0084.885] GetFileType (hFile=0x214) returned 0x1 [0084.885] SetErrorMode (uMode=0x0) returned 0x1 [0084.885] GetFileType (hFile=0x214) returned 0x1 [0084.885] ReadFile (in: hFile=0x214, lpBuffer=0x24d0e84, nNumberOfBytesToRead=0x1d1c, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x24d0e84*, lpNumberOfBytesRead=0x39eb58*=0x1d1c, lpOverlapped=0x0) returned 1 [0084.886] GetLastError () returned 0x0 [0084.886] CloseHandle (hObject=0x214) returned 1 [0084.886] GetLastError () returned 0x0 [0084.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf", lpFilePart=0x0) returned 0x50 [0084.931] GetLastError () returned 0x0 [0084.931] SetErrorMode (uMode=0x1) returned 0x0 [0084.931] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\jdzs.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.931] GetLastError () returned 0xb7 [0084.931] GetFileType (hFile=0x214) returned 0x1 [0084.931] GetFileType (hFile=0x214) returned 0x1 [0084.932] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf", lpFilePart=0x0) returned 0x50 [0084.932] GetLastError () returned 0xb7 [0084.932] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf.LanRan2.0.5", lpFilePart=0x0) returned 0x5c [0084.932] GetLastError () returned 0xb7 [0084.932] SetErrorMode (uMode=0x1) returned 0x0 [0084.932] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\jdzs.rtf"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58ccaf70, ftCreationTime.dwHighDateTime=0x1d3a5d6, ftLastAccessTime.dwLowDateTime=0x30d6bda0, ftLastAccessTime.dwHighDateTime=0x1d3ad68, ftLastWriteTime.dwLowDateTime=0x174c880, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x1d20)) returned 1 [0084.932] GetLastError () returned 0xb7 [0084.932] SetErrorMode (uMode=0x0) returned 0x1 [0084.932] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\jdzs.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\JdZs.rtf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\jdzs.rtf.lanran2.0.5")) returned 1 [0084.933] GetLastError () returned 0xb7 [0084.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf", lpFilePart=0x0) returned 0x5b [0084.933] GetLastError () returned 0xb7 [0084.933] SetErrorMode (uMode=0x1) returned 0x0 [0084.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\kmqwqfsabihhi9p.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.933] GetLastError () returned 0x0 [0084.933] GetFileType (hFile=0x214) returned 0x1 [0084.933] GetFileType (hFile=0x214) returned 0x1 [0084.933] ReadFile (in: hFile=0x214, lpBuffer=0x2564038, nNumberOfBytesToRead=0x1057f, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x2564038*, lpNumberOfBytesRead=0x39eb58*=0x1057f, lpOverlapped=0x0) returned 1 [0084.934] GetLastError () returned 0x0 [0084.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf", lpFilePart=0x0) returned 0x5b [0084.951] GetLastError () returned 0x0 [0084.951] SetErrorMode (uMode=0x1) returned 0x0 [0084.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\kmqwqfsabihhi9p.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.952] GetLastError () returned 0xb7 [0084.952] GetFileType (hFile=0x214) returned 0x1 [0084.952] GetFileType (hFile=0x214) returned 0x1 [0084.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf", lpFilePart=0x0) returned 0x5b [0084.953] GetLastError () returned 0xb7 [0084.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf.LanRan2.0.5", lpFilePart=0x0) returned 0x67 [0084.953] GetLastError () returned 0xb7 [0084.953] SetErrorMode (uMode=0x1) returned 0x0 [0084.953] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\kmqwqfsabihhi9p.pdf"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7f0c8f0, ftCreationTime.dwHighDateTime=0x1d3a59c, ftLastAccessTime.dwLowDateTime=0x9c4dd7d0, ftLastAccessTime.dwHighDateTime=0x1d3ab10, ftLastWriteTime.dwLowDateTime=0x1798b40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x10580)) returned 1 [0084.953] GetLastError () returned 0xb7 [0084.953] SetErrorMode (uMode=0x0) returned 0x1 [0084.953] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\kmqwqfsabihhi9p.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\KMqWQFsAbIhhI9P.pdf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\kmqwqfsabihhi9p.pdf.lanran2.0.5")) returned 1 [0084.954] GetLastError () returned 0xb7 [0084.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV", lpFilePart=0x0) returned 0x55 [0084.954] GetLastError () returned 0xb7 [0084.954] SetErrorMode (uMode=0x1) returned 0x0 [0084.954] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270 [0084.954] GetLastError () returned 0xb7 [0084.954] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.954] GetLastError () returned 0xb7 [0084.954] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.954] GetLastError () returned 0xb7 [0084.954] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.954] GetLastError () returned 0xb7 [0084.954] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0084.954] GetLastError () returned 0x12 [0084.954] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1 [0084.954] SetErrorMode (uMode=0x0) returned 0x1 [0084.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV", lpFilePart=0x0) returned 0x55 [0084.954] GetLastError () returned 0x12 [0084.954] SetErrorMode (uMode=0x1) returned 0x0 [0084.955] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270 [0084.955] GetLastError () returned 0x12 [0084.955] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.955] GetLastError () returned 0x12 [0084.955] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.955] GetLastError () returned 0x12 [0084.955] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0084.955] GetLastError () returned 0x12 [0084.955] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0084.955] GetLastError () returned 0x12 [0084.955] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1 [0084.955] SetErrorMode (uMode=0x0) returned 0x1 [0084.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf", lpFilePart=0x0) returned 0x6a [0084.955] GetLastError () returned 0x12 [0084.955] SetErrorMode (uMode=0x1) returned 0x0 [0084.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\68pvefv6kr3oep2i.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0084.955] GetLastError () returned 0x0 [0084.955] GetFileType (hFile=0x214) returned 0x1 [0084.955] SetErrorMode (uMode=0x0) returned 0x1 [0084.955] GetFileType (hFile=0x214) returned 0x1 [0084.955] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39eb50 | out: lpFileSizeHigh=0x39eb50*=0x0) returned 0x162e9 [0084.955] GetLastError () returned 0x0 [0084.956] ReadFile (in: hFile=0x214, lpBuffer=0x36ae948, nNumberOfBytesToRead=0x162e9, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x36ae948*, lpNumberOfBytesRead=0x39eaf8*=0x162e9, lpOverlapped=0x0) returned 1 [0084.957] GetLastError () returned 0x0 [0084.957] CloseHandle (hObject=0x214) returned 1 [0084.957] GetLastError () returned 0x0 [0085.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf", lpFilePart=0x0) returned 0x6a [0085.002] GetLastError () returned 0x0 [0085.002] SetErrorMode (uMode=0x1) returned 0x0 [0085.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\68pvefv6kr3oep2i.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.003] GetLastError () returned 0xb7 [0085.003] GetFileType (hFile=0x214) returned 0x1 [0085.003] GetFileType (hFile=0x214) returned 0x1 [0085.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf", lpFilePart=0x0) returned 0x6a [0085.005] GetLastError () returned 0xb7 [0085.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf.LanRan2.0.5", lpFilePart=0x0) returned 0x76 [0085.005] GetLastError () returned 0xb7 [0085.005] SetErrorMode (uMode=0x1) returned 0x0 [0085.005] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\68pvefv6kr3oep2i.pdf"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x115bcd30, ftCreationTime.dwHighDateTime=0x1d3a4f8, ftLastAccessTime.dwLowDateTime=0x987d5c30, ftLastAccessTime.dwHighDateTime=0x1d3a0ba, ftLastWriteTime.dwLowDateTime=0x180af60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x162f0)) returned 1 [0085.005] GetLastError () returned 0xb7 [0085.005] SetErrorMode (uMode=0x0) returned 0x1 [0085.005] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\68pvefv6kr3oep2i.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\68pVeFV6kR3OEP2I.pdf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\68pvefv6kr3oep2i.pdf.lanran2.0.5")) returned 1 [0085.005] GetLastError () returned 0xb7 [0085.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu", lpFilePart=0x0) returned 0x65 [0085.005] GetLastError () returned 0xb7 [0085.005] SetErrorMode (uMode=0x1) returned 0x0 [0085.005] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0085.006] GetLastError () returned 0xb7 [0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.006] GetLastError () returned 0xb7 [0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.006] GetLastError () returned 0xb7 [0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.006] GetLastError () returned 0xb7 [0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.006] GetLastError () returned 0xb7 [0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.006] GetLastError () returned 0xb7 [0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.006] GetLastError () returned 0xb7 [0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.006] GetLastError () returned 0xb7 [0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0085.006] GetLastError () returned 0x12 [0085.006] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0085.006] SetErrorMode (uMode=0x0) returned 0x1 [0085.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu", lpFilePart=0x0) returned 0x65 [0085.006] GetLastError () returned 0x12 [0085.006] SetErrorMode (uMode=0x1) returned 0x0 [0085.006] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0085.006] GetLastError () returned 0x12 [0085.006] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.006] GetLastError () returned 0x12 [0085.007] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.007] GetLastError () returned 0x12 [0085.007] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.007] GetLastError () returned 0x12 [0085.007] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.007] GetLastError () returned 0x12 [0085.007] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.007] GetLastError () returned 0x12 [0085.007] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.007] GetLastError () returned 0x12 [0085.007] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.007] GetLastError () returned 0x12 [0085.007] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0085.007] GetLastError () returned 0x12 [0085.007] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0085.007] SetErrorMode (uMode=0x0) returned 0x1 [0085.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx", lpFilePart=0x0) returned 0x7d [0085.007] GetLastError () returned 0x12 [0085.007] SetErrorMode (uMode=0x1) returned 0x0 [0085.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\8frj-ri0s0j5l0bnl0.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.007] GetLastError () returned 0x0 [0085.007] GetFileType (hFile=0x214) returned 0x1 [0085.007] GetFileType (hFile=0x214) returned 0x1 [0085.007] ReadFile (in: hFile=0x214, lpBuffer=0x26b8f78, nNumberOfBytesToRead=0xc23b, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x26b8f78*, lpNumberOfBytesRead=0x39ea98*=0xc23b, lpOverlapped=0x0) returned 1 [0085.008] GetLastError () returned 0x0 [0085.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx", lpFilePart=0x0) returned 0x7d [0085.057] GetLastError () returned 0x0 [0085.057] SetErrorMode (uMode=0x1) returned 0x0 [0085.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\8frj-ri0s0j5l0bnl0.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.058] GetLastError () returned 0xb7 [0085.058] GetFileType (hFile=0x214) returned 0x1 [0085.058] GetFileType (hFile=0x214) returned 0x1 [0085.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx", lpFilePart=0x0) returned 0x7d [0085.059] GetLastError () returned 0xb7 [0085.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x89 [0085.059] GetLastError () returned 0xb7 [0085.059] SetErrorMode (uMode=0x1) returned 0x0 [0085.060] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\8frj-ri0s0j5l0bnl0.docx"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1a7f650, ftCreationTime.dwHighDateTime=0x1d3a97c, ftLastAccessTime.dwLowDateTime=0x32b93cb0, ftLastAccessTime.dwHighDateTime=0x1d3a309, ftLastWriteTime.dwLowDateTime=0x18a34e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xc240)) returned 1 [0085.060] GetLastError () returned 0xb7 [0085.060] SetErrorMode (uMode=0x0) returned 0x1 [0085.060] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\8frj-ri0s0j5l0bnl0.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\8frJ-ri0s0j5l0bnL0.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\8frj-ri0s0j5l0bnl0.docx.lanran2.0.5")) returned 1 [0085.060] GetLastError () returned 0xb7 [0085.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx", lpFilePart=0x0) returned 0x6f [0085.060] GetLastError () returned 0xb7 [0085.060] SetErrorMode (uMode=0x1) returned 0x0 [0085.060] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\sknb.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.060] GetLastError () returned 0x0 [0085.061] GetFileType (hFile=0x214) returned 0x1 [0085.061] GetFileType (hFile=0x214) returned 0x1 [0085.061] ReadFile (in: hFile=0x214, lpBuffer=0x257ea28, nNumberOfBytesToRead=0x207e, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x257ea28*, lpNumberOfBytesRead=0x39ea98*=0x207e, lpOverlapped=0x0) returned 1 [0085.061] GetLastError () returned 0x0 [0085.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx", lpFilePart=0x0) returned 0x6f [0085.086] GetLastError () returned 0x0 [0085.086] SetErrorMode (uMode=0x1) returned 0x0 [0085.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\sknb.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.087] GetLastError () returned 0xb7 [0085.087] GetFileType (hFile=0x214) returned 0x1 [0085.087] GetFileType (hFile=0x214) returned 0x1 [0085.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx", lpFilePart=0x0) returned 0x6f [0085.087] GetLastError () returned 0xb7 [0085.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x7b [0085.088] GetLastError () returned 0xb7 [0085.088] SetErrorMode (uMode=0x1) returned 0x0 [0085.088] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\sknb.docx"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a04c0, ftCreationTime.dwHighDateTime=0x1d3ae4b, ftLastAccessTime.dwLowDateTime=0xbdfa7a60, ftLastAccessTime.dwHighDateTime=0x1d3a650, ftLastWriteTime.dwLowDateTime=0x18c9640, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x2080)) returned 1 [0085.088] GetLastError () returned 0xb7 [0085.088] SetErrorMode (uMode=0x0) returned 0x1 [0085.088] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\sknb.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\sKNb.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\sknb.docx.lanran2.0.5")) returned 1 [0085.088] GetLastError () returned 0xb7 [0085.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc", lpFilePart=0x0) returned 0x77 [0085.088] GetLastError () returned 0xb7 [0085.088] SetErrorMode (uMode=0x1) returned 0x0 [0085.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\zks2iiid esy6.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.088] GetLastError () returned 0x0 [0085.089] GetFileType (hFile=0x214) returned 0x1 [0085.089] GetFileType (hFile=0x214) returned 0x1 [0085.089] ReadFile (in: hFile=0x214, lpBuffer=0x2613160, nNumberOfBytesToRead=0xa92a, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2613160*, lpNumberOfBytesRead=0x39ea98*=0xa92a, lpOverlapped=0x0) returned 1 [0085.089] GetLastError () returned 0x0 [0085.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc", lpFilePart=0x0) returned 0x77 [0085.115] GetLastError () returned 0x0 [0085.116] SetErrorMode (uMode=0x1) returned 0x0 [0085.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\zks2iiid esy6.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.116] GetLastError () returned 0xb7 [0085.117] GetFileType (hFile=0x214) returned 0x1 [0085.117] GetFileType (hFile=0x214) returned 0x1 [0085.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc", lpFilePart=0x0) returned 0x77 [0085.118] GetLastError () returned 0xb7 [0085.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc.LanRan2.0.5", lpFilePart=0x0) returned 0x83 [0085.118] GetLastError () returned 0xb7 [0085.118] SetErrorMode (uMode=0x1) returned 0x0 [0085.118] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\zks2iiid esy6.doc"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25616600, ftCreationTime.dwHighDateTime=0x1d3a516, ftLastAccessTime.dwLowDateTime=0xce5d3680, ftLastAccessTime.dwHighDateTime=0x1d3ac9b, ftLastWriteTime.dwLowDateTime=0x1915900, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xa930)) returned 1 [0085.118] GetLastError () returned 0xb7 [0085.118] SetErrorMode (uMode=0x0) returned 0x1 [0085.118] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\zks2iiid esy6.doc"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\Cuoac7Cx20oxV\\A21mp_0hc61caIu\\zKs2Iiid ESy6.doc.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\cuoac7cx20oxv\\a21mp_0hc61caiu\\zks2iiid esy6.doc.lanran2.0.5")) returned 1 [0085.118] GetLastError () returned 0xb7 [0085.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x", lpFilePart=0x0) returned 0x4e [0085.118] GetLastError () returned 0xb7 [0085.118] SetErrorMode (uMode=0x1) returned 0x0 [0085.119] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0085.119] GetLastError () returned 0xb7 [0085.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.119] GetLastError () returned 0xb7 [0085.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.119] GetLastError () returned 0xb7 [0085.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.119] GetLastError () returned 0xb7 [0085.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.119] GetLastError () returned 0xb7 [0085.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.119] GetLastError () returned 0xb7 [0085.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.119] GetLastError () returned 0xb7 [0085.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0085.119] GetLastError () returned 0x12 [0085.119] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0085.119] SetErrorMode (uMode=0x0) returned 0x1 [0085.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x", lpFilePart=0x0) returned 0x4e [0085.119] GetLastError () returned 0x12 [0085.119] SetErrorMode (uMode=0x1) returned 0x0 [0085.119] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0085.120] GetLastError () returned 0x12 [0085.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.120] GetLastError () returned 0x12 [0085.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.120] GetLastError () returned 0x12 [0085.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.120] GetLastError () returned 0x12 [0085.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.120] GetLastError () returned 0x12 [0085.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.120] GetLastError () returned 0x12 [0085.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.120] GetLastError () returned 0x12 [0085.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0085.120] GetLastError () returned 0x12 [0085.120] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0085.120] SetErrorMode (uMode=0x0) returned 0x1 [0085.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf", lpFilePart=0x0) returned 0x62 [0085.120] GetLastError () returned 0x12 [0085.120] SetErrorMode (uMode=0x1) returned 0x0 [0085.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\bjjubvkfsudxx8e.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.121] GetLastError () returned 0x0 [0085.121] GetFileType (hFile=0x214) returned 0x1 [0085.121] SetErrorMode (uMode=0x0) returned 0x1 [0085.121] GetFileType (hFile=0x214) returned 0x1 [0085.121] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39eb50 | out: lpFileSizeHigh=0x39eb50*=0x0) returned 0x6a12 [0085.121] GetLastError () returned 0x0 [0085.121] ReadFile (in: hFile=0x214, lpBuffer=0x26c7270, nNumberOfBytesToRead=0x6a12, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x26c7270*, lpNumberOfBytesRead=0x39eaf8*=0x6a12, lpOverlapped=0x0) returned 1 [0085.122] GetLastError () returned 0x0 [0085.122] CloseHandle (hObject=0x214) returned 1 [0085.122] GetLastError () returned 0x0 [0085.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf", lpFilePart=0x0) returned 0x62 [0085.185] GetLastError () returned 0x0 [0085.185] SetErrorMode (uMode=0x1) returned 0x0 [0085.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\bjjubvkfsudxx8e.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.186] GetLastError () returned 0xb7 [0085.186] GetFileType (hFile=0x214) returned 0x1 [0085.186] GetFileType (hFile=0x214) returned 0x1 [0085.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf", lpFilePart=0x0) returned 0x62 [0085.187] GetLastError () returned 0xb7 [0085.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf.LanRan2.0.5", lpFilePart=0x0) returned 0x6e [0085.187] GetLastError () returned 0xb7 [0085.187] SetErrorMode (uMode=0x1) returned 0x0 [0085.187] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\bjjubvkfsudxx8e.pdf"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc662c580, ftCreationTime.dwHighDateTime=0x1d3b015, ftLastAccessTime.dwLowDateTime=0x1f5c2910, ftLastAccessTime.dwHighDateTime=0x1d3a4d1, ftLastWriteTime.dwLowDateTime=0x19d3fe0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x6a20)) returned 1 [0085.187] GetLastError () returned 0xb7 [0085.187] SetErrorMode (uMode=0x0) returned 0x1 [0085.187] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\bjjubvkfsudxx8e.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\BJjUBvkfSUdXx8e.pdf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\bjjubvkfsudxx8e.pdf.lanran2.0.5")) returned 1 [0085.187] GetLastError () returned 0xb7 [0085.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt", lpFilePart=0x0) returned 0x5c [0085.187] GetLastError () returned 0xb7 [0085.187] SetErrorMode (uMode=0x1) returned 0x0 [0085.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\byp3mohke.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.188] GetLastError () returned 0x0 [0085.188] GetFileType (hFile=0x214) returned 0x1 [0085.188] SetErrorMode (uMode=0x0) returned 0x1 [0085.188] GetFileType (hFile=0x214) returned 0x1 [0085.188] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39eb50 | out: lpFileSizeHigh=0x39eb50*=0x0) returned 0xbf74 [0085.188] GetLastError () returned 0x0 [0085.188] ReadFile (in: hFile=0x214, lpBuffer=0x257e358, nNumberOfBytesToRead=0xbf74, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x257e358*, lpNumberOfBytesRead=0x39eaf8*=0xbf74, lpOverlapped=0x0) returned 1 [0085.189] GetLastError () returned 0x0 [0085.189] CloseHandle (hObject=0x214) returned 1 [0085.189] GetLastError () returned 0x0 [0085.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt", lpFilePart=0x0) returned 0x5c [0085.244] GetLastError () returned 0x0 [0085.244] SetErrorMode (uMode=0x1) returned 0x0 [0085.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\byp3mohke.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.245] GetLastError () returned 0xb7 [0085.245] GetFileType (hFile=0x214) returned 0x1 [0085.245] GetFileType (hFile=0x214) returned 0x1 [0085.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt", lpFilePart=0x0) returned 0x5c [0085.247] GetLastError () returned 0xb7 [0085.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt.LanRan2.0.5", lpFilePart=0x0) returned 0x68 [0085.247] GetLastError () returned 0xb7 [0085.247] SetErrorMode (uMode=0x1) returned 0x0 [0085.247] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\byp3mohke.odt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6a810e0, ftCreationTime.dwHighDateTime=0x1d3a0ea, ftLastAccessTime.dwLowDateTime=0x9344b250, ftLastAccessTime.dwHighDateTime=0x1d3a2cb, ftLastWriteTime.dwLowDateTime=0x1a6c560, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xbf80)) returned 1 [0085.247] GetLastError () returned 0xb7 [0085.247] SetErrorMode (uMode=0x0) returned 0x1 [0085.247] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\byp3mohke.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\ByP3moHkE.odt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\byp3mohke.odt.lanran2.0.5")) returned 1 [0085.247] GetLastError () returned 0xb7 [0085.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf", lpFilePart=0x0) returned 0x5d [0085.248] GetLastError () returned 0xb7 [0085.248] SetErrorMode (uMode=0x1) returned 0x0 [0085.248] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\izz4jc1gbs.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.248] GetLastError () returned 0x0 [0085.248] GetFileType (hFile=0x214) returned 0x1 [0085.248] GetFileType (hFile=0x214) returned 0x1 [0085.248] ReadFile (in: hFile=0x214, lpBuffer=0x26364c4, nNumberOfBytesToRead=0x494e, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x26364c4*, lpNumberOfBytesRead=0x39eaf8*=0x494e, lpOverlapped=0x0) returned 1 [0085.249] GetLastError () returned 0x0 [0085.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf", lpFilePart=0x0) returned 0x5d [0085.274] GetLastError () returned 0x0 [0085.274] SetErrorMode (uMode=0x1) returned 0x0 [0085.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\izz4jc1gbs.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.275] GetLastError () returned 0xb7 [0085.275] GetFileType (hFile=0x214) returned 0x1 [0085.275] GetFileType (hFile=0x214) returned 0x1 [0085.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf", lpFilePart=0x0) returned 0x5d [0085.276] GetLastError () returned 0xb7 [0085.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf.LanRan2.0.5", lpFilePart=0x0) returned 0x69 [0085.276] GetLastError () returned 0xb7 [0085.276] SetErrorMode (uMode=0x1) returned 0x0 [0085.276] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\izz4jc1gbs.rtf"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b578980, ftCreationTime.dwHighDateTime=0x1d3a8a3, ftLastAccessTime.dwLowDateTime=0x2aba2a70, ftLastAccessTime.dwHighDateTime=0x1d3a1e6, ftLastWriteTime.dwLowDateTime=0x1a926c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x4950)) returned 1 [0085.276] GetLastError () returned 0xb7 [0085.276] SetErrorMode (uMode=0x0) returned 0x1 [0085.276] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\izz4jc1gbs.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\izz4Jc1gbS.rtf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\izz4jc1gbs.rtf.lanran2.0.5")) returned 1 [0085.277] GetLastError () returned 0xb7 [0085.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx", lpFilePart=0x0) returned 0x64 [0085.277] GetLastError () returned 0xb7 [0085.277] SetErrorMode (uMode=0x1) returned 0x0 [0085.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\nrgpxtgl5eovktsc.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.277] GetLastError () returned 0x0 [0085.277] GetFileType (hFile=0x214) returned 0x1 [0085.277] GetFileType (hFile=0x214) returned 0x1 [0085.277] ReadFile (in: hFile=0x214, lpBuffer=0x26d9e7c, nNumberOfBytesToRead=0xf719, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x26d9e7c*, lpNumberOfBytesRead=0x39eaf8*=0xf719, lpOverlapped=0x0) returned 1 [0085.278] GetLastError () returned 0x0 [0085.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx", lpFilePart=0x0) returned 0x64 [0085.307] GetLastError () returned 0x0 [0085.307] SetErrorMode (uMode=0x1) returned 0x0 [0085.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\nrgpxtgl5eovktsc.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.308] GetLastError () returned 0xb7 [0085.309] GetFileType (hFile=0x214) returned 0x1 [0085.309] SetErrorMode (uMode=0x0) returned 0x1 [0085.309] GetFileType (hFile=0x214) returned 0x1 [0085.309] WriteFile (in: hFile=0x214, lpBuffer=0x259264c*, nNumberOfBytesToWrite=0xf720, lpNumberOfBytesWritten=0x39eb04, lpOverlapped=0x0 | out: lpBuffer=0x259264c*, lpNumberOfBytesWritten=0x39eb04*=0xf720, lpOverlapped=0x0) returned 1 [0085.310] GetLastError () returned 0xb7 [0085.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx", lpFilePart=0x0) returned 0x64 [0085.310] GetLastError () returned 0xb7 [0085.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x70 [0085.310] GetLastError () returned 0xb7 [0085.310] SetErrorMode (uMode=0x1) returned 0x0 [0085.310] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\nrgpxtgl5eovktsc.docx"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x298d66f0, ftCreationTime.dwHighDateTime=0x1d3a5db, ftLastAccessTime.dwLowDateTime=0xf51c1910, ftLastAccessTime.dwHighDateTime=0x1d3a473, ftLastWriteTime.dwLowDateTime=0x1b04ae0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xf720)) returned 1 [0085.310] GetLastError () returned 0xb7 [0085.310] SetErrorMode (uMode=0x0) returned 0x1 [0085.311] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\nrgpxtgl5eovktsc.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\nrGPXtGL5EOvKtsC.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\nrgpxtgl5eovktsc.docx.lanran2.0.5")) returned 1 [0085.312] GetLastError () returned 0xb7 [0085.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf", lpFilePart=0x0) returned 0x66 [0085.312] GetLastError () returned 0xb7 [0085.312] SetErrorMode (uMode=0x1) returned 0x0 [0085.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\q ovyk_kvwgwh45lu86.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.312] GetLastError () returned 0x0 [0085.312] GetFileType (hFile=0x214) returned 0x1 [0085.312] SetErrorMode (uMode=0x0) returned 0x1 [0085.313] GetFileType (hFile=0x214) returned 0x1 [0085.313] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39eb50 | out: lpFileSizeHigh=0x39eb50*=0x0) returned 0xb152 [0085.313] GetLastError () returned 0x0 [0085.313] ReadFile (in: hFile=0x214, lpBuffer=0x25a27a0, nNumberOfBytesToRead=0xb152, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x25a27a0*, lpNumberOfBytesRead=0x39eaf8*=0xb152, lpOverlapped=0x0) returned 1 [0085.313] GetLastError () returned 0x0 [0085.314] CloseHandle (hObject=0x214) returned 1 [0085.314] GetLastError () returned 0x0 [0085.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf", lpFilePart=0x0) returned 0x66 [0085.381] GetLastError () returned 0x0 [0085.381] SetErrorMode (uMode=0x1) returned 0x0 [0085.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\q ovyk_kvwgwh45lu86.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.382] GetLastError () returned 0xb7 [0085.382] GetFileType (hFile=0x214) returned 0x1 [0085.382] GetFileType (hFile=0x214) returned 0x1 [0085.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf", lpFilePart=0x0) returned 0x66 [0085.384] GetLastError () returned 0xb7 [0085.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf.LanRan2.0.5", lpFilePart=0x0) returned 0x72 [0085.384] GetLastError () returned 0xb7 [0085.384] SetErrorMode (uMode=0x1) returned 0x0 [0085.384] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\q ovyk_kvwgwh45lu86.rtf"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70935600, ftCreationTime.dwHighDateTime=0x1d3a161, ftLastAccessTime.dwLowDateTime=0x508dd5b0, ftLastAccessTime.dwHighDateTime=0x1d3abb1, ftLastWriteTime.dwLowDateTime=0x1b9d060, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xb160)) returned 1 [0085.384] GetLastError () returned 0xb7 [0085.384] SetErrorMode (uMode=0x0) returned 0x1 [0085.384] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\q ovyk_kvwgwh45lu86.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aMZs0-MTUPZZ4CF\\XSRU4lI2eOc0v44\\_omF x\\Q oVYK_KvWgWH45lu86.rtf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\amzs0-mtupzz4cf\\xsru4li2eoc0v44\\_omf x\\q ovyk_kvwgwh45lu86.rtf.lanran2.0.5")) returned 1 [0085.384] GetLastError () returned 0xb7 [0085.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30 [0085.384] GetLastError () returned 0xb7 [0085.385] SetErrorMode (uMode=0x1) returned 0x0 [0085.385] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0xffffffff [0085.385] GetLastError () returned 0x5 [0085.698] SetErrorMode (uMode=0x0) returned 0x1 [0085.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30 [0085.698] GetLastError () returned 0x5 [0085.698] SetErrorMode (uMode=0x1) returned 0x0 [0085.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0xffffffff [0085.699] GetLastError () returned 0x5 [0085.701] SetErrorMode (uMode=0x0) returned 0x1 [0085.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33 [0085.817] GetLastError () returned 0x5 [0085.817] SetErrorMode (uMode=0x1) returned 0x0 [0085.817] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0xffffffff [0085.817] GetLastError () returned 0x5 [0085.819] SetErrorMode (uMode=0x0) returned 0x1 [0085.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33 [0085.819] GetLastError () returned 0x5 [0085.819] SetErrorMode (uMode=0x1) returned 0x0 [0085.819] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0xffffffff [0085.819] GetLastError () returned 0x5 [0085.821] SetErrorMode (uMode=0x0) returned 0x1 [0085.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0085.828] GetLastError () returned 0x5 [0085.828] SetErrorMode (uMode=0x1) returned 0x0 [0085.829] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270 [0085.829] GetLastError () returned 0x5 [0085.829] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.830] GetLastError () returned 0x5 [0085.830] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.830] GetLastError () returned 0x5 [0085.830] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.830] GetLastError () returned 0x5 [0085.830] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.830] GetLastError () returned 0x5 [0085.830] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0085.830] GetLastError () returned 0x12 [0085.831] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1 [0085.831] SetErrorMode (uMode=0x0) returned 0x1 [0085.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0085.831] GetLastError () returned 0x12 [0085.831] SetErrorMode (uMode=0x1) returned 0x0 [0085.831] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270 [0085.831] GetLastError () returned 0x12 [0085.831] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.831] GetLastError () returned 0x12 [0085.832] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.832] GetLastError () returned 0x12 [0085.832] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.832] GetLastError () returned 0x12 [0085.832] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.832] GetLastError () returned 0x12 [0085.832] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0085.832] GetLastError () returned 0x12 [0085.832] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1 [0085.832] SetErrorMode (uMode=0x0) returned 0x1 [0085.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0085.833] GetLastError () returned 0x12 [0085.833] SetErrorMode (uMode=0x1) returned 0x0 [0085.833] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270 [0085.896] GetLastError () returned 0x12 [0085.897] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.897] GetLastError () returned 0x12 [0085.897] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.897] GetLastError () returned 0x12 [0085.897] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0085.897] GetLastError () returned 0x12 [0085.897] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1 [0085.897] SetErrorMode (uMode=0x0) returned 0x1 [0085.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0085.923] GetLastError () returned 0x12 [0085.923] SetErrorMode (uMode=0x1) returned 0x0 [0085.923] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270 [0085.924] GetLastError () returned 0x12 [0085.924] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.924] GetLastError () returned 0x12 [0085.924] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0085.924] GetLastError () returned 0x12 [0085.924] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0085.924] GetLastError () returned 0x12 [0085.924] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1 [0085.924] SetErrorMode (uMode=0x0) returned 0x1 [0085.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x45 [0085.924] GetLastError () returned 0x12 [0085.924] SetErrorMode (uMode=0x1) returned 0x0 [0085.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0085.925] GetLastError () returned 0x0 [0085.925] GetFileType (hFile=0x214) returned 0x1 [0085.926] SetErrorMode (uMode=0x0) returned 0x1 [0085.926] GetFileType (hFile=0x214) returned 0x1 [0085.926] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0x74e6 [0085.926] GetLastError () returned 0x0 [0085.926] ReadFile (in: hFile=0x214, lpBuffer=0x24e797c, nNumberOfBytesToRead=0x74e6, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x24e797c*, lpNumberOfBytesRead=0x39eb58*=0x74e6, lpOverlapped=0x0) returned 1 [0085.970] GetLastError () returned 0x0 [0085.970] CloseHandle (hObject=0x214) returned 1 [0085.970] GetLastError () returned 0x0 [0086.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x45 [0086.030] GetLastError () returned 0x0 [0086.030] SetErrorMode (uMode=0x1) returned 0x0 [0086.030] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0086.030] GetLastError () returned 0x5 [0086.055] SetErrorMode (uMode=0x0) returned 0x1 [0086.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31 [0086.056] GetLastError () returned 0x5 [0086.056] SetErrorMode (uMode=0x1) returned 0x0 [0086.056] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0xffffffff [0086.056] GetLastError () returned 0x5 [0086.058] SetErrorMode (uMode=0x0) returned 0x1 [0086.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31 [0086.058] GetLastError () returned 0x5 [0086.058] SetErrorMode (uMode=0x1) returned 0x0 [0086.059] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0xffffffff [0086.059] GetLastError () returned 0x5 [0086.061] SetErrorMode (uMode=0x0) returned 0x1 [0086.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0086.071] GetLastError () returned 0x5 [0086.071] SetErrorMode (uMode=0x1) returned 0x0 [0086.071] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570 [0086.071] GetLastError () returned 0x5 [0086.071] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.072] GetLastError () returned 0x5 [0086.072] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.072] GetLastError () returned 0x5 [0086.072] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0086.072] GetLastError () returned 0x12 [0086.072] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1 [0086.072] SetErrorMode (uMode=0x0) returned 0x1 [0086.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0086.073] GetLastError () returned 0x12 [0086.073] SetErrorMode (uMode=0x1) returned 0x0 [0086.073] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570 [0086.073] GetLastError () returned 0x12 [0086.073] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.073] GetLastError () returned 0x12 [0086.073] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.073] GetLastError () returned 0x12 [0086.074] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0086.074] GetLastError () returned 0x12 [0086.074] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1 [0086.074] SetErrorMode (uMode=0x0) returned 0x1 [0086.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9", lpFilePart=0x0) returned 0x38 [0086.074] GetLastError () returned 0x12 [0086.074] SetErrorMode (uMode=0x1) returned 0x0 [0086.074] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570 [0086.074] GetLastError () returned 0x12 [0086.075] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.075] GetLastError () returned 0x12 [0086.075] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.075] GetLastError () returned 0x12 [0086.075] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.075] GetLastError () returned 0x12 [0086.075] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.075] GetLastError () returned 0x12 [0086.076] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.076] GetLastError () returned 0x12 [0086.076] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0086.076] GetLastError () returned 0x12 [0086.076] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1 [0086.077] SetErrorMode (uMode=0x0) returned 0x1 [0086.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9", lpFilePart=0x0) returned 0x38 [0086.077] GetLastError () returned 0x12 [0086.077] SetErrorMode (uMode=0x1) returned 0x0 [0086.077] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570 [0086.078] GetLastError () returned 0x12 [0086.078] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.078] GetLastError () returned 0x12 [0086.078] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.078] GetLastError () returned 0x12 [0086.079] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.079] GetLastError () returned 0x12 [0086.079] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.079] GetLastError () returned 0x12 [0086.080] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.080] GetLastError () returned 0x12 [0086.080] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0086.080] GetLastError () returned 0x12 [0086.081] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1 [0086.081] SetErrorMode (uMode=0x0) returned 0x1 [0086.081] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx", lpFilePart=0x0) returned 0x46 [0086.081] GetLastError () returned 0x12 [0086.081] SetErrorMode (uMode=0x1) returned 0x0 [0086.081] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\jsk 9b9p.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0086.081] GetLastError () returned 0x0 [0086.081] GetFileType (hFile=0x214) returned 0x1 [0086.081] SetErrorMode (uMode=0x0) returned 0x1 [0086.081] GetFileType (hFile=0x214) returned 0x1 [0086.081] GetFileSize (in: hFile=0x214, lpFileSizeHigh=0x39ec10 | out: lpFileSizeHigh=0x39ec10*=0x0) returned 0x12590 [0086.081] GetLastError () returned 0x0 [0086.082] ReadFile (in: hFile=0x214, lpBuffer=0x259f758, nNumberOfBytesToRead=0x12590, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x259f758*, lpNumberOfBytesRead=0x39ebb8*=0x12590, lpOverlapped=0x0) returned 1 [0086.083] GetLastError () returned 0x0 [0086.083] CloseHandle (hObject=0x214) returned 1 [0086.083] GetLastError () returned 0x0 [0086.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx", lpFilePart=0x0) returned 0x46 [0086.164] GetLastError () returned 0x0 [0086.164] SetErrorMode (uMode=0x1) returned 0x0 [0086.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\jsk 9b9p.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0086.165] GetLastError () returned 0xb7 [0086.165] GetFileType (hFile=0x214) returned 0x1 [0086.165] GetFileType (hFile=0x214) returned 0x1 [0086.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx", lpFilePart=0x0) returned 0x46 [0086.173] GetLastError () returned 0xb7 [0086.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x52 [0086.173] GetLastError () returned 0xb7 [0086.173] SetErrorMode (uMode=0x1) returned 0x0 [0086.173] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\jsk 9b9p.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e04cca0, ftCreationTime.dwHighDateTime=0x1d3ad2c, ftLastAccessTime.dwLowDateTime=0x225131f0, ftLastAccessTime.dwHighDateTime=0x1d3a699, ftLastWriteTime.dwLowDateTime=0x2333680, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x125a0)) returned 1 [0086.173] GetLastError () returned 0xb7 [0086.173] SetErrorMode (uMode=0x0) returned 0x1 [0086.174] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\jsk 9b9p.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\Jsk 9b9p.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\jsk 9b9p.docx.lanran2.0.5")) returned 1 [0086.175] GetLastError () returned 0xb7 [0086.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt", lpFilePart=0x0) returned 0x4d [0086.176] GetLastError () returned 0xb7 [0086.176] SetErrorMode (uMode=0x1) returned 0x0 [0086.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\kplxgjplfarmrz5m.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0086.176] GetLastError () returned 0x0 [0086.176] GetFileType (hFile=0x214) returned 0x1 [0086.176] GetFileType (hFile=0x214) returned 0x1 [0086.176] ReadFile (in: hFile=0x214, lpBuffer=0x2670edc, nNumberOfBytesToRead=0xdf80, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x2670edc*, lpNumberOfBytesRead=0x39ebb8*=0xdf80, lpOverlapped=0x0) returned 1 [0086.177] GetLastError () returned 0x0 [0086.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt", lpFilePart=0x0) returned 0x4d [0086.254] GetLastError () returned 0x0 [0086.254] SetErrorMode (uMode=0x1) returned 0x0 [0086.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\kplxgjplfarmrz5m.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0086.255] GetLastError () returned 0xb7 [0086.255] GetFileType (hFile=0x214) returned 0x1 [0086.255] GetFileType (hFile=0x214) returned 0x1 [0086.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt", lpFilePart=0x0) returned 0x4d [0086.256] GetLastError () returned 0xb7 [0086.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt.LanRan2.0.5", lpFilePart=0x0) returned 0x59 [0086.256] GetLastError () returned 0xb7 [0086.256] SetErrorMode (uMode=0x1) returned 0x0 [0086.256] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\kplxgjplfarmrz5m.ppt"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6f65190, ftCreationTime.dwHighDateTime=0x1d3a3ef, ftLastAccessTime.dwLowDateTime=0x5adc0ef0, ftLastAccessTime.dwHighDateTime=0x1d3a44b, ftLastWriteTime.dwLowDateTime=0x23f1d60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xdf90)) returned 1 [0086.256] GetLastError () returned 0xb7 [0086.256] SetErrorMode (uMode=0x0) returned 0x1 [0086.256] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\kplxgjplfarmrz5m.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\KpLxgJplfaRmRZ5m.ppt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\kplxgjplfarmrz5m.ppt.lanran2.0.5")) returned 1 [0086.257] GetLastError () returned 0xb7 [0086.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt", lpFilePart=0x0) returned 0x43 [0086.257] GetLastError () returned 0xb7 [0086.257] SetErrorMode (uMode=0x1) returned 0x0 [0086.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\qc2b7i.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0086.257] GetLastError () returned 0x0 [0086.257] GetFileType (hFile=0x214) returned 0x1 [0086.257] GetFileType (hFile=0x214) returned 0x1 [0086.257] ReadFile (in: hFile=0x214, lpBuffer=0x253fe24, nNumberOfBytesToRead=0x10e8e, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x253fe24*, lpNumberOfBytesRead=0x39ebb8*=0x10e8e, lpOverlapped=0x0) returned 1 [0086.258] GetLastError () returned 0x0 [0086.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt", lpFilePart=0x0) returned 0x43 [0086.285] GetLastError () returned 0x0 [0086.285] SetErrorMode (uMode=0x1) returned 0x0 [0086.286] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\qc2b7i.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x214 [0086.286] GetLastError () returned 0xb7 [0086.287] GetFileType (hFile=0x214) returned 0x1 [0086.287] GetFileType (hFile=0x214) returned 0x1 [0086.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt", lpFilePart=0x0) returned 0x43 [0086.288] GetLastError () returned 0xb7 [0086.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt.LanRan2.0.5", lpFilePart=0x0) returned 0x4f [0086.288] GetLastError () returned 0xb7 [0086.288] SetErrorMode (uMode=0x1) returned 0x0 [0086.288] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\qc2b7i.odt"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f777740, ftCreationTime.dwHighDateTime=0x1d3a0ef, ftLastAccessTime.dwLowDateTime=0xba6bc110, ftLastAccessTime.dwHighDateTime=0x1d3a13c, ftLastWriteTime.dwLowDateTime=0x243e020, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x10e90)) returned 1 [0086.288] GetLastError () returned 0xb7 [0086.288] SetErrorMode (uMode=0x0) returned 0x1 [0086.288] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\qc2b7i.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xFoWV83ToSRPBZP9\\qC2b7I.odt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xfowv83tosrpbzp9\\qc2b7i.odt.lanran2.0.5")) returned 1 [0086.289] GetLastError () returned 0xb7 [0086.289] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned 0x0 [0086.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0086.290] GetLastError () returned 0x3f0 [0086.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27 [0086.291] GetLastError () returned 0x3f0 [0086.291] SetErrorMode (uMode=0x1) returned 0x0 [0086.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0086.291] GetLastError () returned 0x3f0 [0086.291] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.291] GetLastError () returned 0x3f0 [0086.291] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.291] GetLastError () returned 0x3f0 [0086.291] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.291] GetLastError () returned 0x3f0 [0086.291] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.291] GetLastError () returned 0x3f0 [0086.292] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.292] GetLastError () returned 0x3f0 [0086.292] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.292] GetLastError () returned 0x3f0 [0086.292] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.292] GetLastError () returned 0x3f0 [0086.292] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0086.292] GetLastError () returned 0x12 [0086.292] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0086.292] SetErrorMode (uMode=0x0) returned 0x1 [0086.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27 [0086.293] GetLastError () returned 0x12 [0086.293] SetErrorMode (uMode=0x1) returned 0x0 [0086.293] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0086.293] GetLastError () returned 0x12 [0086.293] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.293] GetLastError () returned 0x12 [0086.293] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.293] GetLastError () returned 0x12 [0086.293] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.293] GetLastError () returned 0x12 [0086.293] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.293] GetLastError () returned 0x12 [0086.294] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.294] GetLastError () returned 0x12 [0086.294] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.294] GetLastError () returned 0x12 [0086.294] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.294] GetLastError () returned 0x12 [0086.294] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0086.294] GetLastError () returned 0x12 [0086.294] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0086.294] SetErrorMode (uMode=0x0) returned 0x1 [0086.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif", lpFilePart=0x0) returned 0x31 [0086.294] GetLastError () returned 0x12 [0086.294] SetErrorMode (uMode=0x1) returned 0x0 [0086.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\humj9n.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.294] GetLastError () returned 0x0 [0086.294] GetFileType (hFile=0x210) returned 0x1 [0086.295] SetErrorMode (uMode=0x0) returned 0x1 [0086.295] GetFileType (hFile=0x210) returned 0x1 [0086.295] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0xed7e [0086.295] GetLastError () returned 0x0 [0086.295] ReadFile (in: hFile=0x210, lpBuffer=0x260d3cc, nNumberOfBytesToRead=0xed7e, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x260d3cc*, lpNumberOfBytesRead=0x39ec18*=0xed7e, lpOverlapped=0x0) returned 1 [0086.295] GetLastError () returned 0x0 [0086.295] CloseHandle (hObject=0x210) returned 1 [0086.295] GetLastError () returned 0x0 [0086.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif", lpFilePart=0x0) returned 0x31 [0086.353] GetLastError () returned 0x0 [0086.353] SetErrorMode (uMode=0x1) returned 0x0 [0086.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\humj9n.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.354] GetLastError () returned 0xb7 [0086.354] GetFileType (hFile=0x210) returned 0x1 [0086.355] GetFileType (hFile=0x210) returned 0x1 [0086.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif", lpFilePart=0x0) returned 0x31 [0086.356] GetLastError () returned 0xb7 [0086.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x3d [0086.356] GetLastError () returned 0xb7 [0086.356] SetErrorMode (uMode=0x1) returned 0x0 [0086.356] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\humj9n.gif"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x841e7390, ftCreationTime.dwHighDateTime=0x1d3a1bf, ftLastAccessTime.dwLowDateTime=0x36b93700, ftLastAccessTime.dwHighDateTime=0x1d3ac52, ftLastWriteTime.dwLowDateTime=0x24fc700, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xed80)) returned 1 [0086.356] GetLastError () returned 0xb7 [0086.356] SetErrorMode (uMode=0x0) returned 0x1 [0086.356] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\humj9n.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hUmJ9N.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\humj9n.gif.lanran2.0.5")) returned 1 [0086.357] GetLastError () returned 0xb7 [0086.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png", lpFilePart=0x0) returned 0x33 [0086.357] GetLastError () returned 0xb7 [0086.357] SetErrorMode (uMode=0x1) returned 0x0 [0086.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rusj4 m1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.357] GetLastError () returned 0x0 [0086.357] GetFileType (hFile=0x210) returned 0x1 [0086.357] GetFileType (hFile=0x210) returned 0x1 [0086.357] ReadFile (in: hFile=0x210, lpBuffer=0x26d09dc, nNumberOfBytesToRead=0x3a4a, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26d09dc*, lpNumberOfBytesRead=0x39ec18*=0x3a4a, lpOverlapped=0x0) returned 1 [0086.358] GetLastError () returned 0x0 [0086.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png", lpFilePart=0x0) returned 0x33 [0086.417] GetLastError () returned 0x0 [0086.417] SetErrorMode (uMode=0x1) returned 0x0 [0086.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rusj4 m1.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.418] GetLastError () returned 0xb7 [0086.418] GetFileType (hFile=0x210) returned 0x1 [0086.418] GetFileType (hFile=0x210) returned 0x1 [0086.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png", lpFilePart=0x0) returned 0x33 [0086.419] GetLastError () returned 0xb7 [0086.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png.LanRan2.0.5", lpFilePart=0x0) returned 0x3f [0086.419] GetLastError () returned 0xb7 [0086.419] SetErrorMode (uMode=0x1) returned 0x0 [0086.419] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rusj4 m1.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aadf6b0, ftCreationTime.dwHighDateTime=0x1d3a5f7, ftLastAccessTime.dwLowDateTime=0xfcc55f70, ftLastAccessTime.dwHighDateTime=0x1d3a08e, ftLastWriteTime.dwLowDateTime=0x2594c80, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x3a50)) returned 1 [0086.419] GetLastError () returned 0xb7 [0086.419] SetErrorMode (uMode=0x0) returned 0x1 [0086.419] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rusj4 m1.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\RUSJ4 m1.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\rusj4 m1.png.lanran2.0.5")) returned 1 [0086.420] GetLastError () returned 0xb7 [0086.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif", lpFilePart=0x0) returned 0x3a [0086.420] GetLastError () returned 0xb7 [0086.420] SetErrorMode (uMode=0x1) returned 0x0 [0086.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sqh i6mbe59ed2t.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.420] GetLastError () returned 0x0 [0086.420] GetFileType (hFile=0x210) returned 0x1 [0086.420] GetFileType (hFile=0x210) returned 0x1 [0086.420] ReadFile (in: hFile=0x210, lpBuffer=0x2571fa8, nNumberOfBytesToRead=0xb823, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2571fa8*, lpNumberOfBytesRead=0x39ec18*=0xb823, lpOverlapped=0x0) returned 1 [0086.421] GetLastError () returned 0x0 [0086.447] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif", lpFilePart=0x0) returned 0x3a [0086.447] GetLastError () returned 0x0 [0086.447] SetErrorMode (uMode=0x1) returned 0x0 [0086.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sqh i6mbe59ed2t.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.448] GetLastError () returned 0xb7 [0086.449] GetFileType (hFile=0x210) returned 0x1 [0086.449] GetFileType (hFile=0x210) returned 0x1 [0086.450] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif", lpFilePart=0x0) returned 0x3a [0086.450] GetLastError () returned 0xb7 [0086.450] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x46 [0086.450] GetLastError () returned 0xb7 [0086.450] SetErrorMode (uMode=0x1) returned 0x0 [0086.450] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sqh i6mbe59ed2t.gif"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c4f980, ftCreationTime.dwHighDateTime=0x1d3ad85, ftLastAccessTime.dwLowDateTime=0xaa4f7d30, ftLastAccessTime.dwHighDateTime=0x1d3a7bd, ftLastWriteTime.dwLowDateTime=0x25e0f40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xb830)) returned 1 [0086.450] GetLastError () returned 0xb7 [0086.450] SetErrorMode (uMode=0x0) returned 0x1 [0086.450] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sqh i6mbe59ed2t.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\SQh i6mBe59Ed2T.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\sqh i6mbe59ed2t.gif.lanran2.0.5")) returned 1 [0086.450] GetLastError () returned 0xb7 [0086.451] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif", lpFilePart=0x0) returned 0x3e [0086.451] GetLastError () returned 0xb7 [0086.451] SetErrorMode (uMode=0x1) returned 0x0 [0086.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\svhxap79kwj1dxgdwqi.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.451] GetLastError () returned 0x0 [0086.451] GetFileType (hFile=0x210) returned 0x1 [0086.451] GetFileType (hFile=0x210) returned 0x1 [0086.451] ReadFile (in: hFile=0x210, lpBuffer=0x26282a8, nNumberOfBytesToRead=0xe25b, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26282a8*, lpNumberOfBytesRead=0x39ec18*=0xe25b, lpOverlapped=0x0) returned 1 [0086.452] GetLastError () returned 0x0 [0086.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif", lpFilePart=0x0) returned 0x3e [0086.480] GetLastError () returned 0x0 [0086.480] SetErrorMode (uMode=0x1) returned 0x0 [0086.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\svhxap79kwj1dxgdwqi.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.481] GetLastError () returned 0xb7 [0086.481] GetFileType (hFile=0x210) returned 0x1 [0086.481] SetErrorMode (uMode=0x0) returned 0x1 [0086.481] GetFileType (hFile=0x210) returned 0x1 [0086.481] WriteFile (in: hFile=0x210, lpBuffer=0x24e065c*, nNumberOfBytesToWrite=0xe260, lpNumberOfBytesWritten=0x39ec24, lpOverlapped=0x0 | out: lpBuffer=0x24e065c*, lpNumberOfBytesWritten=0x39ec24*=0xe260, lpOverlapped=0x0) returned 1 [0086.483] GetLastError () returned 0xb7 [0086.483] CloseHandle (hObject=0x210) returned 1 [0086.484] GetLastError () returned 0xb7 [0086.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif", lpFilePart=0x0) returned 0x3e [0086.484] GetLastError () returned 0xb7 [0086.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x4a [0086.484] GetLastError () returned 0xb7 [0086.484] SetErrorMode (uMode=0x1) returned 0x0 [0086.484] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\svhxap79kwj1dxgdwqi.gif"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7193d140, ftCreationTime.dwHighDateTime=0x1d3a910, ftLastAccessTime.dwLowDateTime=0xee8a5c60, ftLastAccessTime.dwHighDateTime=0x1d3a3a6, ftLastWriteTime.dwLowDateTime=0x262d200, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xe260)) returned 1 [0086.484] GetLastError () returned 0xb7 [0086.484] SetErrorMode (uMode=0x0) returned 0x1 [0086.485] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\svhxap79kwj1dxgdwqi.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\svhXap79kwJ1dXgDwQI.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\svhxap79kwj1dxgdwqi.gif.lanran2.0.5")) returned 1 [0086.485] GetLastError () returned 0xb7 [0086.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ", lpFilePart=0x0) returned 0x3a [0086.485] GetLastError () returned 0xb7 [0086.485] SetErrorMode (uMode=0x1) returned 0x0 [0086.485] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570 [0086.485] GetLastError () returned 0xb7 [0086.485] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.486] GetLastError () returned 0xb7 [0086.486] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.486] GetLastError () returned 0xb7 [0086.486] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.486] GetLastError () returned 0xb7 [0086.486] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.486] GetLastError () returned 0xb7 [0086.486] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.486] GetLastError () returned 0xb7 [0086.486] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.486] GetLastError () returned 0xb7 [0086.487] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.487] GetLastError () returned 0xb7 [0086.487] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0086.487] GetLastError () returned 0x12 [0086.487] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1 [0086.487] SetErrorMode (uMode=0x0) returned 0x1 [0086.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ", lpFilePart=0x0) returned 0x3a [0086.487] GetLastError () returned 0x12 [0086.487] SetErrorMode (uMode=0x1) returned 0x0 [0086.487] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570 [0086.487] GetLastError () returned 0x12 [0086.487] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.488] GetLastError () returned 0x12 [0086.488] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.488] GetLastError () returned 0x12 [0086.488] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.488] GetLastError () returned 0x12 [0086.488] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.488] GetLastError () returned 0x12 [0086.488] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.488] GetLastError () returned 0x12 [0086.488] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.488] GetLastError () returned 0x12 [0086.489] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.489] GetLastError () returned 0x12 [0086.489] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0086.489] GetLastError () returned 0x12 [0086.489] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1 [0086.489] SetErrorMode (uMode=0x0) returned 0x1 [0086.489] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif", lpFilePart=0x0) returned 0x4d [0086.489] GetLastError () returned 0x12 [0086.489] SetErrorMode (uMode=0x1) returned 0x0 [0086.489] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\4qwn3lf10ala6b.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.489] GetLastError () returned 0x0 [0086.489] GetFileType (hFile=0x210) returned 0x1 [0086.489] SetErrorMode (uMode=0x0) returned 0x1 [0086.489] GetFileType (hFile=0x210) returned 0x1 [0086.489] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39ec10 | out: lpFileSizeHigh=0x39ec10*=0x0) returned 0x115a0 [0086.490] GetLastError () returned 0x0 [0086.490] ReadFile (in: hFile=0x210, lpBuffer=0x24f0b38, nNumberOfBytesToRead=0x115a0, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x24f0b38*, lpNumberOfBytesRead=0x39ebb8*=0x115a0, lpOverlapped=0x0) returned 1 [0086.490] GetLastError () returned 0x0 [0086.490] CloseHandle (hObject=0x210) returned 1 [0086.490] GetLastError () returned 0x0 [0086.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif", lpFilePart=0x0) returned 0x4d [0086.535] GetLastError () returned 0x0 [0086.535] SetErrorMode (uMode=0x1) returned 0x0 [0086.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\4qwn3lf10ala6b.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.536] GetLastError () returned 0xb7 [0086.536] GetFileType (hFile=0x210) returned 0x1 [0086.536] GetFileType (hFile=0x210) returned 0x1 [0086.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif", lpFilePart=0x0) returned 0x4d [0086.537] GetLastError () returned 0xb7 [0086.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x59 [0086.537] GetLastError () returned 0xb7 [0086.537] SetErrorMode (uMode=0x1) returned 0x0 [0086.537] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\4qwn3lf10ala6b.gif"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46df23f0, ftCreationTime.dwHighDateTime=0x1d3affa, ftLastAccessTime.dwLowDateTime=0x5f5e8bc0, ftLastAccessTime.dwHighDateTime=0x1d3a4f9, ftLastWriteTime.dwLowDateTime=0x269f620, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x115b0)) returned 1 [0086.537] GetLastError () returned 0xb7 [0086.537] SetErrorMode (uMode=0x0) returned 0x1 [0086.537] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\4qwn3lf10ala6b.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\4QWN3LF10ALA6b.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\4qwn3lf10ala6b.gif.lanran2.0.5")) returned 1 [0086.538] GetLastError () returned 0xb7 [0086.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png", lpFilePart=0x0) returned 0x4e [0086.538] GetLastError () returned 0xb7 [0086.538] SetErrorMode (uMode=0x1) returned 0x0 [0086.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\d9oryucu13enryj.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.538] GetLastError () returned 0x0 [0086.538] GetFileType (hFile=0x210) returned 0x1 [0086.538] GetFileType (hFile=0x210) returned 0x1 [0086.538] ReadFile (in: hFile=0x210, lpBuffer=0x25be4dc, nNumberOfBytesToRead=0x6099, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x25be4dc*, lpNumberOfBytesRead=0x39ebb8*=0x6099, lpOverlapped=0x0) returned 1 [0086.539] GetLastError () returned 0x0 [0086.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png", lpFilePart=0x0) returned 0x4e [0086.555] GetLastError () returned 0x0 [0086.555] SetErrorMode (uMode=0x1) returned 0x0 [0086.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\d9oryucu13enryj.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.556] GetLastError () returned 0xb7 [0086.556] GetFileType (hFile=0x210) returned 0x1 [0086.556] GetFileType (hFile=0x210) returned 0x1 [0086.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png", lpFilePart=0x0) returned 0x4e [0086.557] GetLastError () returned 0xb7 [0086.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png.LanRan2.0.5", lpFilePart=0x0) returned 0x5a [0086.557] GetLastError () returned 0xb7 [0086.557] SetErrorMode (uMode=0x1) returned 0x0 [0086.557] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\d9oryucu13enryj.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde6e0640, ftCreationTime.dwHighDateTime=0x1d3a6aa, ftLastAccessTime.dwLowDateTime=0xe601b130, ftLastAccessTime.dwHighDateTime=0x1d3b04c, ftLastWriteTime.dwLowDateTime=0x26c5780, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x60a0)) returned 1 [0086.557] GetLastError () returned 0xb7 [0086.557] SetErrorMode (uMode=0x0) returned 0x1 [0086.557] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\d9oryucu13enryj.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\D9orYUcU13enryJ.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\d9oryucu13enryj.png.lanran2.0.5")) returned 1 [0086.557] GetLastError () returned 0xb7 [0086.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png", lpFilePart=0x0) returned 0x49 [0086.557] GetLastError () returned 0xb7 [0086.557] SetErrorMode (uMode=0x1) returned 0x0 [0086.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\lptpzz0usr.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.557] GetLastError () returned 0x0 [0086.557] GetFileType (hFile=0x210) returned 0x1 [0086.558] GetFileType (hFile=0x210) returned 0x1 [0086.558] ReadFile (in: hFile=0x210, lpBuffer=0x266a9c8, nNumberOfBytesToRead=0x2e45, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x266a9c8*, lpNumberOfBytesRead=0x39ebb8*=0x2e45, lpOverlapped=0x0) returned 1 [0086.558] GetLastError () returned 0x0 [0086.620] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png", lpFilePart=0x0) returned 0x49 [0086.620] GetLastError () returned 0x0 [0086.620] SetErrorMode (uMode=0x1) returned 0x0 [0086.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\lptpzz0usr.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.621] GetLastError () returned 0xb7 [0086.621] GetFileType (hFile=0x210) returned 0x1 [0086.621] GetFileType (hFile=0x210) returned 0x1 [0086.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png", lpFilePart=0x0) returned 0x49 [0086.622] GetLastError () returned 0xb7 [0086.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png.LanRan2.0.5", lpFilePart=0x0) returned 0x55 [0086.622] GetLastError () returned 0xb7 [0086.622] SetErrorMode (uMode=0x1) returned 0x0 [0086.622] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\lptpzz0usr.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b95350, ftCreationTime.dwHighDateTime=0x1d3aa85, ftLastAccessTime.dwLowDateTime=0xf3851520, ftLastAccessTime.dwHighDateTime=0x1d3a5c2, ftLastWriteTime.dwLowDateTime=0x2783e60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x2e50)) returned 1 [0086.623] GetLastError () returned 0xb7 [0086.623] SetErrorMode (uMode=0x0) returned 0x1 [0086.623] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\lptpzz0usr.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\lPTPZZ0usr.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\lptpzz0usr.png.lanran2.0.5")) returned 1 [0086.623] GetLastError () returned 0xb7 [0086.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif", lpFilePart=0x0) returned 0x52 [0086.623] GetLastError () returned 0xb7 [0086.623] SetErrorMode (uMode=0x1) returned 0x0 [0086.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\ofsqsvy_9-o5srbuc-f.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.623] GetLastError () returned 0x0 [0086.623] GetFileType (hFile=0x210) returned 0x1 [0086.623] GetFileType (hFile=0x210) returned 0x1 [0086.623] ReadFile (in: hFile=0x210, lpBuffer=0x2507594, nNumberOfBytesToRead=0x2449, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x2507594*, lpNumberOfBytesRead=0x39ebb8*=0x2449, lpOverlapped=0x0) returned 1 [0086.624] GetLastError () returned 0x0 [0086.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif", lpFilePart=0x0) returned 0x52 [0086.648] GetLastError () returned 0x0 [0086.648] SetErrorMode (uMode=0x1) returned 0x0 [0086.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\ofsqsvy_9-o5srbuc-f.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.650] GetLastError () returned 0xb7 [0086.650] GetFileType (hFile=0x210) returned 0x1 [0086.650] GetFileType (hFile=0x210) returned 0x1 [0086.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif", lpFilePart=0x0) returned 0x52 [0086.651] GetLastError () returned 0xb7 [0086.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x5e [0086.651] GetLastError () returned 0xb7 [0086.651] SetErrorMode (uMode=0x1) returned 0x0 [0086.651] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\ofsqsvy_9-o5srbuc-f.gif"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37dc9320, ftCreationTime.dwHighDateTime=0x1d3a414, ftLastAccessTime.dwLowDateTime=0x74bcad0, ftLastAccessTime.dwHighDateTime=0x1d3a0ec, ftLastWriteTime.dwLowDateTime=0x27d0120, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x2450)) returned 1 [0086.651] GetLastError () returned 0xb7 [0086.651] SetErrorMode (uMode=0x0) returned 0x1 [0086.651] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\ofsqsvy_9-o5srbuc-f.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\OFsQSvY_9-O5SRBUC-f.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\ofsqsvy_9-o5srbuc-f.gif.lanran2.0.5")) returned 1 [0086.651] GetLastError () returned 0xb7 [0086.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp", lpFilePart=0x0) returned 0x48 [0086.651] GetLastError () returned 0xb7 [0086.651] SetErrorMode (uMode=0x1) returned 0x0 [0086.651] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270 [0086.652] GetLastError () returned 0xb7 [0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.652] GetLastError () returned 0xb7 [0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.652] GetLastError () returned 0xb7 [0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.652] GetLastError () returned 0xb7 [0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.652] GetLastError () returned 0xb7 [0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.652] GetLastError () returned 0xb7 [0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.652] GetLastError () returned 0xb7 [0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.652] GetLastError () returned 0xb7 [0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.652] GetLastError () returned 0xb7 [0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.652] GetLastError () returned 0xb7 [0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.652] GetLastError () returned 0xb7 [0086.652] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0086.652] GetLastError () returned 0x12 [0086.652] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1 [0086.652] SetErrorMode (uMode=0x0) returned 0x1 [0086.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp", lpFilePart=0x0) returned 0x48 [0086.652] GetLastError () returned 0x12 [0086.652] SetErrorMode (uMode=0x1) returned 0x0 [0086.653] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270 [0086.653] GetLastError () returned 0x12 [0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.653] GetLastError () returned 0x12 [0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.653] GetLastError () returned 0x12 [0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.653] GetLastError () returned 0x12 [0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.653] GetLastError () returned 0x12 [0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.653] GetLastError () returned 0x12 [0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.653] GetLastError () returned 0x12 [0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.653] GetLastError () returned 0x12 [0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.653] GetLastError () returned 0x12 [0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.653] GetLastError () returned 0x12 [0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0086.653] GetLastError () returned 0x12 [0086.653] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0086.653] GetLastError () returned 0x12 [0086.653] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1 [0086.653] SetErrorMode (uMode=0x0) returned 0x1 [0086.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif", lpFilePart=0x0) returned 0x61 [0086.654] GetLastError () returned 0x12 [0086.654] SetErrorMode (uMode=0x1) returned 0x0 [0086.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\4vk4jynzml2h7s1binw6.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.654] GetLastError () returned 0x0 [0086.654] GetFileType (hFile=0x210) returned 0x1 [0086.654] SetErrorMode (uMode=0x0) returned 0x1 [0086.654] GetFileType (hFile=0x210) returned 0x1 [0086.654] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0xdecc [0086.654] GetLastError () returned 0x0 [0086.654] ReadFile (in: hFile=0x210, lpBuffer=0x259f3b8, nNumberOfBytesToRead=0xdecc, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x259f3b8*, lpNumberOfBytesRead=0x39eb58*=0xdecc, lpOverlapped=0x0) returned 1 [0086.655] GetLastError () returned 0x0 [0086.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif", lpFilePart=0x0) returned 0x61 [0086.681] GetLastError () returned 0x0 [0086.681] SetErrorMode (uMode=0x1) returned 0x0 [0086.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\4vk4jynzml2h7s1binw6.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.682] GetLastError () returned 0xb7 [0086.682] GetFileType (hFile=0x210) returned 0x1 [0086.682] SetErrorMode (uMode=0x0) returned 0x1 [0086.682] GetFileType (hFile=0x210) returned 0x1 [0086.683] WriteFile (in: hFile=0x210, lpBuffer=0x2650830*, nNumberOfBytesToWrite=0xded0, lpNumberOfBytesWritten=0x39eb64, lpOverlapped=0x0 | out: lpBuffer=0x2650830*, lpNumberOfBytesWritten=0x39eb64*=0xded0, lpOverlapped=0x0) returned 1 [0086.684] GetLastError () returned 0xb7 [0086.684] CloseHandle (hObject=0x210) returned 1 [0086.688] GetLastError () returned 0xb7 [0086.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif", lpFilePart=0x0) returned 0x61 [0086.688] GetLastError () returned 0xb7 [0086.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x6d [0086.689] GetLastError () returned 0xb7 [0086.689] SetErrorMode (uMode=0x1) returned 0x0 [0086.689] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\4vk4jynzml2h7s1binw6.gif"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb70b8a0, ftCreationTime.dwHighDateTime=0x1d3a2c2, ftLastAccessTime.dwLowDateTime=0xe533dda0, ftLastAccessTime.dwHighDateTime=0x1d3a219, ftLastWriteTime.dwLowDateTime=0x281c3e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xded0)) returned 1 [0086.689] GetLastError () returned 0xb7 [0086.689] SetErrorMode (uMode=0x0) returned 0x1 [0086.689] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\4vk4jynzml2h7s1binw6.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\4VK4jynZmL2H7s1bInW6.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\4vk4jynzml2h7s1binw6.gif.lanran2.0.5")) returned 1 [0086.689] GetLastError () returned 0xb7 [0086.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif", lpFilePart=0x0) returned 0x5f [0086.689] GetLastError () returned 0xb7 [0086.689] SetErrorMode (uMode=0x1) returned 0x0 [0086.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\5rmwu4x8kfj8tv13oi.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.690] GetLastError () returned 0x0 [0086.690] GetFileType (hFile=0x210) returned 0x1 [0086.690] SetErrorMode (uMode=0x0) returned 0x1 [0086.690] GetFileType (hFile=0x210) returned 0x1 [0086.690] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0x7372 [0086.690] GetLastError () returned 0x0 [0086.690] ReadFile (in: hFile=0x210, lpBuffer=0x265f10c, nNumberOfBytesToRead=0x7372, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x265f10c*, lpNumberOfBytesRead=0x39eb58*=0x7372, lpOverlapped=0x0) returned 1 [0086.691] GetLastError () returned 0x0 [0086.691] CloseHandle (hObject=0x210) returned 1 [0086.691] GetLastError () returned 0x0 [0086.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif", lpFilePart=0x0) returned 0x5f [0086.756] GetLastError () returned 0x0 [0086.756] SetErrorMode (uMode=0x1) returned 0x0 [0086.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\5rmwu4x8kfj8tv13oi.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.757] GetLastError () returned 0xb7 [0086.757] GetFileType (hFile=0x210) returned 0x1 [0086.757] GetFileType (hFile=0x210) returned 0x1 [0086.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif", lpFilePart=0x0) returned 0x5f [0086.759] GetLastError () returned 0xb7 [0086.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x6b [0086.759] GetLastError () returned 0xb7 [0086.759] SetErrorMode (uMode=0x1) returned 0x0 [0086.759] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\5rmwu4x8kfj8tv13oi.gif"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a89dd0, ftCreationTime.dwHighDateTime=0x1d3a337, ftLastAccessTime.dwLowDateTime=0x41f7fb00, ftLastAccessTime.dwHighDateTime=0x1d3afd2, ftLastWriteTime.dwLowDateTime=0x28daac0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x7380)) returned 1 [0086.759] GetLastError () returned 0xb7 [0086.759] SetErrorMode (uMode=0x0) returned 0x1 [0086.759] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\5rmwu4x8kfj8tv13oi.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\5rMWu4X8kfJ8TV13OI.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\5rmwu4x8kfj8tv13oi.gif.lanran2.0.5")) returned 1 [0086.759] GetLastError () returned 0xb7 [0086.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg", lpFilePart=0x0) returned 0x5d [0086.759] GetLastError () returned 0xb7 [0086.759] SetErrorMode (uMode=0x1) returned 0x0 [0086.760] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\7eyqrwddtufwea78.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.760] GetLastError () returned 0x0 [0086.760] GetFileType (hFile=0x210) returned 0x1 [0086.760] SetErrorMode (uMode=0x0) returned 0x1 [0086.760] GetFileType (hFile=0x210) returned 0x1 [0086.760] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0x7278 [0086.760] GetLastError () returned 0x0 [0086.760] ReadFile (in: hFile=0x210, lpBuffer=0x25174a0, nNumberOfBytesToRead=0x7278, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25174a0*, lpNumberOfBytesRead=0x39eb58*=0x7278, lpOverlapped=0x0) returned 1 [0086.761] GetLastError () returned 0x0 [0086.761] CloseHandle (hObject=0x210) returned 1 [0086.761] GetLastError () returned 0x0 [0086.835] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg", lpFilePart=0x0) returned 0x5d [0086.835] GetLastError () returned 0x0 [0086.835] SetErrorMode (uMode=0x1) returned 0x0 [0086.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\7eyqrwddtufwea78.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.836] GetLastError () returned 0xb7 [0086.836] GetFileType (hFile=0x210) returned 0x1 [0086.836] GetFileType (hFile=0x210) returned 0x1 [0086.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg", lpFilePart=0x0) returned 0x5d [0086.837] GetLastError () returned 0xb7 [0086.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x69 [0086.837] GetLastError () returned 0xb7 [0086.837] SetErrorMode (uMode=0x1) returned 0x0 [0086.837] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\7eyqrwddtufwea78.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa2fff30, ftCreationTime.dwHighDateTime=0x1d3aecc, ftLastAccessTime.dwLowDateTime=0xa6bece40, ftLastAccessTime.dwHighDateTime=0x1d3a9df, ftLastWriteTime.dwLowDateTime=0x29991a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x7280)) returned 1 [0086.837] GetLastError () returned 0xb7 [0086.837] SetErrorMode (uMode=0x0) returned 0x1 [0086.837] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\7eyqrwddtufwea78.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\7eyqrwDDTufwEa78.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\7eyqrwddtufwea78.jpg.lanran2.0.5")) returned 1 [0086.838] GetLastError () returned 0xb7 [0086.838] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp", lpFilePart=0x0) returned 0x5c [0086.838] GetLastError () returned 0xb7 [0086.838] SetErrorMode (uMode=0x1) returned 0x0 [0086.838] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\bqvsun3uhxnr4kr.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.838] GetLastError () returned 0x0 [0086.838] GetFileType (hFile=0x210) returned 0x1 [0086.838] GetFileType (hFile=0x210) returned 0x1 [0086.838] ReadFile (in: hFile=0x210, lpBuffer=0x25ca710, nNumberOfBytesToRead=0xf3d0, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25ca710*, lpNumberOfBytesRead=0x39eb58*=0xf3d0, lpOverlapped=0x0) returned 1 [0086.839] GetLastError () returned 0x0 [0086.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp", lpFilePart=0x0) returned 0x5c [0086.867] GetLastError () returned 0x0 [0086.867] SetErrorMode (uMode=0x1) returned 0x0 [0086.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\bqvsun3uhxnr4kr.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.868] GetLastError () returned 0xb7 [0086.868] GetFileType (hFile=0x210) returned 0x1 [0086.868] GetFileType (hFile=0x210) returned 0x1 [0086.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp", lpFilePart=0x0) returned 0x5c [0086.869] GetLastError () returned 0xb7 [0086.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp.LanRan2.0.5", lpFilePart=0x0) returned 0x68 [0086.869] GetLastError () returned 0xb7 [0086.869] SetErrorMode (uMode=0x1) returned 0x0 [0086.869] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\bqvsun3uhxnr4kr.bmp"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eb90080, ftCreationTime.dwHighDateTime=0x1d3a372, ftLastAccessTime.dwLowDateTime=0xb58cf5e0, ftLastAccessTime.dwHighDateTime=0x1d39ffe, ftLastWriteTime.dwLowDateTime=0x29e5460, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xf3e0)) returned 1 [0086.870] GetLastError () returned 0xb7 [0086.870] SetErrorMode (uMode=0x0) returned 0x1 [0086.870] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\bqvsun3uhxnr4kr.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\BqVsUN3uHxNr4KR.bmp.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\bqvsun3uhxnr4kr.bmp.lanran2.0.5")) returned 1 [0086.870] GetLastError () returned 0xb7 [0086.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg", lpFilePart=0x0) returned 0x55 [0086.870] GetLastError () returned 0xb7 [0086.870] SetErrorMode (uMode=0x1) returned 0x0 [0086.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\cyzijwpk.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.870] GetLastError () returned 0x0 [0086.870] GetFileType (hFile=0x210) returned 0x1 [0086.870] GetFileType (hFile=0x210) returned 0x1 [0086.871] ReadFile (in: hFile=0x210, lpBuffer=0x35bd900, nNumberOfBytesToRead=0x18274, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x35bd900*, lpNumberOfBytesRead=0x39eb58*=0x18274, lpOverlapped=0x0) returned 1 [0086.872] GetLastError () returned 0x0 [0086.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg", lpFilePart=0x0) returned 0x55 [0086.906] GetLastError () returned 0x0 [0086.906] SetErrorMode (uMode=0x1) returned 0x0 [0086.906] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\cyzijwpk.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.907] GetLastError () returned 0xb7 [0086.907] GetFileType (hFile=0x210) returned 0x1 [0086.908] SetErrorMode (uMode=0x0) returned 0x1 [0086.908] GetFileType (hFile=0x210) returned 0x1 [0086.908] WriteFile (in: hFile=0x210, lpBuffer=0x36365b0*, nNumberOfBytesToWrite=0x18280, lpNumberOfBytesWritten=0x39eb64, lpOverlapped=0x0 | out: lpBuffer=0x36365b0*, lpNumberOfBytesWritten=0x39eb64*=0x18280, lpOverlapped=0x0) returned 1 [0086.909] GetLastError () returned 0xb7 [0086.909] CloseHandle (hObject=0x210) returned 1 [0086.911] GetLastError () returned 0xb7 [0086.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg", lpFilePart=0x0) returned 0x55 [0086.911] GetLastError () returned 0xb7 [0086.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x61 [0086.911] GetLastError () returned 0xb7 [0086.911] SetErrorMode (uMode=0x1) returned 0x0 [0086.911] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\cyzijwpk.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ddc4350, ftCreationTime.dwHighDateTime=0x1d3a93e, ftLastAccessTime.dwLowDateTime=0xc3292340, ftLastAccessTime.dwHighDateTime=0x1d3a94f, ftLastWriteTime.dwLowDateTime=0x2a31720, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x18280)) returned 1 [0086.911] GetLastError () returned 0xb7 [0086.911] SetErrorMode (uMode=0x0) returned 0x1 [0086.911] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\cyzijwpk.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\cyzIjwPk.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\cyzijwpk.jpg.lanran2.0.5")) returned 1 [0086.912] GetLastError () returned 0xb7 [0086.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg", lpFilePart=0x0) returned 0x56 [0086.912] GetLastError () returned 0xb7 [0086.912] SetErrorMode (uMode=0x1) returned 0x0 [0086.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\muyhktmdm.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.912] GetLastError () returned 0x0 [0086.912] GetFileType (hFile=0x210) returned 0x1 [0086.912] SetErrorMode (uMode=0x0) returned 0x1 [0086.912] GetFileType (hFile=0x210) returned 0x1 [0086.912] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0xdcfa [0086.912] GetLastError () returned 0x0 [0086.912] ReadFile (in: hFile=0x210, lpBuffer=0x2510614, nNumberOfBytesToRead=0xdcfa, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x2510614*, lpNumberOfBytesRead=0x39eb58*=0xdcfa, lpOverlapped=0x0) returned 1 [0086.913] GetLastError () returned 0x0 [0086.913] CloseHandle (hObject=0x210) returned 1 [0086.913] GetLastError () returned 0x0 [0086.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg", lpFilePart=0x0) returned 0x56 [0086.971] GetLastError () returned 0x0 [0086.971] SetErrorMode (uMode=0x1) returned 0x0 [0086.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\muyhktmdm.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.972] GetLastError () returned 0xb7 [0086.972] GetFileType (hFile=0x210) returned 0x1 [0086.972] GetFileType (hFile=0x210) returned 0x1 [0086.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg", lpFilePart=0x0) returned 0x56 [0086.974] GetLastError () returned 0xb7 [0086.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x62 [0086.974] GetLastError () returned 0xb7 [0086.974] SetErrorMode (uMode=0x1) returned 0x0 [0086.974] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\muyhktmdm.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752fa250, ftCreationTime.dwHighDateTime=0x1d3aec6, ftLastAccessTime.dwLowDateTime=0xec0ddbe0, ftLastAccessTime.dwHighDateTime=0x1d3abc3, ftLastWriteTime.dwLowDateTime=0x2ac9ca0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xdd00)) returned 1 [0086.974] GetLastError () returned 0xb7 [0086.974] SetErrorMode (uMode=0x0) returned 0x1 [0086.974] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\muyhktmdm.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\MuYhktmDM.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\muyhktmdm.jpg.lanran2.0.5")) returned 1 [0086.974] GetLastError () returned 0xb7 [0086.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp", lpFilePart=0x0) returned 0x5d [0086.974] GetLastError () returned 0xb7 [0086.974] SetErrorMode (uMode=0x1) returned 0x0 [0086.974] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\nydnoe6adjhzrnny.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0086.975] GetLastError () returned 0x0 [0086.975] GetFileType (hFile=0x210) returned 0x1 [0086.975] GetFileType (hFile=0x210) returned 0x1 [0086.975] ReadFile (in: hFile=0x210, lpBuffer=0x25cfd60, nNumberOfBytesToRead=0xe086, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25cfd60*, lpNumberOfBytesRead=0x39eb58*=0xe086, lpOverlapped=0x0) returned 1 [0086.975] GetLastError () returned 0x0 [0087.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp", lpFilePart=0x0) returned 0x5d [0087.002] GetLastError () returned 0x0 [0087.002] SetErrorMode (uMode=0x1) returned 0x0 [0087.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\nydnoe6adjhzrnny.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.003] GetLastError () returned 0xb7 [0087.003] GetFileType (hFile=0x210) returned 0x1 [0087.003] GetFileType (hFile=0x210) returned 0x1 [0087.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp", lpFilePart=0x0) returned 0x5d [0087.005] GetLastError () returned 0xb7 [0087.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp.LanRan2.0.5", lpFilePart=0x0) returned 0x69 [0087.005] GetLastError () returned 0xb7 [0087.005] SetErrorMode (uMode=0x1) returned 0x0 [0087.005] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\nydnoe6adjhzrnny.bmp"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e6716f0, ftCreationTime.dwHighDateTime=0x1d39ff1, ftLastAccessTime.dwLowDateTime=0xa07280e0, ftLastAccessTime.dwHighDateTime=0x1d3a0c0, ftLastWriteTime.dwLowDateTime=0x2b15f60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xe090)) returned 1 [0087.005] GetLastError () returned 0xb7 [0087.005] SetErrorMode (uMode=0x0) returned 0x1 [0087.005] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\nydnoe6adjhzrnny.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\NyDNoE6ADjhZrNny.bmp.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\nydnoe6adjhzrnny.bmp.lanran2.0.5")) returned 1 [0087.005] GetLastError () returned 0xb7 [0087.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png", lpFilePart=0x0) returned 0x5c [0087.005] GetLastError () returned 0xb7 [0087.005] SetErrorMode (uMode=0x1) returned 0x0 [0087.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\yr4nfivedvx896w.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.006] GetLastError () returned 0x0 [0087.006] GetFileType (hFile=0x210) returned 0x1 [0087.006] GetFileType (hFile=0x210) returned 0x1 [0087.006] ReadFile (in: hFile=0x210, lpBuffer=0x3686370, nNumberOfBytesToRead=0x155b6, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x3686370*, lpNumberOfBytesRead=0x39eb58*=0x155b6, lpOverlapped=0x0) returned 1 [0087.007] GetLastError () returned 0x0 [0087.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png", lpFilePart=0x0) returned 0x5c [0087.070] GetLastError () returned 0x0 [0087.070] SetErrorMode (uMode=0x1) returned 0x0 [0087.071] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\yr4nfivedvx896w.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.072] GetLastError () returned 0xb7 [0087.072] GetFileType (hFile=0x210) returned 0x1 [0087.072] GetFileType (hFile=0x210) returned 0x1 [0087.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png", lpFilePart=0x0) returned 0x5c [0087.073] GetLastError () returned 0xb7 [0087.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png.LanRan2.0.5", lpFilePart=0x0) returned 0x68 [0087.073] GetLastError () returned 0xb7 [0087.073] SetErrorMode (uMode=0x1) returned 0x0 [0087.073] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\yr4nfivedvx896w.png"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e0a60b0, ftCreationTime.dwHighDateTime=0x1d3a474, ftLastAccessTime.dwLowDateTime=0x706185a0, ftLastAccessTime.dwHighDateTime=0x1d3ae5c, ftLastWriteTime.dwLowDateTime=0x2bd4640, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x155c0)) returned 1 [0087.074] GetLastError () returned 0xb7 [0087.074] SetErrorMode (uMode=0x0) returned 0x1 [0087.074] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\yr4nfivedvx896w.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\yr4nFIveDvX896w.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\yr4nfivedvx896w.png.lanran2.0.5")) returned 1 [0087.074] GetLastError () returned 0xb7 [0087.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF", lpFilePart=0x0) returned 0x55 [0087.074] GetLastError () returned 0xb7 [0087.074] SetErrorMode (uMode=0x1) returned 0x0 [0087.074] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0087.074] GetLastError () returned 0xb7 [0087.074] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.074] GetLastError () returned 0xb7 [0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.075] GetLastError () returned 0xb7 [0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.075] GetLastError () returned 0xb7 [0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.075] GetLastError () returned 0xb7 [0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.075] GetLastError () returned 0xb7 [0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0087.075] GetLastError () returned 0x12 [0087.075] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0087.075] SetErrorMode (uMode=0x0) returned 0x1 [0087.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF", lpFilePart=0x0) returned 0x55 [0087.075] GetLastError () returned 0x12 [0087.075] SetErrorMode (uMode=0x1) returned 0x0 [0087.075] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0087.075] GetLastError () returned 0x12 [0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.075] GetLastError () returned 0x12 [0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.075] GetLastError () returned 0x12 [0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.075] GetLastError () returned 0x12 [0087.075] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.075] GetLastError () returned 0x12 [0087.076] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.076] GetLastError () returned 0x12 [0087.076] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0087.076] GetLastError () returned 0x12 [0087.076] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0087.076] SetErrorMode (uMode=0x0) returned 0x1 [0087.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg", lpFilePart=0x0) returned 0x60 [0087.076] GetLastError () returned 0x12 [0087.076] SetErrorMode (uMode=0x1) returned 0x0 [0087.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\5e6mnj.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.076] GetLastError () returned 0x0 [0087.076] GetFileType (hFile=0x210) returned 0x1 [0087.076] GetFileType (hFile=0x210) returned 0x1 [0087.076] ReadFile (in: hFile=0x210, lpBuffer=0x2519a2c, nNumberOfBytesToRead=0x14209, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x2519a2c*, lpNumberOfBytesRead=0x39eaf8*=0x14209, lpOverlapped=0x0) returned 1 [0087.077] GetLastError () returned 0x0 [0087.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg", lpFilePart=0x0) returned 0x60 [0087.106] GetLastError () returned 0x0 [0087.106] SetErrorMode (uMode=0x1) returned 0x0 [0087.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\5e6mnj.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.107] GetLastError () returned 0xb7 [0087.107] GetFileType (hFile=0x210) returned 0x1 [0087.107] SetErrorMode (uMode=0x0) returned 0x1 [0087.107] GetFileType (hFile=0x210) returned 0x1 [0087.107] WriteFile (in: hFile=0x210, lpBuffer=0x25dda0c*, nNumberOfBytesToWrite=0x14210, lpNumberOfBytesWritten=0x39eb04, lpOverlapped=0x0 | out: lpBuffer=0x25dda0c*, lpNumberOfBytesWritten=0x39eb04*=0x14210, lpOverlapped=0x0) returned 1 [0087.109] GetLastError () returned 0xb7 [0087.109] CloseHandle (hObject=0x210) returned 1 [0087.110] GetLastError () returned 0xb7 [0087.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg", lpFilePart=0x0) returned 0x60 [0087.110] GetLastError () returned 0xb7 [0087.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x6c [0087.110] GetLastError () returned 0xb7 [0087.110] SetErrorMode (uMode=0x1) returned 0x0 [0087.110] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\5e6mnj.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa485c0d0, ftCreationTime.dwHighDateTime=0x1d3a2d1, ftLastAccessTime.dwLowDateTime=0x263bafc0, ftLastAccessTime.dwHighDateTime=0x1d3a6df, ftLastWriteTime.dwLowDateTime=0x2c20900, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x14210)) returned 1 [0087.110] GetLastError () returned 0xb7 [0087.110] SetErrorMode (uMode=0x0) returned 0x1 [0087.110] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\5e6mnj.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\5e6mNJ.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\5e6mnj.jpg.lanran2.0.5")) returned 1 [0087.111] GetLastError () returned 0xb7 [0087.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp", lpFilePart=0x0) returned 0x6d [0087.111] GetLastError () returned 0xb7 [0087.111] SetErrorMode (uMode=0x1) returned 0x0 [0087.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\cte330fqj4o3f9xhhv3.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.111] GetLastError () returned 0x0 [0087.111] GetFileType (hFile=0x210) returned 0x1 [0087.111] SetErrorMode (uMode=0x0) returned 0x1 [0087.111] GetFileType (hFile=0x210) returned 0x1 [0087.112] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39eb50 | out: lpFileSizeHigh=0x39eb50*=0x0) returned 0x7f21 [0087.112] GetLastError () returned 0x0 [0087.112] ReadFile (in: hFile=0x210, lpBuffer=0x25f2628, nNumberOfBytesToRead=0x7f21, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x25f2628*, lpNumberOfBytesRead=0x39eaf8*=0x7f21, lpOverlapped=0x0) returned 1 [0087.112] GetLastError () returned 0x0 [0087.112] CloseHandle (hObject=0x210) returned 1 [0087.112] GetLastError () returned 0x0 [0087.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp", lpFilePart=0x0) returned 0x6d [0087.172] GetLastError () returned 0x0 [0087.172] SetErrorMode (uMode=0x1) returned 0x0 [0087.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\cte330fqj4o3f9xhhv3.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.173] GetLastError () returned 0xb7 [0087.173] GetFileType (hFile=0x210) returned 0x1 [0087.174] GetFileType (hFile=0x210) returned 0x1 [0087.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp", lpFilePart=0x0) returned 0x6d [0087.175] GetLastError () returned 0xb7 [0087.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp.LanRan2.0.5", lpFilePart=0x0) returned 0x79 [0087.175] GetLastError () returned 0xb7 [0087.175] SetErrorMode (uMode=0x1) returned 0x0 [0087.175] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\cte330fqj4o3f9xhhv3.bmp"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91d8af00, ftCreationTime.dwHighDateTime=0x1d3ae2b, ftLastAccessTime.dwLowDateTime=0x67076480, ftLastAccessTime.dwHighDateTime=0x1d3afdc, ftLastWriteTime.dwLowDateTime=0x2cb8e80, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x7f30)) returned 1 [0087.175] GetLastError () returned 0xb7 [0087.175] SetErrorMode (uMode=0x0) returned 0x1 [0087.175] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\cte330fqj4o3f9xhhv3.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\cTe330FQj4O3F9xHHv3.bmp.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\cte330fqj4o3f9xhhv3.bmp.lanran2.0.5")) returned 1 [0087.177] GetLastError () returned 0xb7 [0087.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif", lpFilePart=0x0) returned 0x62 [0087.177] GetLastError () returned 0xb7 [0087.177] SetErrorMode (uMode=0x1) returned 0x0 [0087.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\f4gh7x9-.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.177] GetLastError () returned 0x0 [0087.177] GetFileType (hFile=0x210) returned 0x1 [0087.178] GetFileType (hFile=0x210) returned 0x1 [0087.178] ReadFile (in: hFile=0x210, lpBuffer=0x26aa39c, nNumberOfBytesToRead=0x133c1, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x26aa39c*, lpNumberOfBytesRead=0x39eaf8*=0x133c1, lpOverlapped=0x0) returned 1 [0087.178] GetLastError () returned 0x0 [0087.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif", lpFilePart=0x0) returned 0x62 [0087.239] GetLastError () returned 0x0 [0087.239] SetErrorMode (uMode=0x1) returned 0x0 [0087.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\f4gh7x9-.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.240] GetLastError () returned 0xb7 [0087.240] GetFileType (hFile=0x210) returned 0x1 [0087.240] GetFileType (hFile=0x210) returned 0x1 [0087.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif", lpFilePart=0x0) returned 0x62 [0087.242] GetLastError () returned 0xb7 [0087.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x6e [0087.242] GetLastError () returned 0xb7 [0087.242] SetErrorMode (uMode=0x1) returned 0x0 [0087.242] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\f4gh7x9-.gif"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d0f82e0, ftCreationTime.dwHighDateTime=0x1d3a161, ftLastAccessTime.dwLowDateTime=0x920213f0, ftLastAccessTime.dwHighDateTime=0x1d3a65f, ftLastWriteTime.dwLowDateTime=0x2d51400, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x133d0)) returned 1 [0087.242] GetLastError () returned 0xb7 [0087.242] SetErrorMode (uMode=0x0) returned 0x1 [0087.242] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\f4gh7x9-.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\F4gh7x9-.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\f4gh7x9-.gif.lanran2.0.5")) returned 1 [0087.243] GetLastError () returned 0xb7 [0087.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp", lpFilePart=0x0) returned 0x61 [0087.243] GetLastError () returned 0xb7 [0087.243] SetErrorMode (uMode=0x1) returned 0x0 [0087.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\rr1ee6x.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.243] GetLastError () returned 0x0 [0087.243] GetFileType (hFile=0x210) returned 0x1 [0087.243] GetFileType (hFile=0x210) returned 0x1 [0087.243] ReadFile (in: hFile=0x210, lpBuffer=0x3755208, nNumberOfBytesToRead=0x185d0, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x3755208*, lpNumberOfBytesRead=0x39eaf8*=0x185d0, lpOverlapped=0x0) returned 1 [0087.245] GetLastError () returned 0x0 [0087.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp", lpFilePart=0x0) returned 0x61 [0087.282] GetLastError () returned 0x0 [0087.283] SetErrorMode (uMode=0x1) returned 0x0 [0087.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\rr1ee6x.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.284] GetLastError () returned 0xb7 [0087.284] GetFileType (hFile=0x210) returned 0x1 [0087.284] SetErrorMode (uMode=0x0) returned 0x1 [0087.284] GetFileType (hFile=0x210) returned 0x1 [0087.284] WriteFile (in: hFile=0x210, lpBuffer=0x34c79a0*, nNumberOfBytesToWrite=0x185e0, lpNumberOfBytesWritten=0x39eb04, lpOverlapped=0x0 | out: lpBuffer=0x34c79a0*, lpNumberOfBytesWritten=0x39eb04*=0x185e0, lpOverlapped=0x0) returned 1 [0087.286] GetLastError () returned 0xb7 [0087.286] CloseHandle (hObject=0x210) returned 1 [0087.287] GetLastError () returned 0xb7 [0087.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp", lpFilePart=0x0) returned 0x61 [0087.287] GetLastError () returned 0xb7 [0087.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp.LanRan2.0.5", lpFilePart=0x0) returned 0x6d [0087.287] GetLastError () returned 0xb7 [0087.288] SetErrorMode (uMode=0x1) returned 0x0 [0087.288] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\rr1ee6x.bmp"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9ccc6e0, ftCreationTime.dwHighDateTime=0x1d3ab66, ftLastAccessTime.dwLowDateTime=0x48b7b20, ftLastAccessTime.dwHighDateTime=0x1d3a7b7, ftLastWriteTime.dwLowDateTime=0x2dc3820, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x185e0)) returned 1 [0087.288] GetLastError () returned 0xb7 [0087.288] SetErrorMode (uMode=0x0) returned 0x1 [0087.288] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\rr1ee6x.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\wNoQiWNK2EuCp\\qcl6r7WOC3TF\\rr1Ee6x.bmp.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\wnoqiwnk2eucp\\qcl6r7woc3tf\\rr1ee6x.bmp.lanran2.0.5")) returned 1 [0087.288] GetLastError () returned 0xb7 [0087.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM", lpFilePart=0x0) returned 0x48 [0087.288] GetLastError () returned 0xb7 [0087.288] SetErrorMode (uMode=0x1) returned 0x0 [0087.289] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570 [0087.289] GetLastError () returned 0xb7 [0087.289] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.289] GetLastError () returned 0xb7 [0087.289] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.289] GetLastError () returned 0xb7 [0087.289] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.289] GetLastError () returned 0xb7 [0087.290] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.290] GetLastError () returned 0xb7 [0087.290] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.290] GetLastError () returned 0xb7 [0087.290] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.290] GetLastError () returned 0xb7 [0087.290] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.290] GetLastError () returned 0xb7 [0087.290] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.290] GetLastError () returned 0xb7 [0087.290] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.290] GetLastError () returned 0xb7 [0087.291] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.291] GetLastError () returned 0xb7 [0087.291] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0087.291] GetLastError () returned 0x12 [0087.291] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1 [0087.291] SetErrorMode (uMode=0x0) returned 0x1 [0087.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM", lpFilePart=0x0) returned 0x48 [0087.291] GetLastError () returned 0x12 [0087.291] SetErrorMode (uMode=0x1) returned 0x0 [0087.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c570 [0087.291] GetLastError () returned 0x12 [0087.292] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.292] GetLastError () returned 0x12 [0087.292] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.292] GetLastError () returned 0x12 [0087.292] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.292] GetLastError () returned 0x12 [0087.292] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.292] GetLastError () returned 0x12 [0087.292] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.292] GetLastError () returned 0x12 [0087.292] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.293] GetLastError () returned 0x12 [0087.293] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.293] GetLastError () returned 0x12 [0087.293] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.293] GetLastError () returned 0x12 [0087.293] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.293] GetLastError () returned 0x12 [0087.293] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.293] GetLastError () returned 0x12 [0087.293] FindNextFileW (in: hFindFile=0x42c570, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0087.293] GetLastError () returned 0x12 [0087.294] FindClose (in: hFindFile=0x42c570 | out: hFindFile=0x42c570) returned 1 [0087.294] SetErrorMode (uMode=0x0) returned 0x1 [0087.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg", lpFilePart=0x0) returned 0x61 [0087.294] GetLastError () returned 0x12 [0087.294] SetErrorMode (uMode=0x1) returned 0x0 [0087.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\5 xsesqkjee fd4wdiel.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.294] GetLastError () returned 0x0 [0087.294] GetFileType (hFile=0x210) returned 0x1 [0087.294] SetErrorMode (uMode=0x0) returned 0x1 [0087.294] GetFileType (hFile=0x210) returned 0x1 [0087.294] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0xf7a5 [0087.294] GetLastError () returned 0x0 [0087.294] ReadFile (in: hFile=0x210, lpBuffer=0x24bd3d8, nNumberOfBytesToRead=0xf7a5, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x24bd3d8*, lpNumberOfBytesRead=0x39eb58*=0xf7a5, lpOverlapped=0x0) returned 1 [0087.295] GetLastError () returned 0x0 [0087.295] CloseHandle (hObject=0x210) returned 1 [0087.295] GetLastError () returned 0x0 [0087.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg", lpFilePart=0x0) returned 0x61 [0087.352] GetLastError () returned 0x0 [0087.352] SetErrorMode (uMode=0x1) returned 0x0 [0087.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\5 xsesqkjee fd4wdiel.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.354] GetLastError () returned 0xb7 [0087.354] GetFileType (hFile=0x210) returned 0x1 [0087.354] GetFileType (hFile=0x210) returned 0x1 [0087.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg", lpFilePart=0x0) returned 0x61 [0087.355] GetLastError () returned 0xb7 [0087.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x6d [0087.356] GetLastError () returned 0xb7 [0087.356] SetErrorMode (uMode=0x1) returned 0x0 [0087.356] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\5 xsesqkjee fd4wdiel.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7a91c10, ftCreationTime.dwHighDateTime=0x1d3aace, ftLastAccessTime.dwLowDateTime=0xfea14180, ftLastAccessTime.dwHighDateTime=0x1d3aba9, ftLastWriteTime.dwLowDateTime=0x2e81f00, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xf7b0)) returned 1 [0087.356] GetLastError () returned 0xb7 [0087.356] SetErrorMode (uMode=0x0) returned 0x1 [0087.356] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\5 xsesqkjee fd4wdiel.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\5 xsEsQkJee Fd4wdiEl.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\5 xsesqkjee fd4wdiel.jpg.lanran2.0.5")) returned 1 [0087.356] GetLastError () returned 0xb7 [0087.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png", lpFilePart=0x0) returned 0x57 [0087.357] GetLastError () returned 0xb7 [0087.357] SetErrorMode (uMode=0x1) returned 0x0 [0087.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\azsni -ulr.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.357] GetLastError () returned 0x0 [0087.357] GetFileType (hFile=0x210) returned 0x1 [0087.357] GetFileType (hFile=0x210) returned 0x1 [0087.357] ReadFile (in: hFile=0x210, lpBuffer=0x2583634, nNumberOfBytesToRead=0xfe9e, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x2583634*, lpNumberOfBytesRead=0x39eb58*=0xfe9e, lpOverlapped=0x0) returned 1 [0087.358] GetLastError () returned 0x0 [0087.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png", lpFilePart=0x0) returned 0x57 [0087.384] GetLastError () returned 0x0 [0087.384] SetErrorMode (uMode=0x1) returned 0x0 [0087.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\azsni -ulr.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.385] GetLastError () returned 0xb7 [0087.385] GetFileType (hFile=0x210) returned 0x1 [0087.385] GetFileType (hFile=0x210) returned 0x1 [0087.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png", lpFilePart=0x0) returned 0x57 [0087.387] GetLastError () returned 0xb7 [0087.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png.LanRan2.0.5", lpFilePart=0x0) returned 0x63 [0087.387] GetLastError () returned 0xb7 [0087.387] SetErrorMode (uMode=0x1) returned 0x0 [0087.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\azsni -ulr.png"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75d04cf0, ftCreationTime.dwHighDateTime=0x1d3a9d5, ftLastAccessTime.dwLowDateTime=0x957a4450, ftLastAccessTime.dwHighDateTime=0x1d3a71b, ftLastWriteTime.dwLowDateTime=0x2ece1c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xfea0)) returned 1 [0087.387] GetLastError () returned 0xb7 [0087.387] SetErrorMode (uMode=0x0) returned 0x1 [0087.387] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\azsni -ulr.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\AZsni -ULR.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\azsni -ulr.png.lanran2.0.5")) returned 1 [0087.388] GetLastError () returned 0xb7 [0087.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png", lpFilePart=0x0) returned 0x59 [0087.388] GetLastError () returned 0xb7 [0087.388] SetErrorMode (uMode=0x1) returned 0x0 [0087.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\eve0agd3kpqy.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.388] GetLastError () returned 0x0 [0087.388] GetFileType (hFile=0x210) returned 0x1 [0087.388] GetFileType (hFile=0x210) returned 0x1 [0087.388] ReadFile (in: hFile=0x210, lpBuffer=0x264b250, nNumberOfBytesToRead=0xab9d, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x264b250*, lpNumberOfBytesRead=0x39eb58*=0xab9d, lpOverlapped=0x0) returned 1 [0087.389] GetLastError () returned 0x0 [0087.441] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png", lpFilePart=0x0) returned 0x59 [0087.441] GetLastError () returned 0x0 [0087.441] SetErrorMode (uMode=0x1) returned 0x0 [0087.441] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\eve0agd3kpqy.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.442] GetLastError () returned 0xb7 [0087.442] GetFileType (hFile=0x210) returned 0x1 [0087.442] GetFileType (hFile=0x210) returned 0x1 [0087.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png", lpFilePart=0x0) returned 0x59 [0087.444] GetLastError () returned 0xb7 [0087.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png.LanRan2.0.5", lpFilePart=0x0) returned 0x65 [0087.444] GetLastError () returned 0xb7 [0087.444] SetErrorMode (uMode=0x1) returned 0x0 [0087.444] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\eve0agd3kpqy.png"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bd3670, ftCreationTime.dwHighDateTime=0x1d3ad0d, ftLastAccessTime.dwLowDateTime=0xc2389d60, ftLastAccessTime.dwHighDateTime=0x1d3a22b, ftLastWriteTime.dwLowDateTime=0x2f405e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xaba0)) returned 1 [0087.444] GetLastError () returned 0xb7 [0087.444] SetErrorMode (uMode=0x0) returned 0x1 [0087.444] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\eve0agd3kpqy.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Eve0agd3KPqY.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\eve0agd3kpqy.png.lanran2.0.5")) returned 1 [0087.444] GetLastError () returned 0xb7 [0087.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif", lpFilePart=0x0) returned 0x52 [0087.444] GetLastError () returned 0xb7 [0087.444] SetErrorMode (uMode=0x1) returned 0x0 [0087.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\hhev8.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.445] GetLastError () returned 0x0 [0087.445] GetFileType (hFile=0x210) returned 0x1 [0087.445] GetFileType (hFile=0x210) returned 0x1 [0087.445] ReadFile (in: hFile=0x210, lpBuffer=0x25098a8, nNumberOfBytesToRead=0x55db, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25098a8*, lpNumberOfBytesRead=0x39eb58*=0x55db, lpOverlapped=0x0) returned 1 [0087.445] GetLastError () returned 0x0 [0087.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif", lpFilePart=0x0) returned 0x52 [0087.470] GetLastError () returned 0x0 [0087.470] SetErrorMode (uMode=0x1) returned 0x0 [0087.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\hhev8.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.471] GetLastError () returned 0xb7 [0087.471] GetFileType (hFile=0x210) returned 0x1 [0087.471] GetFileType (hFile=0x210) returned 0x1 [0087.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif", lpFilePart=0x0) returned 0x52 [0087.471] GetLastError () returned 0xb7 [0087.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x5e [0087.471] GetLastError () returned 0xb7 [0087.471] SetErrorMode (uMode=0x1) returned 0x0 [0087.472] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\hhev8.gif"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424ddcf0, ftCreationTime.dwHighDateTime=0x1d3a47e, ftLastAccessTime.dwLowDateTime=0x22eed840, ftLastAccessTime.dwHighDateTime=0x1d3ae3e, ftLastWriteTime.dwLowDateTime=0x2f8c8a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x55e0)) returned 1 [0087.472] GetLastError () returned 0xb7 [0087.472] SetErrorMode (uMode=0x0) returned 0x1 [0087.472] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\hhev8.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\hHev8.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\hhev8.gif.lanran2.0.5")) returned 1 [0087.472] GetLastError () returned 0xb7 [0087.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg", lpFilePart=0x0) returned 0x55 [0087.472] GetLastError () returned 0xb7 [0087.472] SetErrorMode (uMode=0x1) returned 0x0 [0087.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\kco0kx-t.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.472] GetLastError () returned 0x0 [0087.472] GetFileType (hFile=0x210) returned 0x1 [0087.472] GetFileType (hFile=0x210) returned 0x1 [0087.473] ReadFile (in: hFile=0x210, lpBuffer=0x3534380, nNumberOfBytesToRead=0x15fc2, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x3534380*, lpNumberOfBytesRead=0x39eb58*=0x15fc2, lpOverlapped=0x0) returned 1 [0087.473] GetLastError () returned 0x0 [0087.501] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg", lpFilePart=0x0) returned 0x55 [0087.501] GetLastError () returned 0x0 [0087.501] SetErrorMode (uMode=0x1) returned 0x0 [0087.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\kco0kx-t.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.503] GetLastError () returned 0xb7 [0087.503] GetFileType (hFile=0x210) returned 0x1 [0087.503] GetFileType (hFile=0x210) returned 0x1 [0087.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg", lpFilePart=0x0) returned 0x55 [0087.504] GetLastError () returned 0xb7 [0087.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x61 [0087.504] GetLastError () returned 0xb7 [0087.504] SetErrorMode (uMode=0x1) returned 0x0 [0087.504] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\kco0kx-t.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf41b5790, ftCreationTime.dwHighDateTime=0x1d3a065, ftLastAccessTime.dwLowDateTime=0x30149290, ftLastAccessTime.dwHighDateTime=0x1d3ab59, ftLastWriteTime.dwLowDateTime=0x2fd8b60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x15fd0)) returned 1 [0087.504] GetLastError () returned 0xb7 [0087.504] SetErrorMode (uMode=0x0) returned 0x1 [0087.504] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\kco0kx-t.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\kcO0kX-t.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\kco0kx-t.jpg.lanran2.0.5")) returned 1 [0087.505] GetLastError () returned 0xb7 [0087.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif", lpFilePart=0x0) returned 0x5e [0087.505] GetLastError () returned 0xb7 [0087.505] SetErrorMode (uMode=0x1) returned 0x0 [0087.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\ml-82gxwyfnqyhlon.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.505] GetLastError () returned 0x0 [0087.505] GetFileType (hFile=0x210) returned 0x1 [0087.505] GetFileType (hFile=0x210) returned 0x1 [0087.505] ReadFile (in: hFile=0x210, lpBuffer=0x263a070, nNumberOfBytesToRead=0x71f2, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x263a070*, lpNumberOfBytesRead=0x39eb58*=0x71f2, lpOverlapped=0x0) returned 1 [0087.506] GetLastError () returned 0x0 [0087.532] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif", lpFilePart=0x0) returned 0x5e [0087.532] GetLastError () returned 0x0 [0087.532] SetErrorMode (uMode=0x1) returned 0x0 [0087.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\ml-82gxwyfnqyhlon.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.533] GetLastError () returned 0xb7 [0087.535] GetFileType (hFile=0x210) returned 0x1 [0087.535] SetErrorMode (uMode=0x0) returned 0x1 [0087.535] GetFileType (hFile=0x210) returned 0x1 [0087.535] WriteFile (in: hFile=0x210, lpBuffer=0x24ec824*, nNumberOfBytesToWrite=0x7200, lpNumberOfBytesWritten=0x39eb64, lpOverlapped=0x0 | out: lpBuffer=0x24ec824*, lpNumberOfBytesWritten=0x39eb64*=0x7200, lpOverlapped=0x0) returned 1 [0087.536] GetLastError () returned 0xb7 [0087.536] CloseHandle (hObject=0x210) returned 1 [0087.536] GetLastError () returned 0xb7 [0087.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif", lpFilePart=0x0) returned 0x5e [0087.537] GetLastError () returned 0xb7 [0087.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x6a [0087.537] GetLastError () returned 0xb7 [0087.537] SetErrorMode (uMode=0x1) returned 0x0 [0087.537] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\ml-82gxwyfnqyhlon.gif"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb88d0480, ftCreationTime.dwHighDateTime=0x1d3a5a6, ftLastAccessTime.dwLowDateTime=0x8f75e560, ftLastAccessTime.dwHighDateTime=0x1d3a49f, ftLastWriteTime.dwLowDateTime=0x3024e20, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x7200)) returned 1 [0087.537] GetLastError () returned 0xb7 [0087.537] SetErrorMode (uMode=0x0) returned 0x1 [0087.537] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\ml-82gxwyfnqyhlon.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\Ml-82GXwYFnqYhLoN.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\ml-82gxwyfnqyhlon.gif.lanran2.0.5")) returned 1 [0087.537] GetLastError () returned 0xb7 [0087.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg", lpFilePart=0x0) returned 0x54 [0087.537] GetLastError () returned 0xb7 [0087.537] SetErrorMode (uMode=0x1) returned 0x0 [0087.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\u1fjsyz.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.537] GetLastError () returned 0x0 [0087.537] GetFileType (hFile=0x210) returned 0x1 [0087.537] SetErrorMode (uMode=0x0) returned 0x1 [0087.537] GetFileType (hFile=0x210) returned 0x1 [0087.538] GetFileSize (in: hFile=0x210, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0x98e4 [0087.538] GetLastError () returned 0x0 [0087.538] ReadFile (in: hFile=0x210, lpBuffer=0x24f43ec, nNumberOfBytesToRead=0x98e4, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x24f43ec*, lpNumberOfBytesRead=0x39eb58*=0x98e4, lpOverlapped=0x0) returned 1 [0087.538] GetLastError () returned 0x0 [0087.538] CloseHandle (hObject=0x210) returned 1 [0087.538] GetLastError () returned 0x0 [0087.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg", lpFilePart=0x0) returned 0x54 [0087.592] GetLastError () returned 0x0 [0087.592] SetErrorMode (uMode=0x1) returned 0x0 [0087.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\u1fjsyz.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.599] GetLastError () returned 0xb7 [0087.599] GetFileType (hFile=0x210) returned 0x1 [0087.600] GetFileType (hFile=0x210) returned 0x1 [0087.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg", lpFilePart=0x0) returned 0x54 [0087.601] GetLastError () returned 0xb7 [0087.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x60 [0087.601] GetLastError () returned 0xb7 [0087.601] SetErrorMode (uMode=0x1) returned 0x0 [0087.601] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\u1fjsyz.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5be5dda0, ftCreationTime.dwHighDateTime=0x1d3b05b, ftLastAccessTime.dwLowDateTime=0x410e3520, ftLastAccessTime.dwHighDateTime=0x1d3a2ca, ftLastWriteTime.dwLowDateTime=0x30e3500, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x98f0)) returned 1 [0087.601] GetLastError () returned 0xb7 [0087.601] SetErrorMode (uMode=0x0) returned 0x1 [0087.601] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\u1fjsyz.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\U1fjsyz.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\u1fjsyz.jpg.lanran2.0.5")) returned 1 [0087.602] GetLastError () returned 0xb7 [0087.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp", lpFilePart=0x0) returned 0x5c [0087.602] GetLastError () returned 0xb7 [0087.602] SetErrorMode (uMode=0x1) returned 0x0 [0087.602] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\vr-kwpndecd-l4m.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.602] GetLastError () returned 0x0 [0087.602] GetFileType (hFile=0x210) returned 0x1 [0087.602] GetFileType (hFile=0x210) returned 0x1 [0087.602] ReadFile (in: hFile=0x210, lpBuffer=0x25b5ca8, nNumberOfBytesToRead=0x933a, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25b5ca8*, lpNumberOfBytesRead=0x39eb58*=0x933a, lpOverlapped=0x0) returned 1 [0087.603] GetLastError () returned 0x0 [0087.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp", lpFilePart=0x0) returned 0x5c [0087.628] GetLastError () returned 0x0 [0087.628] SetErrorMode (uMode=0x1) returned 0x0 [0087.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\vr-kwpndecd-l4m.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.629] GetLastError () returned 0xb7 [0087.629] GetFileType (hFile=0x210) returned 0x1 [0087.629] GetFileType (hFile=0x210) returned 0x1 [0087.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp", lpFilePart=0x0) returned 0x5c [0087.631] GetLastError () returned 0xb7 [0087.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp.LanRan2.0.5", lpFilePart=0x0) returned 0x68 [0087.631] GetLastError () returned 0xb7 [0087.631] SetErrorMode (uMode=0x1) returned 0x0 [0087.631] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\vr-kwpndecd-l4m.bmp"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fff220, ftCreationTime.dwHighDateTime=0x1d3aa5f, ftLastAccessTime.dwLowDateTime=0x1d943f50, ftLastAccessTime.dwHighDateTime=0x1d3a97c, ftLastWriteTime.dwLowDateTime=0x3109660, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x9340)) returned 1 [0087.631] GetLastError () returned 0xb7 [0087.631] SetErrorMode (uMode=0x0) returned 0x1 [0087.631] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\vr-kwpndecd-l4m.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\vR-kWPndecD-L4M.bmp.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\vr-kwpndecd-l4m.bmp.lanran2.0.5")) returned 1 [0087.631] GetLastError () returned 0xb7 [0087.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp", lpFilePart=0x0) returned 0x60 [0087.631] GetLastError () returned 0xb7 [0087.631] SetErrorMode (uMode=0x1) returned 0x0 [0087.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\wknzeogznere45_5yin.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.632] GetLastError () returned 0x0 [0087.632] GetFileType (hFile=0x210) returned 0x1 [0087.632] GetFileType (hFile=0x210) returned 0x1 [0087.632] ReadFile (in: hFile=0x210, lpBuffer=0x2675204, nNumberOfBytesToRead=0x13f3e, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x2675204*, lpNumberOfBytesRead=0x39eb58*=0x13f3e, lpOverlapped=0x0) returned 1 [0087.632] GetLastError () returned 0x0 [0087.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp", lpFilePart=0x0) returned 0x60 [0087.694] GetLastError () returned 0x0 [0087.694] SetErrorMode (uMode=0x1) returned 0x0 [0087.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\wknzeogznere45_5yin.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x210 [0087.695] GetLastError () returned 0xb7 [0087.696] GetFileType (hFile=0x210) returned 0x1 [0087.696] GetFileType (hFile=0x210) returned 0x1 [0087.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp", lpFilePart=0x0) returned 0x60 [0087.697] GetLastError () returned 0xb7 [0087.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp.LanRan2.0.5", lpFilePart=0x0) returned 0x6c [0087.697] GetLastError () returned 0xb7 [0087.697] SetErrorMode (uMode=0x1) returned 0x0 [0087.697] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\wknzeogznere45_5yin.bmp"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9556cec0, ftCreationTime.dwHighDateTime=0x1d3a613, ftLastAccessTime.dwLowDateTime=0xf54da270, ftLastAccessTime.dwHighDateTime=0x1d3ae0d, ftLastWriteTime.dwLowDateTime=0x31c7d40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x13f40)) returned 1 [0087.697] GetLastError () returned 0xb7 [0087.697] SetErrorMode (uMode=0x0) returned 0x1 [0087.698] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\wknzeogznere45_5yin.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\lzwU1zxUs7HZu2wbFCQ\\zDFQPSXm44McM\\WKnzeOgZNEre45_5yIn.bmp.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\lzwu1zxus7hzu2wbfcq\\zdfqpsxm44mcm\\wknzeogznere45_5yin.bmp.lanran2.0.5")) returned 1 [0087.698] GetLastError () returned 0xb7 [0087.698] SHGetFolderPathW (in: hwnd=0x0, csidl=0, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x0 [0087.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0087.699] GetLastError () returned 0x3f0 [0087.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0087.699] GetLastError () returned 0x3f0 [0087.699] SetErrorMode (uMode=0x1) returned 0x0 [0087.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c330 [0087.699] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.700] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.700] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.701] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.701] GetLastError () returned 0x3f0 [0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.702] GetLastError () returned 0x3f0 [0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.702] GetLastError () returned 0x3f0 [0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0087.702] GetLastError () returned 0x12 [0087.702] FindClose (in: hFindFile=0x42c330 | out: hFindFile=0x42c330) returned 1 [0087.702] SetErrorMode (uMode=0x0) returned 0x1 [0087.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0087.702] GetLastError () returned 0x12 [0087.702] SetErrorMode (uMode=0x1) returned 0x0 [0087.702] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c330 [0087.702] GetLastError () returned 0x12 [0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.702] GetLastError () returned 0x12 [0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.702] GetLastError () returned 0x12 [0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.702] GetLastError () returned 0x12 [0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.702] GetLastError () returned 0x12 [0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.702] GetLastError () returned 0x12 [0087.702] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.703] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.703] GetLastError () returned 0x12 [0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.704] GetLastError () returned 0x12 [0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.704] GetLastError () returned 0x12 [0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.704] GetLastError () returned 0x12 [0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.704] GetLastError () returned 0x12 [0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.704] GetLastError () returned 0x12 [0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.704] GetLastError () returned 0x12 [0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.704] GetLastError () returned 0x12 [0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.704] GetLastError () returned 0x12 [0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.704] GetLastError () returned 0x12 [0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.704] GetLastError () returned 0x12 [0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.704] GetLastError () returned 0x12 [0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.704] GetLastError () returned 0x12 [0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0087.704] GetLastError () returned 0x12 [0087.704] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0087.704] GetLastError () returned 0x12 [0087.704] FindClose (in: hFindFile=0x42c330 | out: hFindFile=0x42c330) returned 1 [0087.704] SetErrorMode (uMode=0x0) returned 0x1 [0087.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt", lpFilePart=0x0) returned 0x31 [0087.705] GetLastError () returned 0x12 [0087.705] SetErrorMode (uMode=0x1) returned 0x0 [0087.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01zwrvx.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0087.705] GetLastError () returned 0x0 [0087.705] GetFileType (hFile=0x21c) returned 0x1 [0087.705] SetErrorMode (uMode=0x0) returned 0x1 [0087.705] GetFileType (hFile=0x21c) returned 0x1 [0087.705] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0x5a60 [0087.705] GetLastError () returned 0x0 [0087.705] ReadFile (in: hFile=0x21c, lpBuffer=0x2573230, nNumberOfBytesToRead=0x5a60, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2573230*, lpNumberOfBytesRead=0x39ec18*=0x5a60, lpOverlapped=0x0) returned 1 [0087.706] GetLastError () returned 0x0 [0087.706] CloseHandle (hObject=0x21c) returned 1 [0087.706] GetLastError () returned 0x0 [0087.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt", lpFilePart=0x0) returned 0x31 [0087.758] GetLastError () returned 0x0 [0087.758] SetErrorMode (uMode=0x1) returned 0x0 [0087.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01zwrvx.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0087.760] GetLastError () returned 0xb7 [0087.760] GetFileType (hFile=0x21c) returned 0x1 [0087.760] GetFileType (hFile=0x21c) returned 0x1 [0087.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt", lpFilePart=0x0) returned 0x31 [0087.761] GetLastError () returned 0xb7 [0087.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt.LanRan2.0.5", lpFilePart=0x0) returned 0x3d [0087.761] GetLastError () returned 0xb7 [0087.761] SetErrorMode (uMode=0x1) returned 0x0 [0087.761] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01zwrvx.ppt"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2def79d0, ftCreationTime.dwHighDateTime=0x1d3a852, ftLastAccessTime.dwLowDateTime=0x6be64ab0, ftLastAccessTime.dwHighDateTime=0x1d3a14b, ftLastWriteTime.dwLowDateTime=0x32602c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x5a70)) returned 1 [0087.761] GetLastError () returned 0xb7 [0087.761] SetErrorMode (uMode=0x0) returned 0x1 [0087.761] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01zwrvx.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\01zWrvx.ppt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\01zwrvx.ppt.lanran2.0.5")) returned 1 [0087.762] GetLastError () returned 0xb7 [0087.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4", lpFilePart=0x0) returned 0x3c [0087.762] GetLastError () returned 0xb7 [0087.762] SetErrorMode (uMode=0x1) returned 0x0 [0087.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1g7fsw9r5ibyucv1g3.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0087.762] GetLastError () returned 0x0 [0087.762] GetFileType (hFile=0x21c) returned 0x1 [0087.763] GetFileType (hFile=0x21c) returned 0x1 [0087.763] ReadFile (in: hFile=0x21c, lpBuffer=0x261d294, nNumberOfBytesToRead=0xa4da, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x261d294*, lpNumberOfBytesRead=0x39ec18*=0xa4da, lpOverlapped=0x0) returned 1 [0087.763] GetLastError () returned 0x0 [0087.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4", lpFilePart=0x0) returned 0x3c [0087.796] GetLastError () returned 0x0 [0087.796] SetErrorMode (uMode=0x1) returned 0x0 [0087.797] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1g7fsw9r5ibyucv1g3.mp4"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0087.798] GetLastError () returned 0xb7 [0087.798] GetFileType (hFile=0x21c) returned 0x1 [0087.798] GetFileType (hFile=0x21c) returned 0x1 [0087.799] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4", lpFilePart=0x0) returned 0x3c [0087.799] GetLastError () returned 0xb7 [0087.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4.LanRan2.0.5", lpFilePart=0x0) returned 0x48 [0087.800] GetLastError () returned 0xb7 [0087.800] SetErrorMode (uMode=0x1) returned 0x0 [0087.800] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1g7fsw9r5ibyucv1g3.mp4"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565bee40, ftCreationTime.dwHighDateTime=0x1d3af31, ftLastAccessTime.dwLowDateTime=0xbe6d0200, ftLastAccessTime.dwHighDateTime=0x1d3a863, ftLastWriteTime.dwLowDateTime=0x32ac580, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xa4e0)) returned 1 [0087.800] GetLastError () returned 0xb7 [0087.800] SetErrorMode (uMode=0x0) returned 0x1 [0087.800] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1g7fsw9r5ibyucv1g3.mp4"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1G7fsw9R5iByUcV1g3.mp4.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1g7fsw9r5ibyucv1g3.mp4.lanran2.0.5")) returned 1 [0087.801] GetLastError () returned 0xb7 [0087.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg", lpFilePart=0x0) returned 0x35 [0087.801] GetLastError () returned 0xb7 [0087.801] SetErrorMode (uMode=0x1) returned 0x0 [0087.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7sctepfgj-s.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0087.801] GetLastError () returned 0x0 [0087.801] GetFileType (hFile=0x21c) returned 0x1 [0087.801] GetFileType (hFile=0x21c) returned 0x1 [0087.801] ReadFile (in: hFile=0x21c, lpBuffer=0x26e306c, nNumberOfBytesToRead=0x7b21, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26e306c*, lpNumberOfBytesRead=0x39ec18*=0x7b21, lpOverlapped=0x0) returned 1 [0087.802] GetLastError () returned 0x0 [0087.832] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg", lpFilePart=0x0) returned 0x35 [0087.832] GetLastError () returned 0x0 [0087.832] SetErrorMode (uMode=0x1) returned 0x0 [0087.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7sctepfgj-s.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0087.833] GetLastError () returned 0xb7 [0087.833] GetFileType (hFile=0x21c) returned 0x1 [0087.833] GetFileType (hFile=0x21c) returned 0x1 [0087.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg", lpFilePart=0x0) returned 0x35 [0087.834] GetLastError () returned 0xb7 [0087.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x41 [0087.834] GetLastError () returned 0xb7 [0087.834] SetErrorMode (uMode=0x1) returned 0x0 [0087.834] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7sctepfgj-s.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd6b4a0, ftCreationTime.dwHighDateTime=0x1d3a279, ftLastAccessTime.dwLowDateTime=0x3edf37d0, ftLastAccessTime.dwHighDateTime=0x1d3af5a, ftLastWriteTime.dwLowDateTime=0x32f8840, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x7b30)) returned 1 [0087.835] GetLastError () returned 0xb7 [0087.835] SetErrorMode (uMode=0x0) returned 0x1 [0087.835] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7sctepfgj-s.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\7SCtEpFgj-s.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\7sctepfgj-s.jpg.lanran2.0.5")) returned 1 [0087.836] GetLastError () returned 0xb7 [0087.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", lpFilePart=0x0) returned 0x38 [0087.836] GetLastError () returned 0xb7 [0087.836] SetErrorMode (uMode=0x1) returned 0x0 [0087.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\@___readme___@.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0087.836] GetLastError () returned 0x0 [0087.836] GetFileType (hFile=0x21c) returned 0x1 [0087.836] GetFileType (hFile=0x21c) returned 0x1 [0087.836] ReadFile (in: hFile=0x21c, lpBuffer=0x2799a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2799a88*, lpNumberOfBytesRead=0x39ec18*=0x696, lpOverlapped=0x0) returned 1 [0087.836] GetLastError () returned 0x0 [0087.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", lpFilePart=0x0) returned 0x38 [0087.895] GetLastError () returned 0x0 [0087.895] SetErrorMode (uMode=0x1) returned 0x0 [0087.896] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\@___readme___@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0087.896] GetLastError () returned 0xb7 [0087.897] GetFileType (hFile=0x21c) returned 0x1 [0087.897] GetFileType (hFile=0x21c) returned 0x1 [0087.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", lpFilePart=0x0) returned 0x38 [0087.898] GetLastError () returned 0xb7 [0087.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt.LanRan2.0.5", lpFilePart=0x0) returned 0x44 [0087.898] GetLastError () returned 0xb7 [0087.898] SetErrorMode (uMode=0x1) returned 0x0 [0087.898] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\@___readme___@.txt"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9a082c0, ftCreationTime.dwHighDateTime=0x1d41168, ftLastAccessTime.dwLowDateTime=0xf9a082c0, ftLastAccessTime.dwHighDateTime=0x1d41168, ftLastWriteTime.dwLowDateTime=0x33b6f20, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x6a0)) returned 1 [0087.898] GetLastError () returned 0xb7 [0087.898] SetErrorMode (uMode=0x0) returned 0x1 [0087.898] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\@___readme___@.txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\@___readme___@.txt.lanran2.0.5")) returned 1 [0087.899] GetLastError () returned 0xb7 [0087.899] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv", lpFilePart=0x0) returned 0x31 [0087.899] GetLastError () returned 0xb7 [0087.899] SetErrorMode (uMode=0x1) returned 0x0 [0087.899] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dmiwofz.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0087.899] GetLastError () returned 0x0 [0087.899] GetFileType (hFile=0x21c) returned 0x1 [0087.899] GetFileType (hFile=0x21c) returned 0x1 [0087.899] ReadFile (in: hFile=0x21c, lpBuffer=0x2577330, nNumberOfBytesToRead=0xbec1, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2577330*, lpNumberOfBytesRead=0x39ec18*=0xbec1, lpOverlapped=0x0) returned 1 [0087.900] GetLastError () returned 0x0 [0087.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv", lpFilePart=0x0) returned 0x31 [0087.925] GetLastError () returned 0x0 [0087.925] SetErrorMode (uMode=0x1) returned 0x0 [0087.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dmiwofz.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0087.927] GetLastError () returned 0xb7 [0087.927] GetFileType (hFile=0x21c) returned 0x1 [0087.927] GetFileType (hFile=0x21c) returned 0x1 [0087.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv", lpFilePart=0x0) returned 0x31 [0087.928] GetLastError () returned 0xb7 [0087.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv.LanRan2.0.5", lpFilePart=0x0) returned 0x3d [0087.928] GetLastError () returned 0xb7 [0087.928] SetErrorMode (uMode=0x1) returned 0x0 [0087.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dmiwofz.csv"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56305c0, ftCreationTime.dwHighDateTime=0x1d3a22d, ftLastAccessTime.dwLowDateTime=0x574f0280, ftLastAccessTime.dwHighDateTime=0x1d3a6ba, ftLastWriteTime.dwLowDateTime=0x33dd080, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xbed0)) returned 1 [0087.928] GetLastError () returned 0xb7 [0087.928] SetErrorMode (uMode=0x0) returned 0x1 [0087.928] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dmiwofz.csv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\dMiWOFZ.csv.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\dmiwofz.csv.lanran2.0.5")) returned 1 [0087.929] GetLastError () returned 0xb7 [0087.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp", lpFilePart=0x0) returned 0x34 [0087.929] GetLastError () returned 0xb7 [0087.929] SetErrorMode (uMode=0x1) returned 0x0 [0087.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e wxc788va.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0087.929] GetLastError () returned 0x0 [0087.929] GetFileType (hFile=0x21c) returned 0x1 [0087.930] GetFileType (hFile=0x21c) returned 0x1 [0087.930] ReadFile (in: hFile=0x21c, lpBuffer=0x262f02c, nNumberOfBytesToRead=0x4a18, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x262f02c*, lpNumberOfBytesRead=0x39ec18*=0x4a18, lpOverlapped=0x0) returned 1 [0087.930] GetLastError () returned 0x0 [0087.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp", lpFilePart=0x0) returned 0x34 [0087.955] GetLastError () returned 0x0 [0087.955] SetErrorMode (uMode=0x1) returned 0x0 [0087.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e wxc788va.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0087.956] GetLastError () returned 0xb7 [0087.956] GetFileType (hFile=0x21c) returned 0x1 [0087.956] GetFileType (hFile=0x21c) returned 0x1 [0087.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp", lpFilePart=0x0) returned 0x34 [0087.957] GetLastError () returned 0xb7 [0087.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp.LanRan2.0.5", lpFilePart=0x0) returned 0x40 [0087.957] GetLastError () returned 0xb7 [0087.957] SetErrorMode (uMode=0x1) returned 0x0 [0087.957] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e wxc788va.bmp"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88835eb0, ftCreationTime.dwHighDateTime=0x1d3add0, ftLastAccessTime.dwLowDateTime=0x64997df0, ftLastAccessTime.dwHighDateTime=0x1d3a348, ftLastWriteTime.dwLowDateTime=0x3429340, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x4a20)) returned 1 [0087.957] GetLastError () returned 0xb7 [0087.957] SetErrorMode (uMode=0x0) returned 0x1 [0087.957] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e wxc788va.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E wXC788vA.bmp.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e wxc788va.bmp.lanran2.0.5")) returned 1 [0087.958] GetLastError () returned 0xb7 [0087.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png", lpFilePart=0x0) returned 0x3d [0087.958] GetLastError () returned 0xb7 [0087.958] SetErrorMode (uMode=0x1) returned 0x0 [0087.958] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ecsqc_ysqethy4sfp q.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0087.959] GetLastError () returned 0x0 [0087.959] GetFileType (hFile=0x21c) returned 0x1 [0087.959] GetFileType (hFile=0x21c) returned 0x1 [0087.959] ReadFile (in: hFile=0x21c, lpBuffer=0x26d2d34, nNumberOfBytesToRead=0x2889, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26d2d34*, lpNumberOfBytesRead=0x39ec18*=0x2889, lpOverlapped=0x0) returned 1 [0087.959] GetLastError () returned 0x0 [0088.018] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png", lpFilePart=0x0) returned 0x3d [0088.018] GetLastError () returned 0x0 [0088.018] SetErrorMode (uMode=0x1) returned 0x0 [0088.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ecsqc_ysqethy4sfp q.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.019] GetLastError () returned 0xb7 [0088.019] GetFileType (hFile=0x21c) returned 0x1 [0088.019] GetFileType (hFile=0x21c) returned 0x1 [0088.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png", lpFilePart=0x0) returned 0x3d [0088.020] GetLastError () returned 0xb7 [0088.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png.LanRan2.0.5", lpFilePart=0x0) returned 0x49 [0088.020] GetLastError () returned 0xb7 [0088.020] SetErrorMode (uMode=0x1) returned 0x0 [0088.020] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ecsqc_ysqethy4sfp q.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9f7740, ftCreationTime.dwHighDateTime=0x1d3a080, ftLastAccessTime.dwLowDateTime=0xc177deb0, ftLastAccessTime.dwHighDateTime=0x1d3a44a, ftLastWriteTime.dwLowDateTime=0x34c18c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x2890)) returned 1 [0088.020] GetLastError () returned 0xb7 [0088.020] SetErrorMode (uMode=0x0) returned 0x1 [0088.021] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ecsqc_ysqethy4sfp q.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\eCSQc_YSQetHy4sfP Q.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ecsqc_ysqethy4sfp q.png.lanran2.0.5")) returned 1 [0088.021] GetLastError () returned 0xb7 [0088.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3", lpFilePart=0x0) returned 0x32 [0088.022] GetLastError () returned 0xb7 [0088.022] SetErrorMode (uMode=0x1) returned 0x0 [0088.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdernccw.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.022] GetLastError () returned 0x0 [0088.022] GetFileType (hFile=0x21c) returned 0x1 [0088.022] GetFileType (hFile=0x21c) returned 0x1 [0088.022] ReadFile (in: hFile=0x21c, lpBuffer=0x256c2d8, nNumberOfBytesToRead=0x2efa, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x256c2d8*, lpNumberOfBytesRead=0x39ec18*=0x2efa, lpOverlapped=0x0) returned 1 [0088.023] GetLastError () returned 0x0 [0088.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3", lpFilePart=0x0) returned 0x32 [0088.047] GetLastError () returned 0x0 [0088.047] SetErrorMode (uMode=0x1) returned 0x0 [0088.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdernccw.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.049] GetLastError () returned 0xb7 [0088.049] GetFileType (hFile=0x21c) returned 0x1 [0088.049] GetFileType (hFile=0x21c) returned 0x1 [0088.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3", lpFilePart=0x0) returned 0x32 [0088.050] GetLastError () returned 0xb7 [0088.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x3e [0088.050] GetLastError () returned 0xb7 [0088.050] SetErrorMode (uMode=0x1) returned 0x0 [0088.050] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdernccw.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x570b4ba0, ftCreationTime.dwHighDateTime=0x1d3af32, ftLastAccessTime.dwLowDateTime=0xbc856080, ftLastAccessTime.dwHighDateTime=0x1d3aea9, ftLastWriteTime.dwLowDateTime=0x350db80, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x2f00)) returned 1 [0088.050] GetLastError () returned 0xb7 [0088.050] SetErrorMode (uMode=0x0) returned 0x1 [0088.050] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdernccw.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\FDernCcw.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fdernccw.mp3.lanran2.0.5")) returned 1 [0088.051] GetLastError () returned 0xb7 [0088.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt", lpFilePart=0x0) returned 0x2e [0088.051] GetLastError () returned 0xb7 [0088.051] SetErrorMode (uMode=0x1) returned 0x0 [0088.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fukr.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.051] GetLastError () returned 0x0 [0088.051] GetFileType (hFile=0x21c) returned 0x1 [0088.051] GetFileType (hFile=0x21c) returned 0x1 [0088.051] ReadFile (in: hFile=0x21c, lpBuffer=0x2605e7c, nNumberOfBytesToRead=0x1e72, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2605e7c*, lpNumberOfBytesRead=0x39ec18*=0x1e72, lpOverlapped=0x0) returned 1 [0088.052] GetLastError () returned 0x0 [0088.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt", lpFilePart=0x0) returned 0x2e [0088.088] GetLastError () returned 0x0 [0088.088] SetErrorMode (uMode=0x1) returned 0x0 [0088.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fukr.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.089] GetLastError () returned 0xb7 [0088.089] GetFileType (hFile=0x21c) returned 0x1 [0088.089] GetFileType (hFile=0x21c) returned 0x1 [0088.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt", lpFilePart=0x0) returned 0x2e [0088.090] GetLastError () returned 0xb7 [0088.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt.LanRan2.0.5", lpFilePart=0x0) returned 0x3a [0088.090] GetLastError () returned 0xb7 [0088.090] SetErrorMode (uMode=0x1) returned 0x0 [0088.090] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fukr.odt"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f34da40, ftCreationTime.dwHighDateTime=0x1d3a190, ftLastAccessTime.dwLowDateTime=0xbabbc900, ftLastAccessTime.dwHighDateTime=0x1d3a090, ftLastWriteTime.dwLowDateTime=0x357ffa0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x1e80)) returned 1 [0088.091] GetLastError () returned 0xb7 [0088.091] SetErrorMode (uMode=0x0) returned 0x1 [0088.091] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fukr.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fukr.odt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fukr.odt.lanran2.0.5")) returned 1 [0088.092] GetLastError () returned 0xb7 [0088.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx", lpFilePart=0x0) returned 0x35 [0088.092] GetLastError () returned 0xb7 [0088.092] SetErrorMode (uMode=0x1) returned 0x0 [0088.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jww ehsrfj.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.092] GetLastError () returned 0x0 [0088.092] GetFileType (hFile=0x21c) returned 0x1 [0088.092] GetFileType (hFile=0x21c) returned 0x1 [0088.092] ReadFile (in: hFile=0x21c, lpBuffer=0x2699588, nNumberOfBytesToRead=0xe58c, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2699588*, lpNumberOfBytesRead=0x39ec18*=0xe58c, lpOverlapped=0x0) returned 1 [0088.093] GetLastError () returned 0x0 [0088.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx", lpFilePart=0x0) returned 0x35 [0088.131] GetLastError () returned 0x0 [0088.131] SetErrorMode (uMode=0x1) returned 0x0 [0088.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jww ehsrfj.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.133] GetLastError () returned 0xb7 [0088.133] GetFileType (hFile=0x21c) returned 0x1 [0088.133] SetErrorMode (uMode=0x0) returned 0x1 [0088.133] GetFileType (hFile=0x21c) returned 0x1 [0088.133] WriteFile (in: hFile=0x21c, lpBuffer=0x2557b30*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x39ec24, lpOverlapped=0x0 | out: lpBuffer=0x2557b30*, lpNumberOfBytesWritten=0x39ec24*=0xe590, lpOverlapped=0x0) returned 1 [0088.134] GetLastError () returned 0xb7 [0088.134] CloseHandle (hObject=0x21c) returned 1 [0088.136] GetLastError () returned 0xb7 [0088.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx", lpFilePart=0x0) returned 0x35 [0088.136] GetLastError () returned 0xb7 [0088.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x41 [0088.136] GetLastError () returned 0xb7 [0088.136] SetErrorMode (uMode=0x1) returned 0x0 [0088.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jww ehsrfj.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1a5010, ftCreationTime.dwHighDateTime=0x1d3a5d3, ftLastAccessTime.dwLowDateTime=0xd0a1c360, ftLastAccessTime.dwHighDateTime=0x1d3a026, ftLastWriteTime.dwLowDateTime=0x35f23c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xe590)) returned 1 [0088.136] GetLastError () returned 0xb7 [0088.136] SetErrorMode (uMode=0x0) returned 0x1 [0088.137] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jww ehsrfj.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Jww eHSrFj.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jww ehsrfj.pptx.lanran2.0.5")) returned 1 [0088.138] GetLastError () returned 0xb7 [0088.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38 [0088.138] GetLastError () returned 0xb7 [0088.138] SetErrorMode (uMode=0x1) returned 0x0 [0088.138] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.138] GetLastError () returned 0x0 [0088.138] GetFileType (hFile=0x21c) returned 0x1 [0088.138] SetErrorMode (uMode=0x0) returned 0x1 [0088.138] GetFileType (hFile=0x21c) returned 0x1 [0088.138] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0x34400 [0088.138] GetLastError () returned 0x0 [0088.140] ReadFile (in: hFile=0x21c, lpBuffer=0x36149f0, nNumberOfBytesToRead=0x34400, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x36149f0*, lpNumberOfBytesRead=0x39ec18*=0x34400, lpOverlapped=0x0) returned 1 [0088.141] GetLastError () returned 0x0 [0088.141] CloseHandle (hObject=0x21c) returned 1 [0088.141] GetLastError () returned 0x0 [0088.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38 [0088.229] GetLastError () returned 0x0 [0088.229] SetErrorMode (uMode=0x1) returned 0x0 [0088.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0088.230] GetLastError () returned 0x20 [0088.232] SetErrorMode (uMode=0x0) returned 0x1 [0088.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif", lpFilePart=0x0) returned 0x3e [0088.232] GetLastError () returned 0x20 [0088.232] SetErrorMode (uMode=0x1) returned 0x0 [0088.232] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o1dnin_torm0c32phrbo.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.232] GetLastError () returned 0x0 [0088.232] GetFileType (hFile=0x21c) returned 0x1 [0088.232] SetErrorMode (uMode=0x0) returned 0x1 [0088.232] GetFileType (hFile=0x21c) returned 0x1 [0088.232] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0x9126 [0088.232] GetLastError () returned 0x0 [0088.232] ReadFile (in: hFile=0x21c, lpBuffer=0x25ef064, nNumberOfBytesToRead=0x9126, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25ef064*, lpNumberOfBytesRead=0x39ec18*=0x9126, lpOverlapped=0x0) returned 1 [0088.233] GetLastError () returned 0x0 [0088.233] CloseHandle (hObject=0x21c) returned 1 [0088.233] GetLastError () returned 0x0 [0088.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif", lpFilePart=0x0) returned 0x3e [0088.277] GetLastError () returned 0x0 [0088.277] SetErrorMode (uMode=0x1) returned 0x0 [0088.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o1dnin_torm0c32phrbo.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.278] GetLastError () returned 0xb7 [0088.279] GetFileType (hFile=0x21c) returned 0x1 [0088.279] GetFileType (hFile=0x21c) returned 0x1 [0088.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif", lpFilePart=0x0) returned 0x3e [0088.280] GetLastError () returned 0xb7 [0088.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x4a [0088.280] GetLastError () returned 0xb7 [0088.280] SetErrorMode (uMode=0x1) returned 0x0 [0088.280] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o1dnin_torm0c32phrbo.gif"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec4ca1b0, ftCreationTime.dwHighDateTime=0x1d3a243, ftLastAccessTime.dwLowDateTime=0x544dee20, ftLastAccessTime.dwHighDateTime=0x1d3a944, ftLastWriteTime.dwLowDateTime=0x3749020, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x9130)) returned 1 [0088.280] GetLastError () returned 0xb7 [0088.280] SetErrorMode (uMode=0x0) returned 0x1 [0088.280] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o1dnin_torm0c32phrbo.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\O1DNiN_torm0c32phrbO.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\o1dnin_torm0c32phrbo.gif.lanran2.0.5")) returned 1 [0088.281] GetLastError () returned 0xb7 [0088.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf", lpFilePart=0x0) returned 0x39 [0088.281] GetLastError () returned 0xb7 [0088.281] SetErrorMode (uMode=0x1) returned 0x0 [0088.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\os5w-yo1b1y1zoj.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.281] GetLastError () returned 0x0 [0088.281] GetFileType (hFile=0x21c) returned 0x1 [0088.281] GetFileType (hFile=0x21c) returned 0x1 [0088.281] ReadFile (in: hFile=0x21c, lpBuffer=0x26ad824, nNumberOfBytesToRead=0xfc19, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26ad824*, lpNumberOfBytesRead=0x39ec18*=0xfc19, lpOverlapped=0x0) returned 1 [0088.282] GetLastError () returned 0x0 [0088.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf", lpFilePart=0x0) returned 0x39 [0088.301] GetLastError () returned 0x0 [0088.301] SetErrorMode (uMode=0x1) returned 0x0 [0088.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\os5w-yo1b1y1zoj.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.302] GetLastError () returned 0xb7 [0088.302] GetFileType (hFile=0x21c) returned 0x1 [0088.302] SetErrorMode (uMode=0x0) returned 0x1 [0088.302] GetFileType (hFile=0x21c) returned 0x1 [0088.302] WriteFile (in: hFile=0x21c, lpBuffer=0x2566060*, nNumberOfBytesToWrite=0xfc20, lpNumberOfBytesWritten=0x39ec24, lpOverlapped=0x0 | out: lpBuffer=0x2566060*, lpNumberOfBytesWritten=0x39ec24*=0xfc20, lpOverlapped=0x0) returned 1 [0088.303] GetLastError () returned 0xb7 [0088.303] CloseHandle (hObject=0x21c) returned 1 [0088.307] GetLastError () returned 0xb7 [0088.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf", lpFilePart=0x0) returned 0x39 [0088.307] GetLastError () returned 0xb7 [0088.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf.LanRan2.0.5", lpFilePart=0x0) returned 0x45 [0088.307] GetLastError () returned 0xb7 [0088.307] SetErrorMode (uMode=0x1) returned 0x0 [0088.308] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\os5w-yo1b1y1zoj.rtf"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d4fa2e0, ftCreationTime.dwHighDateTime=0x1d3a5b1, ftLastAccessTime.dwLowDateTime=0xc742c990, ftLastAccessTime.dwHighDateTime=0x1d39fe0, ftLastWriteTime.dwLowDateTime=0x37952e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xfc20)) returned 1 [0088.308] GetLastError () returned 0xb7 [0088.308] SetErrorMode (uMode=0x0) returned 0x1 [0088.308] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\os5w-yo1b1y1zoj.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\OS5w-yo1B1y1Zoj.rtf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\os5w-yo1b1y1zoj.rtf.lanran2.0.5")) returned 1 [0088.308] GetLastError () returned 0xb7 [0088.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg", lpFilePart=0x0) returned 0x32 [0088.308] GetLastError () returned 0xb7 [0088.308] SetErrorMode (uMode=0x1) returned 0x0 [0088.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pfd82kmu.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.309] GetLastError () returned 0x0 [0088.309] GetFileType (hFile=0x21c) returned 0x1 [0088.309] SetErrorMode (uMode=0x0) returned 0x1 [0088.309] GetFileType (hFile=0x21c) returned 0x1 [0088.309] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0x1317b [0088.309] GetLastError () returned 0x0 [0088.309] ReadFile (in: hFile=0x21c, lpBuffer=0x25764f0, nNumberOfBytesToRead=0x1317b, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25764f0*, lpNumberOfBytesRead=0x39ec18*=0x1317b, lpOverlapped=0x0) returned 1 [0088.310] GetLastError () returned 0x0 [0088.310] CloseHandle (hObject=0x21c) returned 1 [0088.310] GetLastError () returned 0x0 [0088.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg", lpFilePart=0x0) returned 0x32 [0088.360] GetLastError () returned 0x0 [0088.360] SetErrorMode (uMode=0x1) returned 0x0 [0088.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pfd82kmu.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.362] GetLastError () returned 0xb7 [0088.362] GetFileType (hFile=0x21c) returned 0x1 [0088.362] GetFileType (hFile=0x21c) returned 0x1 [0088.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg", lpFilePart=0x0) returned 0x32 [0088.364] GetLastError () returned 0xb7 [0088.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x3e [0088.364] GetLastError () returned 0xb7 [0088.364] SetErrorMode (uMode=0x1) returned 0x0 [0088.364] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pfd82kmu.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d280c50, ftCreationTime.dwHighDateTime=0x1d3abee, ftLastAccessTime.dwLowDateTime=0x20db6620, ftLastAccessTime.dwHighDateTime=0x1d3a72e, ftLastWriteTime.dwLowDateTime=0x3807700, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x13180)) returned 1 [0088.364] GetLastError () returned 0xb7 [0088.364] SetErrorMode (uMode=0x0) returned 0x1 [0088.364] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pfd82kmu.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PFD82kmu.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pfd82kmu.jpg.lanran2.0.5")) returned 1 [0088.366] GetLastError () returned 0xb7 [0088.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx", lpFilePart=0x0) returned 0x3d [0088.366] GetLastError () returned 0xb7 [0088.366] SetErrorMode (uMode=0x1) returned 0x0 [0088.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\satcx9nutaaxstwmxb.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.366] GetLastError () returned 0x0 [0088.366] GetFileType (hFile=0x21c) returned 0x1 [0088.366] GetFileType (hFile=0x21c) returned 0x1 [0088.366] ReadFile (in: hFile=0x21c, lpBuffer=0x264ace0, nNumberOfBytesToRead=0x8499, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x264ace0*, lpNumberOfBytesRead=0x39ec18*=0x8499, lpOverlapped=0x0) returned 1 [0088.367] GetLastError () returned 0x0 [0088.393] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx", lpFilePart=0x0) returned 0x3d [0088.393] GetLastError () returned 0x0 [0088.393] SetErrorMode (uMode=0x1) returned 0x0 [0088.393] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\satcx9nutaaxstwmxb.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.395] GetLastError () returned 0xb7 [0088.395] GetFileType (hFile=0x21c) returned 0x1 [0088.395] GetFileType (hFile=0x21c) returned 0x1 [0088.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx", lpFilePart=0x0) returned 0x3d [0088.396] GetLastError () returned 0xb7 [0088.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x49 [0088.396] GetLastError () returned 0xb7 [0088.396] SetErrorMode (uMode=0x1) returned 0x0 [0088.396] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\satcx9nutaaxstwmxb.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f36b9a0, ftCreationTime.dwHighDateTime=0x1d3a7ab, ftLastAccessTime.dwLowDateTime=0xa16d20e0, ftLastAccessTime.dwHighDateTime=0x1d3a9fd, ftLastWriteTime.dwLowDateTime=0x38539c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x84a0)) returned 1 [0088.396] GetLastError () returned 0xb7 [0088.396] SetErrorMode (uMode=0x0) returned 0x1 [0088.396] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\satcx9nutaaxstwmxb.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\SaTcx9nUTAAxStWMXB.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\satcx9nutaaxstwmxb.pptx.lanran2.0.5")) returned 1 [0088.397] GetLastError () returned 0xb7 [0088.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt", lpFilePart=0x0) returned 0x36 [0088.397] GetLastError () returned 0xb7 [0088.397] SetErrorMode (uMode=0x1) returned 0x0 [0088.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vjxpznfyv9dc.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.398] GetLastError () returned 0x0 [0088.398] GetFileType (hFile=0x21c) returned 0x1 [0088.398] GetFileType (hFile=0x21c) returned 0x1 [0088.400] ReadFile (in: hFile=0x21c, lpBuffer=0x24f1804, nNumberOfBytesToRead=0x99db, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x24f1804*, lpNumberOfBytesRead=0x39ec18*=0x99db, lpOverlapped=0x0) returned 1 [0088.401] GetLastError () returned 0x0 [0088.401] CloseHandle (hObject=0x21c) returned 1 [0088.401] GetLastError () returned 0x0 [0088.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt", lpFilePart=0x0) returned 0x36 [0088.454] GetLastError () returned 0x0 [0088.454] SetErrorMode (uMode=0x1) returned 0x0 [0088.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vjxpznfyv9dc.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.456] GetLastError () returned 0xb7 [0088.456] GetFileType (hFile=0x21c) returned 0x1 [0088.456] GetFileType (hFile=0x21c) returned 0x1 [0088.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt", lpFilePart=0x0) returned 0x36 [0088.457] GetLastError () returned 0xb7 [0088.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt.LanRan2.0.5", lpFilePart=0x0) returned 0x42 [0088.457] GetLastError () returned 0xb7 [0088.457] SetErrorMode (uMode=0x1) returned 0x0 [0088.457] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vjxpznfyv9dc.odt"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7702490, ftCreationTime.dwHighDateTime=0x1d3a1c2, ftLastAccessTime.dwLowDateTime=0x6c221d30, ftLastAccessTime.dwHighDateTime=0x1d3a617, ftLastWriteTime.dwLowDateTime=0x38ebf40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x99e0)) returned 1 [0088.457] GetLastError () returned 0xb7 [0088.457] SetErrorMode (uMode=0x0) returned 0x1 [0088.457] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vjxpznfyv9dc.odt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\VJXPZNfyV9DC.odt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vjxpznfyv9dc.odt.lanran2.0.5")) returned 1 [0088.458] GetLastError () returned 0xb7 [0088.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png", lpFilePart=0x0) returned 0x3c [0088.458] GetLastError () returned 0xb7 [0088.458] SetErrorMode (uMode=0x1) returned 0x0 [0088.458] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xp5sknoafuzblkthwf.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.458] GetLastError () returned 0x0 [0088.458] GetFileType (hFile=0x21c) returned 0x1 [0088.458] GetFileType (hFile=0x21c) returned 0x1 [0088.458] ReadFile (in: hFile=0x21c, lpBuffer=0x25b3580, nNumberOfBytesToRead=0x14dd, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25b3580*, lpNumberOfBytesRead=0x39ec18*=0x14dd, lpOverlapped=0x0) returned 1 [0088.459] GetLastError () returned 0x0 [0088.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png", lpFilePart=0x0) returned 0x3c [0088.478] GetLastError () returned 0x0 [0088.478] SetErrorMode (uMode=0x1) returned 0x0 [0088.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xp5sknoafuzblkthwf.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.479] GetLastError () returned 0xb7 [0088.479] GetFileType (hFile=0x21c) returned 0x1 [0088.479] GetFileType (hFile=0x21c) returned 0x1 [0088.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png", lpFilePart=0x0) returned 0x3c [0088.480] GetLastError () returned 0xb7 [0088.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png.LanRan2.0.5", lpFilePart=0x0) returned 0x48 [0088.480] GetLastError () returned 0xb7 [0088.480] SetErrorMode (uMode=0x1) returned 0x0 [0088.480] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xp5sknoafuzblkthwf.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdcc6250, ftCreationTime.dwHighDateTime=0x1d3a206, ftLastAccessTime.dwLowDateTime=0xe3d5ef00, ftLastAccessTime.dwHighDateTime=0x1d3a400, ftLastWriteTime.dwLowDateTime=0x3938200, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x14e0)) returned 1 [0088.480] GetLastError () returned 0xb7 [0088.480] SetErrorMode (uMode=0x0) returned 0x1 [0088.480] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xp5sknoafuzblkthwf.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xp5sKnOAFUzblkTHWf.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xp5sknoafuzblkthwf.png.lanran2.0.5")) returned 1 [0088.481] GetLastError () returned 0xb7 [0088.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX", lpFilePart=0x0) returned 0x32 [0088.481] GetLastError () returned 0xb7 [0088.481] SetErrorMode (uMode=0x1) returned 0x0 [0088.481] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0088.481] GetLastError () returned 0xb7 [0088.481] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.481] GetLastError () returned 0xb7 [0088.481] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.481] GetLastError () returned 0xb7 [0088.481] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.481] GetLastError () returned 0xb7 [0088.481] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.481] GetLastError () returned 0xb7 [0088.481] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.482] GetLastError () returned 0xb7 [0088.482] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.482] GetLastError () returned 0xb7 [0088.482] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0088.482] GetLastError () returned 0x12 [0088.482] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0088.482] SetErrorMode (uMode=0x0) returned 0x1 [0088.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX", lpFilePart=0x0) returned 0x32 [0088.482] GetLastError () returned 0x12 [0088.482] SetErrorMode (uMode=0x1) returned 0x0 [0088.482] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0088.482] GetLastError () returned 0x12 [0088.482] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.482] GetLastError () returned 0x12 [0088.482] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.482] GetLastError () returned 0x12 [0088.482] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.482] GetLastError () returned 0x12 [0088.482] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.482] GetLastError () returned 0x12 [0088.482] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.482] GetLastError () returned 0x12 [0088.483] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.483] GetLastError () returned 0x12 [0088.483] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0088.483] GetLastError () returned 0x12 [0088.483] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0088.483] SetErrorMode (uMode=0x0) returned 0x1 [0088.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg", lpFilePart=0x0) returned 0x3d [0088.483] GetLastError () returned 0x12 [0088.483] SetErrorMode (uMode=0x1) returned 0x0 [0088.483] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\qb61ws.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.483] GetLastError () returned 0x0 [0088.483] GetFileType (hFile=0x21c) returned 0x1 [0088.483] SetErrorMode (uMode=0x0) returned 0x1 [0088.483] GetFileType (hFile=0x21c) returned 0x1 [0088.483] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x39ec10 | out: lpFileSizeHigh=0x39ec10*=0x0) returned 0x2b38 [0088.483] GetLastError () returned 0x0 [0088.483] ReadFile (in: hFile=0x21c, lpBuffer=0x2644918, nNumberOfBytesToRead=0x2b38, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x2644918*, lpNumberOfBytesRead=0x39ebb8*=0x2b38, lpOverlapped=0x0) returned 1 [0088.484] GetLastError () returned 0x0 [0088.484] CloseHandle (hObject=0x21c) returned 1 [0088.484] GetLastError () returned 0x0 [0088.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg", lpFilePart=0x0) returned 0x3d [0088.536] GetLastError () returned 0x0 [0088.536] SetErrorMode (uMode=0x1) returned 0x0 [0088.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\qb61ws.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.536] GetLastError () returned 0xb7 [0088.536] GetFileType (hFile=0x21c) returned 0x1 [0088.537] GetFileType (hFile=0x21c) returned 0x1 [0088.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg", lpFilePart=0x0) returned 0x3d [0088.537] GetLastError () returned 0xb7 [0088.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x49 [0088.537] GetLastError () returned 0xb7 [0088.537] SetErrorMode (uMode=0x1) returned 0x0 [0088.538] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\qb61ws.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x296a2830, ftCreationTime.dwHighDateTime=0x1d3ae86, ftLastAccessTime.dwLowDateTime=0x5fe57f60, ftLastAccessTime.dwHighDateTime=0x1d3a975, ftLastWriteTime.dwLowDateTime=0x39d0780, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x2b40)) returned 1 [0088.538] GetLastError () returned 0xb7 [0088.538] SetErrorMode (uMode=0x0) returned 0x1 [0088.538] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\qb61ws.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\qB61ws.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\qb61ws.jpg.lanran2.0.5")) returned 1 [0088.538] GetLastError () returned 0xb7 [0088.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx", lpFilePart=0x0) returned 0x3f [0088.538] GetLastError () returned 0xb7 [0088.538] SetErrorMode (uMode=0x1) returned 0x0 [0088.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\zksm86k.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.538] GetLastError () returned 0x0 [0088.539] GetFileType (hFile=0x21c) returned 0x1 [0088.539] GetFileType (hFile=0x21c) returned 0x1 [0088.539] ReadFile (in: hFile=0x21c, lpBuffer=0x26dcd08, nNumberOfBytesToRead=0x13ddc, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x26dcd08*, lpNumberOfBytesRead=0x39ebb8*=0x13ddc, lpOverlapped=0x0) returned 1 [0088.539] GetLastError () returned 0x0 [0088.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx", lpFilePart=0x0) returned 0x3f [0088.569] GetLastError () returned 0x0 [0088.569] SetErrorMode (uMode=0x1) returned 0x0 [0088.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\zksm86k.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.570] GetLastError () returned 0xb7 [0088.570] GetFileType (hFile=0x21c) returned 0x1 [0088.570] SetErrorMode (uMode=0x0) returned 0x1 [0088.570] GetFileType (hFile=0x21c) returned 0x1 [0088.570] WriteFile (in: hFile=0x21c, lpBuffer=0x25b37cc*, nNumberOfBytesToWrite=0x13de0, lpNumberOfBytesWritten=0x39ebc4, lpOverlapped=0x0 | out: lpBuffer=0x25b37cc*, lpNumberOfBytesWritten=0x39ebc4*=0x13de0, lpOverlapped=0x0) returned 1 [0088.572] GetLastError () returned 0xb7 [0088.572] CloseHandle (hObject=0x21c) returned 1 [0088.573] GetLastError () returned 0xb7 [0088.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx", lpFilePart=0x0) returned 0x3f [0088.573] GetLastError () returned 0xb7 [0088.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x4b [0088.573] GetLastError () returned 0xb7 [0088.573] SetErrorMode (uMode=0x1) returned 0x0 [0088.573] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\zksm86k.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356ac920, ftCreationTime.dwHighDateTime=0x1d3acc2, ftLastAccessTime.dwLowDateTime=0x2b302490, ftLastAccessTime.dwHighDateTime=0x1d3a174, ftLastWriteTime.dwLowDateTime=0x3a1ca40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x13de0)) returned 1 [0088.573] GetLastError () returned 0xb7 [0088.573] SetErrorMode (uMode=0x0) returned 0x1 [0088.573] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\zksm86k.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\zKSm86k.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\zksm86k.docx.lanran2.0.5")) returned 1 [0088.574] GetLastError () returned 0xb7 [0088.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC", lpFilePart=0x0) returned 0x37 [0088.574] GetLastError () returned 0xb7 [0088.574] SetErrorMode (uMode=0x1) returned 0x0 [0088.574] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0088.574] GetLastError () returned 0xb7 [0088.574] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.574] GetLastError () returned 0xb7 [0088.574] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.574] GetLastError () returned 0xb7 [0088.575] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.575] GetLastError () returned 0xb7 [0088.575] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.575] GetLastError () returned 0xb7 [0088.575] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0088.575] GetLastError () returned 0x12 [0088.575] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0088.575] SetErrorMode (uMode=0x0) returned 0x1 [0088.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC", lpFilePart=0x0) returned 0x37 [0088.575] GetLastError () returned 0x12 [0088.575] SetErrorMode (uMode=0x1) returned 0x0 [0088.576] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0088.576] GetLastError () returned 0x12 [0088.576] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.576] GetLastError () returned 0x12 [0088.576] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.576] GetLastError () returned 0x12 [0088.576] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.576] GetLastError () returned 0x12 [0088.576] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.576] GetLastError () returned 0x12 [0088.576] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0088.576] GetLastError () returned 0x12 [0088.577] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0088.577] SetErrorMode (uMode=0x0) returned 0x1 [0088.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3", lpFilePart=0x0) returned 0x48 [0088.577] GetLastError () returned 0x12 [0088.577] SetErrorMode (uMode=0x1) returned 0x0 [0088.577] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\b8eedu5rs9qt.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.577] GetLastError () returned 0x0 [0088.577] GetFileType (hFile=0x21c) returned 0x1 [0088.577] SetErrorMode (uMode=0x0) returned 0x1 [0088.577] GetFileType (hFile=0x21c) returned 0x1 [0088.577] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0x8df2 [0088.577] GetLastError () returned 0x0 [0088.577] ReadFile (in: hFile=0x21c, lpBuffer=0x25c91d0, nNumberOfBytesToRead=0x8df2, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25c91d0*, lpNumberOfBytesRead=0x39eb58*=0x8df2, lpOverlapped=0x0) returned 1 [0088.578] GetLastError () returned 0x0 [0088.578] CloseHandle (hObject=0x21c) returned 1 [0088.578] GetLastError () returned 0x0 [0088.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3", lpFilePart=0x0) returned 0x48 [0088.634] GetLastError () returned 0x0 [0088.634] SetErrorMode (uMode=0x1) returned 0x0 [0088.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\b8eedu5rs9qt.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.635] GetLastError () returned 0xb7 [0088.635] GetFileType (hFile=0x21c) returned 0x1 [0088.635] GetFileType (hFile=0x21c) returned 0x1 [0088.636] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3", lpFilePart=0x0) returned 0x48 [0088.636] GetLastError () returned 0xb7 [0088.636] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x54 [0088.636] GetLastError () returned 0xb7 [0088.636] SetErrorMode (uMode=0x1) returned 0x0 [0088.636] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\b8eedu5rs9qt.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec2c0150, ftCreationTime.dwHighDateTime=0x1d3ae2b, ftLastAccessTime.dwLowDateTime=0x408cad40, ftLastAccessTime.dwHighDateTime=0x1d3a7a5, ftLastWriteTime.dwLowDateTime=0x3ab4fc0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x8e00)) returned 1 [0088.636] GetLastError () returned 0xb7 [0088.636] SetErrorMode (uMode=0x0) returned 0x1 [0088.636] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\b8eedu5rs9qt.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\B8eEDu5rS9Qt.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\b8eedu5rs9qt.mp3.lanran2.0.5")) returned 1 [0088.637] GetLastError () returned 0xb7 [0088.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png", lpFilePart=0x0) returned 0x4e [0088.637] GetLastError () returned 0xb7 [0088.637] SetErrorMode (uMode=0x1) returned 0x0 [0088.637] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\kufkge8e_3tsephazw.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.637] GetLastError () returned 0x0 [0088.637] GetFileType (hFile=0x21c) returned 0x1 [0088.638] GetFileType (hFile=0x21c) returned 0x1 [0088.638] ReadFile (in: hFile=0x21c, lpBuffer=0x2686888, nNumberOfBytesToRead=0x5f72, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x2686888*, lpNumberOfBytesRead=0x39eb58*=0x5f72, lpOverlapped=0x0) returned 1 [0088.638] GetLastError () returned 0x0 [0088.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png", lpFilePart=0x0) returned 0x4e [0088.710] GetLastError () returned 0x0 [0088.710] SetErrorMode (uMode=0x1) returned 0x0 [0088.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\kufkge8e_3tsephazw.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.710] GetLastError () returned 0xb7 [0088.710] GetFileType (hFile=0x21c) returned 0x1 [0088.711] GetFileType (hFile=0x21c) returned 0x1 [0088.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png", lpFilePart=0x0) returned 0x4e [0088.712] GetLastError () returned 0xb7 [0088.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png.LanRan2.0.5", lpFilePart=0x0) returned 0x5a [0088.712] GetLastError () returned 0xb7 [0088.712] SetErrorMode (uMode=0x1) returned 0x0 [0088.712] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\kufkge8e_3tsephazw.png"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d520710, ftCreationTime.dwHighDateTime=0x1d3aaf9, ftLastAccessTime.dwLowDateTime=0x32b71ec0, ftLastAccessTime.dwHighDateTime=0x1d3ad5a, ftLastWriteTime.dwLowDateTime=0x3b736a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x5f80)) returned 1 [0088.712] GetLastError () returned 0xb7 [0088.712] SetErrorMode (uMode=0x0) returned 0x1 [0088.712] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\kufkge8e_3tsephazw.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\KUfKgE8e_3TsEPhAZw.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\53otcpmpe7hx\\dhcc\\kufkge8e_3tsephazw.png.lanran2.0.5")) returned 1 [0088.712] GetLastError () returned 0xb7 [0088.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4", lpFilePart=0x0) returned 0x39 [0088.712] GetLastError () returned 0xb7 [0088.712] SetErrorMode (uMode=0x1) returned 0x0 [0088.713] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c530 [0088.713] GetLastError () returned 0xb7 [0088.713] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.713] GetLastError () returned 0xb7 [0088.713] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.713] GetLastError () returned 0xb7 [0088.713] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.713] GetLastError () returned 0xb7 [0088.713] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.713] GetLastError () returned 0xb7 [0088.713] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.713] GetLastError () returned 0xb7 [0088.713] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.713] GetLastError () returned 0xb7 [0088.713] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0088.713] GetLastError () returned 0x12 [0088.713] FindClose (in: hFindFile=0x42c530 | out: hFindFile=0x42c530) returned 1 [0088.713] SetErrorMode (uMode=0x0) returned 0x1 [0088.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4", lpFilePart=0x0) returned 0x39 [0088.713] GetLastError () returned 0x12 [0088.713] SetErrorMode (uMode=0x1) returned 0x0 [0088.713] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c530 [0088.713] GetLastError () returned 0x12 [0088.714] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.714] GetLastError () returned 0x12 [0088.714] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.714] GetLastError () returned 0x12 [0088.714] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.714] GetLastError () returned 0x12 [0088.714] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.714] GetLastError () returned 0x12 [0088.714] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.714] GetLastError () returned 0x12 [0088.714] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.714] GetLastError () returned 0x12 [0088.714] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0088.714] GetLastError () returned 0x12 [0088.714] FindClose (in: hFindFile=0x42c530 | out: hFindFile=0x42c530) returned 1 [0088.714] SetErrorMode (uMode=0x0) returned 0x1 [0088.714] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx", lpFilePart=0x0) returned 0x46 [0088.714] GetLastError () returned 0x12 [0088.714] SetErrorMode (uMode=0x1) returned 0x0 [0088.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\dxxywug.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.714] GetLastError () returned 0x0 [0088.714] GetFileType (hFile=0x21c) returned 0x1 [0088.714] GetFileType (hFile=0x21c) returned 0x1 [0088.715] ReadFile (in: hFile=0x21c, lpBuffer=0x24ef5bc, nNumberOfBytesToRead=0x10bdd, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x24ef5bc*, lpNumberOfBytesRead=0x39ebb8*=0x10bdd, lpOverlapped=0x0) returned 1 [0088.715] GetLastError () returned 0x0 [0088.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx", lpFilePart=0x0) returned 0x46 [0088.741] GetLastError () returned 0x0 [0088.741] SetErrorMode (uMode=0x1) returned 0x0 [0088.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\dxxywug.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.743] GetLastError () returned 0xb7 [0088.743] GetFileType (hFile=0x21c) returned 0x1 [0088.743] SetErrorMode (uMode=0x0) returned 0x1 [0088.743] GetFileType (hFile=0x21c) returned 0x1 [0088.743] WriteFile (in: hFile=0x21c, lpBuffer=0x25a930c*, nNumberOfBytesToWrite=0x10be0, lpNumberOfBytesWritten=0x39ebc4, lpOverlapped=0x0 | out: lpBuffer=0x25a930c*, lpNumberOfBytesWritten=0x39ebc4*=0x10be0, lpOverlapped=0x0) returned 1 [0088.744] GetLastError () returned 0xb7 [0088.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx", lpFilePart=0x0) returned 0x46 [0088.744] GetLastError () returned 0xb7 [0088.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x52 [0088.744] GetLastError () returned 0xb7 [0088.744] SetErrorMode (uMode=0x1) returned 0x0 [0088.744] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\dxxywug.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c05060, ftCreationTime.dwHighDateTime=0x1d3affd, ftLastAccessTime.dwLowDateTime=0x2e2aa210, ftLastAccessTime.dwHighDateTime=0x1d3a3f4, ftLastWriteTime.dwLowDateTime=0x3bbf960, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x10be0)) returned 1 [0088.744] GetLastError () returned 0xb7 [0088.744] SetErrorMode (uMode=0x0) returned 0x1 [0088.744] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\dxxywug.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\DXXyWug.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\dxxywug.pptx.lanran2.0.5")) returned 1 [0088.746] GetLastError () returned 0xb7 [0088.746] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi", lpFilePart=0x0) returned 0x47 [0088.746] GetLastError () returned 0xb7 [0088.746] SetErrorMode (uMode=0x1) returned 0x0 [0088.746] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\ovjda2whk.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.746] GetLastError () returned 0x0 [0088.747] GetFileType (hFile=0x21c) returned 0x1 [0088.747] SetErrorMode (uMode=0x0) returned 0x1 [0088.747] GetFileType (hFile=0x21c) returned 0x1 [0088.747] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x39ec10 | out: lpFileSizeHigh=0x39ec10*=0x0) returned 0x9d54 [0088.747] GetLastError () returned 0x0 [0088.747] ReadFile (in: hFile=0x21c, lpBuffer=0x25ba7cc, nNumberOfBytesToRead=0x9d54, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x25ba7cc*, lpNumberOfBytesRead=0x39ebb8*=0x9d54, lpOverlapped=0x0) returned 1 [0088.747] GetLastError () returned 0x0 [0088.748] CloseHandle (hObject=0x21c) returned 1 [0088.748] GetLastError () returned 0x0 [0088.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi", lpFilePart=0x0) returned 0x47 [0088.826] GetLastError () returned 0x0 [0088.827] SetErrorMode (uMode=0x1) returned 0x0 [0088.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\ovjda2whk.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.827] GetLastError () returned 0xb7 [0088.827] GetFileType (hFile=0x21c) returned 0x1 [0088.827] GetFileType (hFile=0x21c) returned 0x1 [0088.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi", lpFilePart=0x0) returned 0x47 [0088.828] GetLastError () returned 0xb7 [0088.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi.LanRan2.0.5", lpFilePart=0x0) returned 0x53 [0088.828] GetLastError () returned 0xb7 [0088.828] SetErrorMode (uMode=0x1) returned 0x0 [0088.828] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\ovjda2whk.avi"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a300b90, ftCreationTime.dwHighDateTime=0x1d3a607, ftLastAccessTime.dwLowDateTime=0x718021c0, ftLastAccessTime.dwHighDateTime=0x1d3abfb, ftLastWriteTime.dwLowDateTime=0x3c7e040, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x9d60)) returned 1 [0088.828] GetLastError () returned 0xb7 [0088.828] SetErrorMode (uMode=0x0) returned 0x1 [0088.829] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\ovjda2whk.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\ovJDA2WhK.avi.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\ovjda2whk.avi.lanran2.0.5")) returned 1 [0088.829] GetLastError () returned 0xb7 [0088.830] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg", lpFilePart=0x0) returned 0x48 [0088.830] GetLastError () returned 0xb7 [0088.830] SetErrorMode (uMode=0x1) returned 0x0 [0088.830] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c330 [0088.830] GetLastError () returned 0xb7 [0088.830] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.830] GetLastError () returned 0xb7 [0088.830] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.830] GetLastError () returned 0xb7 [0088.830] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.830] GetLastError () returned 0xb7 [0088.830] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0088.831] GetLastError () returned 0x12 [0088.831] FindClose (in: hFindFile=0x42c330 | out: hFindFile=0x42c330) returned 1 [0088.831] SetErrorMode (uMode=0x0) returned 0x1 [0088.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg", lpFilePart=0x0) returned 0x48 [0088.831] GetLastError () returned 0x12 [0088.831] SetErrorMode (uMode=0x1) returned 0x0 [0088.831] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c330 [0088.831] GetLastError () returned 0x12 [0088.831] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.831] GetLastError () returned 0x12 [0088.831] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.831] GetLastError () returned 0x12 [0088.831] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.831] GetLastError () returned 0x12 [0088.831] FindNextFileW (in: hFindFile=0x42c330, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0088.831] GetLastError () returned 0x12 [0088.831] FindClose (in: hFindFile=0x42c330 | out: hFindFile=0x42c330) returned 1 [0088.831] SetErrorMode (uMode=0x0) returned 0x1 [0088.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx", lpFilePart=0x0) returned 0x5e [0088.831] GetLastError () returned 0x12 [0088.831] SetErrorMode (uMode=0x1) returned 0x0 [0088.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\pbcsaw8barzkhg\\r4x-n5oyi mg288u.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.832] GetLastError () returned 0x0 [0088.832] GetFileType (hFile=0x21c) returned 0x1 [0088.832] GetFileType (hFile=0x21c) returned 0x1 [0088.832] ReadFile (in: hFile=0x21c, lpBuffer=0x267ebcc, nNumberOfBytesToRead=0x5464, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x267ebcc*, lpNumberOfBytesRead=0x39eb58*=0x5464, lpOverlapped=0x0) returned 1 [0088.832] GetLastError () returned 0x0 [0088.832] CloseHandle (hObject=0x21c) returned 1 [0088.832] GetLastError () returned 0x0 [0088.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx", lpFilePart=0x0) returned 0x5e [0088.891] GetLastError () returned 0x0 [0088.891] SetErrorMode (uMode=0x1) returned 0x0 [0088.891] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\pbcsaw8barzkhg\\r4x-n5oyi mg288u.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.892] GetLastError () returned 0xb7 [0088.892] GetFileType (hFile=0x21c) returned 0x1 [0088.892] GetFileType (hFile=0x21c) returned 0x1 [0088.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx", lpFilePart=0x0) returned 0x5e [0088.893] GetLastError () returned 0xb7 [0088.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx.LanRan2.0.5", lpFilePart=0x0) returned 0x6a [0088.893] GetLastError () returned 0xb7 [0088.893] SetErrorMode (uMode=0x1) returned 0x0 [0088.893] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\pbcsaw8barzkhg\\r4x-n5oyi mg288u.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c6b2e40, ftCreationTime.dwHighDateTime=0x1d3a51f, ftLastAccessTime.dwLowDateTime=0xea723910, ftLastAccessTime.dwHighDateTime=0x1d3a156, ftLastWriteTime.dwLowDateTime=0x3d165c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x5470)) returned 1 [0088.893] GetLastError () returned 0xb7 [0088.893] SetErrorMode (uMode=0x0) returned 0x1 [0088.893] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\pbcsaw8barzkhg\\r4x-n5oyi mg288u.xlsx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\R4X-N5oyI Mg288u.xlsx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\pbcsaw8barzkhg\\r4x-n5oyi mg288u.xlsx.lanran2.0.5")) returned 1 [0088.893] GetLastError () returned 0xb7 [0088.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z", lpFilePart=0x0) returned 0x42 [0088.894] GetLastError () returned 0xb7 [0088.894] SetErrorMode (uMode=0x1) returned 0x0 [0088.894] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0 [0088.894] GetLastError () returned 0xb7 [0088.894] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.894] GetLastError () returned 0xb7 [0088.894] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.894] GetLastError () returned 0xb7 [0088.894] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.894] GetLastError () returned 0xb7 [0088.894] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.894] GetLastError () returned 0xb7 [0088.895] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.895] GetLastError () returned 0xb7 [0088.895] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.895] GetLastError () returned 0xb7 [0088.895] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.895] GetLastError () returned 0xb7 [0088.895] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.895] GetLastError () returned 0xb7 [0088.895] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0088.895] GetLastError () returned 0x12 [0088.896] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1 [0088.896] SetErrorMode (uMode=0x0) returned 0x1 [0088.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z", lpFilePart=0x0) returned 0x42 [0088.896] GetLastError () returned 0x12 [0088.896] SetErrorMode (uMode=0x1) returned 0x0 [0088.896] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0 [0088.896] GetLastError () returned 0x12 [0088.896] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.896] GetLastError () returned 0x12 [0088.896] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.896] GetLastError () returned 0x12 [0088.897] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.897] GetLastError () returned 0x12 [0088.897] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.897] GetLastError () returned 0x12 [0088.897] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.897] GetLastError () returned 0x12 [0088.897] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.897] GetLastError () returned 0x12 [0088.897] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.897] GetLastError () returned 0x12 [0088.897] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.897] GetLastError () returned 0x12 [0088.898] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0088.898] GetLastError () returned 0x12 [0088.898] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1 [0088.898] SetErrorMode (uMode=0x0) returned 0x1 [0088.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3", lpFilePart=0x0) returned 0x5b [0088.898] GetLastError () returned 0x12 [0088.898] SetErrorMode (uMode=0x1) returned 0x0 [0088.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\hn 1fhec4peyiskdkwck.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.898] GetLastError () returned 0x0 [0088.898] GetFileType (hFile=0x21c) returned 0x1 [0088.898] SetErrorMode (uMode=0x0) returned 0x1 [0088.898] GetFileType (hFile=0x21c) returned 0x1 [0088.898] GetFileSize (in: hFile=0x21c, lpFileSizeHigh=0x39ebb0 | out: lpFileSizeHigh=0x39ebb0*=0x0) returned 0x2dce [0088.898] GetLastError () returned 0x0 [0088.898] ReadFile (in: hFile=0x21c, lpBuffer=0x2539e90, nNumberOfBytesToRead=0x2dce, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x2539e90*, lpNumberOfBytesRead=0x39eb58*=0x2dce, lpOverlapped=0x0) returned 1 [0088.899] GetLastError () returned 0x0 [0088.899] CloseHandle (hObject=0x21c) returned 1 [0088.899] GetLastError () returned 0x0 [0088.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3", lpFilePart=0x0) returned 0x5b [0088.953] GetLastError () returned 0x0 [0088.953] SetErrorMode (uMode=0x1) returned 0x0 [0088.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\hn 1fhec4peyiskdkwck.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.954] GetLastError () returned 0xb7 [0088.954] GetFileType (hFile=0x21c) returned 0x1 [0088.954] GetFileType (hFile=0x21c) returned 0x1 [0088.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3", lpFilePart=0x0) returned 0x5b [0088.955] GetLastError () returned 0xb7 [0088.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x67 [0088.955] GetLastError () returned 0xb7 [0088.955] SetErrorMode (uMode=0x1) returned 0x0 [0088.955] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\hn 1fhec4peyiskdkwck.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f44ccf0, ftCreationTime.dwHighDateTime=0x1d3a594, ftLastAccessTime.dwLowDateTime=0x24d3dff0, ftLastAccessTime.dwHighDateTime=0x1d3a28d, ftLastWriteTime.dwLowDateTime=0x3daeb40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x2dd0)) returned 1 [0088.955] GetLastError () returned 0xb7 [0088.955] SetErrorMode (uMode=0x0) returned 0x1 [0088.955] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\hn 1fhec4peyiskdkwck.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\Hn 1FheC4pEyIsKDKwCk.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\hn 1fhec4peyiskdkwck.mp3.lanran2.0.5")) returned 1 [0088.956] GetLastError () returned 0xb7 [0088.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt", lpFilePart=0x0) returned 0x50 [0088.956] GetLastError () returned 0xb7 [0088.956] SetErrorMode (uMode=0x1) returned 0x0 [0088.956] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\yxeuthdak.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.956] GetLastError () returned 0x0 [0088.956] GetFileType (hFile=0x21c) returned 0x1 [0088.956] GetFileType (hFile=0x21c) returned 0x1 [0088.956] ReadFile (in: hFile=0x21c, lpBuffer=0x25d34f0, nNumberOfBytesToRead=0xb021, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25d34f0*, lpNumberOfBytesRead=0x39eb58*=0xb021, lpOverlapped=0x0) returned 1 [0088.957] GetLastError () returned 0x0 [0088.982] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt", lpFilePart=0x0) returned 0x50 [0088.982] GetLastError () returned 0x0 [0088.982] SetErrorMode (uMode=0x1) returned 0x0 [0088.982] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\yxeuthdak.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x21c [0088.983] GetLastError () returned 0xb7 [0088.983] GetFileType (hFile=0x21c) returned 0x1 [0088.983] GetFileType (hFile=0x21c) returned 0x1 [0088.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt", lpFilePart=0x0) returned 0x50 [0088.984] GetLastError () returned 0xb7 [0088.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt.LanRan2.0.5", lpFilePart=0x0) returned 0x5c [0088.984] GetLastError () returned 0xb7 [0088.984] SetErrorMode (uMode=0x1) returned 0x0 [0088.984] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\yxeuthdak.ppt"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x883301e0, ftCreationTime.dwHighDateTime=0x1d3a466, ftLastAccessTime.dwLowDateTime=0x48272060, ftLastAccessTime.dwHighDateTime=0x1d3a8bf, ftLastWriteTime.dwLowDateTime=0x3dfae00, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xb030)) returned 1 [0088.985] GetLastError () returned 0xb7 [0088.985] SetErrorMode (uMode=0x0) returned 0x1 [0088.985] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\yxeuthdak.ppt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\yXEUThDAK.ppt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hu-0kpxnlm7ritr_t 4\\tjtcob3z\\yxeuthdak.ppt.lanran2.0.5")) returned 1 [0088.985] GetLastError () returned 0xb7 [0088.985] SHGetFolderPathW (in: hwnd=0x0, csidl=13, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned 0x0 [0088.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", lpFilePart=0x0) returned 0x23 [0088.986] GetLastError () returned 0x3f0 [0088.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpFilePart=0x0) returned 0x24 [0088.986] GetLastError () returned 0x3f0 [0088.986] SetErrorMode (uMode=0x1) returned 0x0 [0088.986] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0088.987] GetLastError () returned 0x3f0 [0088.987] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.987] GetLastError () returned 0x3f0 [0088.987] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.987] GetLastError () returned 0x3f0 [0088.987] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.987] GetLastError () returned 0x3f0 [0088.987] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.987] GetLastError () returned 0x3f0 [0088.987] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.987] GetLastError () returned 0x3f0 [0088.987] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.987] GetLastError () returned 0x3f0 [0088.987] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.987] GetLastError () returned 0x3f0 [0088.987] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0088.987] GetLastError () returned 0x12 [0088.987] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0088.987] SetErrorMode (uMode=0x0) returned 0x1 [0088.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpFilePart=0x0) returned 0x24 [0088.987] GetLastError () returned 0x12 [0088.987] SetErrorMode (uMode=0x1) returned 0x0 [0088.987] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0088.988] GetLastError () returned 0x12 [0088.988] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.988] GetLastError () returned 0x12 [0088.988] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.988] GetLastError () returned 0x12 [0088.988] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.988] GetLastError () returned 0x12 [0088.988] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.988] GetLastError () returned 0x12 [0088.988] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.988] GetLastError () returned 0x12 [0088.989] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.989] GetLastError () returned 0x12 [0088.989] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0088.989] GetLastError () returned 0x12 [0088.989] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0088.989] GetLastError () returned 0x12 [0088.989] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0088.989] SetErrorMode (uMode=0x0) returned 0x1 [0088.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3", lpFilePart=0x0) returned 0x34 [0088.990] GetLastError () returned 0x12 [0088.990] SetErrorMode (uMode=0x1) returned 0x0 [0088.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ekvtedi3hgit.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0088.990] GetLastError () returned 0x0 [0088.990] GetFileType (hFile=0x220) returned 0x1 [0088.990] SetErrorMode (uMode=0x0) returned 0x1 [0088.990] GetFileType (hFile=0x220) returned 0x1 [0088.990] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x39ec70 | out: lpFileSizeHigh=0x39ec70*=0x0) returned 0x6c1a [0088.990] GetLastError () returned 0x0 [0088.990] ReadFile (in: hFile=0x220, lpBuffer=0x2688ee4, nNumberOfBytesToRead=0x6c1a, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2688ee4*, lpNumberOfBytesRead=0x39ec18*=0x6c1a, lpOverlapped=0x0) returned 1 [0088.991] GetLastError () returned 0x0 [0088.991] CloseHandle (hObject=0x220) returned 1 [0088.991] GetLastError () returned 0x0 [0089.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3", lpFilePart=0x0) returned 0x34 [0089.048] GetLastError () returned 0x0 [0089.048] SetErrorMode (uMode=0x1) returned 0x0 [0089.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ekvtedi3hgit.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.049] GetLastError () returned 0xb7 [0089.049] GetFileType (hFile=0x220) returned 0x1 [0089.049] GetFileType (hFile=0x220) returned 0x1 [0089.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3", lpFilePart=0x0) returned 0x34 [0089.050] GetLastError () returned 0xb7 [0089.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x40 [0089.050] GetLastError () returned 0xb7 [0089.050] SetErrorMode (uMode=0x1) returned 0x0 [0089.050] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ekvtedi3hgit.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d250240, ftCreationTime.dwHighDateTime=0x1d3af9c, ftLastAccessTime.dwLowDateTime=0xdd83b600, ftLastAccessTime.dwHighDateTime=0x1d3ab7b, ftLastWriteTime.dwLowDateTime=0x3e93380, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x6c20)) returned 1 [0089.050] GetLastError () returned 0xb7 [0089.050] SetErrorMode (uMode=0x0) returned 0x1 [0089.050] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ekvtedi3hgit.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ekvTEdI3HGiT.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ekvtedi3hgit.mp3.lanran2.0.5")) returned 1 [0089.051] GetLastError () returned 0xb7 [0089.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-", lpFilePart=0x0) returned 0x34 [0089.051] GetLastError () returned 0xb7 [0089.051] SetErrorMode (uMode=0x1) returned 0x0 [0089.051] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0 [0089.051] GetLastError () returned 0xb7 [0089.051] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.051] GetLastError () returned 0xb7 [0089.051] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.051] GetLastError () returned 0xb7 [0089.051] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.051] GetLastError () returned 0xb7 [0089.052] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.052] GetLastError () returned 0xb7 [0089.052] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.052] GetLastError () returned 0xb7 [0089.052] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.052] GetLastError () returned 0xb7 [0089.052] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.052] GetLastError () returned 0x12 [0089.052] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1 [0089.052] SetErrorMode (uMode=0x0) returned 0x1 [0089.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-", lpFilePart=0x0) returned 0x34 [0089.052] GetLastError () returned 0x12 [0089.052] SetErrorMode (uMode=0x1) returned 0x0 [0089.053] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0 [0089.053] GetLastError () returned 0x12 [0089.053] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.053] GetLastError () returned 0x12 [0089.053] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.053] GetLastError () returned 0x12 [0089.053] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.053] GetLastError () returned 0x12 [0089.053] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.053] GetLastError () returned 0x12 [0089.054] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.054] GetLastError () returned 0x12 [0089.054] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.054] GetLastError () returned 0x12 [0089.054] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.054] GetLastError () returned 0x12 [0089.054] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1 [0089.054] SetErrorMode (uMode=0x0) returned 0x1 [0089.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3", nBufferLength=0x105, lpBuffer=0x39e65c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3", lpFilePart=0x0) returned 0x4b [0089.054] GetLastError () returned 0x12 [0089.054] SetErrorMode (uMode=0x1) returned 0x0 [0089.054] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\pellq xvtj8zfkuwee.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.054] GetLastError () returned 0x0 [0089.054] GetFileType (hFile=0x220) returned 0x1 [0089.054] SetErrorMode (uMode=0x0) returned 0x1 [0089.054] GetFileType (hFile=0x220) returned 0x1 [0089.055] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x39ec10 | out: lpFileSizeHigh=0x39ec10*=0x0) returned 0x174c3 [0089.055] GetLastError () returned 0x0 [0089.055] ReadFile (in: hFile=0x220, lpBuffer=0x34ce600, nNumberOfBytesToRead=0x174c3, lpNumberOfBytesRead=0x39ebb8, lpOverlapped=0x0 | out: lpBuffer=0x34ce600*, lpNumberOfBytesRead=0x39ebb8*=0x174c3, lpOverlapped=0x0) returned 1 [0089.056] GetLastError () returned 0x0 [0089.057] CloseHandle (hObject=0x220) returned 1 [0089.057] GetLastError () returned 0x0 [0089.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3", nBufferLength=0x105, lpBuffer=0x39e664, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3", lpFilePart=0x0) returned 0x4b [0089.117] GetLastError () returned 0x0 [0089.117] SetErrorMode (uMode=0x1) returned 0x0 [0089.117] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\pellq xvtj8zfkuwee.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.118] GetLastError () returned 0xb7 [0089.118] GetFileType (hFile=0x220) returned 0x1 [0089.118] GetFileType (hFile=0x220) returned 0x1 [0089.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3", lpFilePart=0x0) returned 0x4b [0089.119] GetLastError () returned 0xb7 [0089.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x57 [0089.120] GetLastError () returned 0xb7 [0089.120] SetErrorMode (uMode=0x1) returned 0x0 [0089.120] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\pellq xvtj8zfkuwee.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39ec08 | out: lpFileInformation=0x39ec08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc13620, ftCreationTime.dwHighDateTime=0x1d3ae2d, ftLastAccessTime.dwLowDateTime=0xae150d60, ftLastAccessTime.dwHighDateTime=0x1d3a941, ftLastWriteTime.dwLowDateTime=0x3f51a60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x174d0)) returned 1 [0089.120] GetLastError () returned 0xb7 [0089.120] SetErrorMode (uMode=0x0) returned 0x1 [0089.120] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\pellq xvtj8zfkuwee.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\PEllq xVTj8zFKUweE.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\pellq xvtj8zfkuwee.mp3.lanran2.0.5")) returned 1 [0089.120] GetLastError () returned 0xb7 [0089.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_", lpFilePart=0x0) returned 0x42 [0089.120] GetLastError () returned 0xb7 [0089.120] SetErrorMode (uMode=0x1) returned 0x0 [0089.120] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c530 [0089.121] GetLastError () returned 0xb7 [0089.121] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.121] GetLastError () returned 0xb7 [0089.121] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.121] GetLastError () returned 0xb7 [0089.121] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.121] GetLastError () returned 0xb7 [0089.121] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.121] GetLastError () returned 0xb7 [0089.121] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.121] GetLastError () returned 0xb7 [0089.121] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.121] GetLastError () returned 0x12 [0089.121] FindClose (in: hFindFile=0x42c530 | out: hFindFile=0x42c530) returned 1 [0089.121] SetErrorMode (uMode=0x0) returned 0x1 [0089.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_", lpFilePart=0x0) returned 0x42 [0089.121] GetLastError () returned 0x12 [0089.121] SetErrorMode (uMode=0x1) returned 0x0 [0089.121] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c530 [0089.121] GetLastError () returned 0x12 [0089.121] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.121] GetLastError () returned 0x12 [0089.121] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.122] GetLastError () returned 0x12 [0089.122] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.122] GetLastError () returned 0x12 [0089.122] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.122] GetLastError () returned 0x12 [0089.122] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.122] GetLastError () returned 0x12 [0089.122] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.122] GetLastError () returned 0x12 [0089.122] FindClose (in: hFindFile=0x42c530 | out: hFindFile=0x42c530) returned 1 [0089.122] SetErrorMode (uMode=0x0) returned 0x1 [0089.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\pwgwLVNPL9 Eq9mDqm", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\pwgwLVNPL9 Eq9mDqm", lpFilePart=0x0) returned 0x55 [0089.122] GetLastError () returned 0x12 [0089.122] SetErrorMode (uMode=0x1) returned 0x0 [0089.122] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\pwgwLVNPL9 Eq9mDqm\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c530 [0089.122] GetLastError () returned 0x12 [0089.122] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.122] GetLastError () returned 0x12 [0089.122] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.122] GetLastError () returned 0x12 [0089.122] FindClose (in: hFindFile=0x42c530 | out: hFindFile=0x42c530) returned 1 [0089.123] SetErrorMode (uMode=0x0) returned 0x1 [0089.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\pwgwLVNPL9 Eq9mDqm", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\pwgwLVNPL9 Eq9mDqm", lpFilePart=0x0) returned 0x55 [0089.123] GetLastError () returned 0x12 [0089.123] SetErrorMode (uMode=0x1) returned 0x0 [0089.123] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\pwgwLVNPL9 Eq9mDqm\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c530 [0089.123] GetLastError () returned 0x12 [0089.123] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.123] GetLastError () returned 0x12 [0089.123] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.123] GetLastError () returned 0x12 [0089.123] FindClose (in: hFindFile=0x42c530 | out: hFindFile=0x42c530) returned 1 [0089.123] SetErrorMode (uMode=0x0) returned 0x1 [0089.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF", lpFilePart=0x0) returned 0x51 [0089.123] GetLastError () returned 0x12 [0089.123] SetErrorMode (uMode=0x1) returned 0x0 [0089.123] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c530 [0089.123] GetLastError () returned 0x12 [0089.123] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.123] GetLastError () returned 0x12 [0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.124] GetLastError () returned 0x12 [0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.124] GetLastError () returned 0x12 [0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.124] GetLastError () returned 0x12 [0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.124] GetLastError () returned 0x12 [0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.124] GetLastError () returned 0x12 [0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.124] GetLastError () returned 0x12 [0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.124] GetLastError () returned 0x12 [0089.124] FindClose (in: hFindFile=0x42c530 | out: hFindFile=0x42c530) returned 1 [0089.124] SetErrorMode (uMode=0x0) returned 0x1 [0089.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF", lpFilePart=0x0) returned 0x51 [0089.124] GetLastError () returned 0x12 [0089.124] SetErrorMode (uMode=0x1) returned 0x0 [0089.124] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c530 [0089.124] GetLastError () returned 0x12 [0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.124] GetLastError () returned 0x12 [0089.124] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.124] GetLastError () returned 0x12 [0089.125] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.125] GetLastError () returned 0x12 [0089.125] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.125] GetLastError () returned 0x12 [0089.125] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.125] GetLastError () returned 0x12 [0089.125] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.125] GetLastError () returned 0x12 [0089.125] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.125] GetLastError () returned 0x12 [0089.125] FindNextFileW (in: hFindFile=0x42c530, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.125] GetLastError () returned 0x12 [0089.125] FindClose (in: hFindFile=0x42c530 | out: hFindFile=0x42c530) returned 1 [0089.125] SetErrorMode (uMode=0x0) returned 0x1 [0089.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3", lpFilePart=0x0) returned 0x66 [0089.125] GetLastError () returned 0x12 [0089.125] SetErrorMode (uMode=0x1) returned 0x0 [0089.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\gncucpscfxtvc9ad.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.125] GetLastError () returned 0x0 [0089.125] GetFileType (hFile=0x220) returned 0x1 [0089.125] GetFileType (hFile=0x220) returned 0x1 [0089.125] ReadFile (in: hFile=0x220, lpBuffer=0x25d9264, nNumberOfBytesToRead=0xc410, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x25d9264*, lpNumberOfBytesRead=0x39eaf8*=0xc410, lpOverlapped=0x0) returned 1 [0089.126] GetLastError () returned 0x0 [0089.126] CloseHandle (hObject=0x220) returned 1 [0089.126] GetLastError () returned 0x0 [0089.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3", lpFilePart=0x0) returned 0x66 [0089.188] GetLastError () returned 0x0 [0089.188] SetErrorMode (uMode=0x1) returned 0x0 [0089.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\gncucpscfxtvc9ad.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.189] GetLastError () returned 0xb7 [0089.189] GetFileType (hFile=0x220) returned 0x1 [0089.190] GetFileType (hFile=0x220) returned 0x1 [0089.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3", lpFilePart=0x0) returned 0x66 [0089.193] GetLastError () returned 0xb7 [0089.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x72 [0089.193] GetLastError () returned 0xb7 [0089.193] SetErrorMode (uMode=0x1) returned 0x0 [0089.193] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\gncucpscfxtvc9ad.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x591c3030, ftCreationTime.dwHighDateTime=0x1d3a861, ftLastAccessTime.dwLowDateTime=0xd4024060, ftLastAccessTime.dwHighDateTime=0x1d3aeb4, ftLastWriteTime.dwLowDateTime=0x3fe9fe0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xc420)) returned 1 [0089.193] GetLastError () returned 0xb7 [0089.193] SetErrorMode (uMode=0x0) returned 0x1 [0089.193] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\gncucpscfxtvc9ad.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\GNCucpScFXtVc9ad.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\gncucpscfxtvc9ad.mp3.lanran2.0.5")) returned 1 [0089.193] GetLastError () returned 0xb7 [0089.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3", lpFilePart=0x0) returned 0x5a [0089.193] GetLastError () returned 0xb7 [0089.194] SetErrorMode (uMode=0x1) returned 0x0 [0089.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\l op.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.194] GetLastError () returned 0x0 [0089.194] GetFileType (hFile=0x220) returned 0x1 [0089.194] GetFileType (hFile=0x220) returned 0x1 [0089.194] ReadFile (in: hFile=0x220, lpBuffer=0x3572b70, nNumberOfBytesToRead=0x18705, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x3572b70*, lpNumberOfBytesRead=0x39eaf8*=0x18705, lpOverlapped=0x0) returned 1 [0089.196] GetLastError () returned 0x0 [0089.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3", lpFilePart=0x0) returned 0x5a [0089.228] GetLastError () returned 0x0 [0089.228] SetErrorMode (uMode=0x1) returned 0x0 [0089.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\l op.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.229] GetLastError () returned 0xb7 [0089.229] GetFileType (hFile=0x220) returned 0x1 [0089.229] GetFileType (hFile=0x220) returned 0x1 [0089.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3", lpFilePart=0x0) returned 0x5a [0089.231] GetLastError () returned 0xb7 [0089.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x66 [0089.231] GetLastError () returned 0xb7 [0089.231] SetErrorMode (uMode=0x1) returned 0x0 [0089.231] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\l op.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c264f0, ftCreationTime.dwHighDateTime=0x1d3a5ac, ftLastAccessTime.dwLowDateTime=0x88c2a540, ftLastAccessTime.dwHighDateTime=0x1d3ae0a, ftLastWriteTime.dwLowDateTime=0x405c400, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x18710)) returned 1 [0089.231] GetLastError () returned 0xb7 [0089.231] SetErrorMode (uMode=0x0) returned 0x1 [0089.231] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\l op.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\L OP.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\l op.mp3.lanran2.0.5")) returned 1 [0089.232] GetLastError () returned 0xb7 [0089.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_", lpFilePart=0x0) returned 0x59 [0089.232] GetLastError () returned 0xb7 [0089.232] SetErrorMode (uMode=0x1) returned 0x0 [0089.232] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0 [0089.232] GetLastError () returned 0xb7 [0089.232] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.232] GetLastError () returned 0xb7 [0089.232] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.232] GetLastError () returned 0xb7 [0089.232] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.232] GetLastError () returned 0xb7 [0089.232] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.232] GetLastError () returned 0xb7 [0089.232] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.232] GetLastError () returned 0x12 [0089.232] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1 [0089.232] SetErrorMode (uMode=0x0) returned 0x1 [0089.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_", lpFilePart=0x0) returned 0x59 [0089.233] GetLastError () returned 0x12 [0089.233] SetErrorMode (uMode=0x1) returned 0x0 [0089.233] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0 [0089.233] GetLastError () returned 0x12 [0089.233] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.233] GetLastError () returned 0x12 [0089.233] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.233] GetLastError () returned 0x12 [0089.233] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.233] GetLastError () returned 0x12 [0089.233] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.233] GetLastError () returned 0x12 [0089.233] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.233] GetLastError () returned 0x12 [0089.233] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1 [0089.233] SetErrorMode (uMode=0x0) returned 0x1 [0089.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3", lpFilePart=0x0) returned 0x70 [0089.233] GetLastError () returned 0x12 [0089.233] SetErrorMode (uMode=0x1) returned 0x0 [0089.233] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\uxgiqg_18rni5nq9lf.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.233] GetLastError () returned 0x0 [0089.234] GetFileType (hFile=0x220) returned 0x1 [0089.234] GetFileType (hFile=0x220) returned 0x1 [0089.234] ReadFile (in: hFile=0x220, lpBuffer=0x252a66c, nNumberOfBytesToRead=0x12eb0, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x252a66c*, lpNumberOfBytesRead=0x39ea98*=0x12eb0, lpOverlapped=0x0) returned 1 [0089.234] GetLastError () returned 0x0 [0089.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3", lpFilePart=0x0) returned 0x70 [0089.261] GetLastError () returned 0x0 [0089.261] SetErrorMode (uMode=0x1) returned 0x0 [0089.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\uxgiqg_18rni5nq9lf.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.262] GetLastError () returned 0xb7 [0089.262] GetFileType (hFile=0x220) returned 0x1 [0089.262] GetFileType (hFile=0x220) returned 0x1 [0089.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3", lpFilePart=0x0) returned 0x70 [0089.264] GetLastError () returned 0xb7 [0089.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x7c [0089.264] GetLastError () returned 0xb7 [0089.264] SetErrorMode (uMode=0x1) returned 0x0 [0089.264] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\uxgiqg_18rni5nq9lf.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e570c0, ftCreationTime.dwHighDateTime=0x1d3a872, ftLastAccessTime.dwLowDateTime=0xa603f600, ftLastAccessTime.dwHighDateTime=0x1d3a53a, ftLastWriteTime.dwLowDateTime=0x40a86c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x12ec0)) returned 1 [0089.264] GetLastError () returned 0xb7 [0089.264] SetErrorMode (uMode=0x0) returned 0x1 [0089.264] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\uxgiqg_18rni5nq9lf.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\uXgIQG_18Rni5Nq9LF.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\uxgiqg_18rni5nq9lf.mp3.lanran2.0.5")) returned 1 [0089.264] GetLastError () returned 0xb7 [0089.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3", lpFilePart=0x0) returned 0x6e [0089.265] GetLastError () returned 0xb7 [0089.265] SetErrorMode (uMode=0x1) returned 0x0 [0089.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\ytctsumrwh1cpryn.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.265] GetLastError () returned 0x0 [0089.265] GetFileType (hFile=0x220) returned 0x1 [0089.265] GetFileType (hFile=0x220) returned 0x1 [0089.265] ReadFile (in: hFile=0x220, lpBuffer=0x25fe5bc, nNumberOfBytesToRead=0x676e, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x25fe5bc*, lpNumberOfBytesRead=0x39ea98*=0x676e, lpOverlapped=0x0) returned 1 [0089.266] GetLastError () returned 0x0 [0089.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3", lpFilePart=0x0) returned 0x6e [0089.479] GetLastError () returned 0x0 [0089.479] SetErrorMode (uMode=0x1) returned 0x0 [0089.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\ytctsumrwh1cpryn.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.480] GetLastError () returned 0xb7 [0089.480] GetFileType (hFile=0x220) returned 0x1 [0089.480] GetFileType (hFile=0x220) returned 0x1 [0089.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3", lpFilePart=0x0) returned 0x6e [0089.481] GetLastError () returned 0xb7 [0089.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x7a [0089.481] GetLastError () returned 0xb7 [0089.481] SetErrorMode (uMode=0x1) returned 0x0 [0089.481] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\ytctsumrwh1cpryn.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ce7f210, ftCreationTime.dwHighDateTime=0x1d3ae16, ftLastAccessTime.dwLowDateTime=0x1e492360, ftLastAccessTime.dwHighDateTime=0x1d3a8ab, ftLastWriteTime.dwLowDateTime=0x42bda00, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x6770)) returned 1 [0089.481] GetLastError () returned 0xb7 [0089.481] SetErrorMode (uMode=0x0) returned 0x1 [0089.481] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\ytctsumrwh1cpryn.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\BW2Ai 23ohEUW-U-\\65KBbTyvWQXb_\\Sj9Iur0ZVVAjIF\\hS3QNP_\\yTctsumRWh1CPRYn.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\bw2ai 23oheuw-u-\\65kbbtyvwqxb_\\sj9iur0zvvajif\\hs3qnp_\\ytctsumrwh1cpryn.mp3.lanran2.0.5")) returned 1 [0089.482] GetLastError () returned 0xb7 [0089.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PVEe2eX", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PVEe2eX", lpFilePart=0x0) returned 0x2b [0089.482] GetLastError () returned 0xb7 [0089.482] SetErrorMode (uMode=0x1) returned 0x0 [0089.482] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PVEe2eX\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0089.482] GetLastError () returned 0xb7 [0089.482] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.482] GetLastError () returned 0xb7 [0089.482] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.482] GetLastError () returned 0xb7 [0089.482] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.482] GetLastError () returned 0xb7 [0089.482] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.482] GetLastError () returned 0x12 [0089.482] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0089.483] SetErrorMode (uMode=0x0) returned 0x1 [0089.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PVEe2eX", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PVEe2eX", lpFilePart=0x0) returned 0x2b [0089.483] GetLastError () returned 0x12 [0089.483] SetErrorMode (uMode=0x1) returned 0x0 [0089.483] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\PVEe2eX\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0089.483] GetLastError () returned 0x12 [0089.483] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.483] GetLastError () returned 0x12 [0089.483] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.483] GetLastError () returned 0x12 [0089.483] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.483] GetLastError () returned 0x12 [0089.483] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.483] GetLastError () returned 0x12 [0089.483] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0089.483] SetErrorMode (uMode=0x0) returned 0x1 [0089.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez", lpFilePart=0x0) returned 0x30 [0089.483] GetLastError () returned 0x12 [0089.483] SetErrorMode (uMode=0x1) returned 0x0 [0089.483] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0089.484] GetLastError () returned 0x12 [0089.484] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.484] GetLastError () returned 0x12 [0089.484] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.484] GetLastError () returned 0x12 [0089.484] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.484] GetLastError () returned 0x12 [0089.484] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.484] GetLastError () returned 0x12 [0089.484] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0089.484] SetErrorMode (uMode=0x0) returned 0x1 [0089.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez", lpFilePart=0x0) returned 0x30 [0089.484] GetLastError () returned 0x12 [0089.484] SetErrorMode (uMode=0x1) returned 0x0 [0089.484] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0089.484] GetLastError () returned 0x12 [0089.484] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.484] GetLastError () returned 0x12 [0089.484] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.484] GetLastError () returned 0x12 [0089.484] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.484] GetLastError () returned 0x12 [0089.484] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.484] GetLastError () returned 0x12 [0089.484] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0089.485] SetErrorMode (uMode=0x0) returned 0x1 [0089.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx", lpFilePart=0x0) returned 0x39 [0089.485] GetLastError () returned 0x12 [0089.485] SetErrorMode (uMode=0x1) returned 0x0 [0089.485] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0089.485] GetLastError () returned 0x12 [0089.485] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.485] GetLastError () returned 0x12 [0089.485] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.485] GetLastError () returned 0x12 [0089.485] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.485] GetLastError () returned 0x12 [0089.485] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.485] GetLastError () returned 0x12 [0089.485] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0089.486] SetErrorMode (uMode=0x0) returned 0x1 [0089.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx", lpFilePart=0x0) returned 0x39 [0089.486] GetLastError () returned 0x12 [0089.486] SetErrorMode (uMode=0x1) returned 0x0 [0089.486] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0089.486] GetLastError () returned 0x12 [0089.486] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.486] GetLastError () returned 0x12 [0089.486] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.486] GetLastError () returned 0x12 [0089.486] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.486] GetLastError () returned 0x12 [0089.486] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.486] GetLastError () returned 0x12 [0089.486] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0089.486] SetErrorMode (uMode=0x0) returned 0x1 [0089.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_", lpFilePart=0x0) returned 0x4c [0089.486] GetLastError () returned 0x12 [0089.486] SetErrorMode (uMode=0x1) returned 0x0 [0089.487] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0089.487] GetLastError () returned 0x12 [0089.487] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.487] GetLastError () returned 0x12 [0089.487] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.487] GetLastError () returned 0x12 [0089.487] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.487] GetLastError () returned 0x12 [0089.487] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.487] GetLastError () returned 0x12 [0089.487] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.487] GetLastError () returned 0x12 [0089.487] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0089.487] SetErrorMode (uMode=0x0) returned 0x1 [0089.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_", lpFilePart=0x0) returned 0x4c [0089.487] GetLastError () returned 0x12 [0089.487] SetErrorMode (uMode=0x1) returned 0x0 [0089.487] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0089.487] GetLastError () returned 0x12 [0089.487] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.487] GetLastError () returned 0x12 [0089.488] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.488] GetLastError () returned 0x12 [0089.488] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.488] GetLastError () returned 0x12 [0089.488] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.488] GetLastError () returned 0x12 [0089.488] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.488] GetLastError () returned 0x12 [0089.488] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0089.488] SetErrorMode (uMode=0x0) returned 0x1 [0089.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3", lpFilePart=0x0) returned 0x59 [0089.488] GetLastError () returned 0x12 [0089.488] SetErrorMode (uMode=0x1) returned 0x0 [0089.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\akc-l-vx\\wy6oe3new26uepdqh_\\_unfijl-.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.488] GetLastError () returned 0x0 [0089.488] GetFileType (hFile=0x220) returned 0x1 [0089.488] GetFileType (hFile=0x220) returned 0x1 [0089.488] ReadFile (in: hFile=0x220, lpBuffer=0x26b1c70, nNumberOfBytesToRead=0x63d7, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x26b1c70*, lpNumberOfBytesRead=0x39eaf8*=0x63d7, lpOverlapped=0x0) returned 1 [0089.489] GetLastError () returned 0x0 [0089.515] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3", lpFilePart=0x0) returned 0x59 [0089.515] GetLastError () returned 0x0 [0089.515] SetErrorMode (uMode=0x1) returned 0x0 [0089.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\akc-l-vx\\wy6oe3new26uepdqh_\\_unfijl-.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.516] GetLastError () returned 0xb7 [0089.516] GetFileType (hFile=0x220) returned 0x1 [0089.516] GetFileType (hFile=0x220) returned 0x1 [0089.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3", lpFilePart=0x0) returned 0x59 [0089.517] GetLastError () returned 0xb7 [0089.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x65 [0089.517] GetLastError () returned 0xb7 [0089.517] SetErrorMode (uMode=0x1) returned 0x0 [0089.517] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\akc-l-vx\\wy6oe3new26uepdqh_\\_unfijl-.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7599f2f0, ftCreationTime.dwHighDateTime=0x1d3a23b, ftLastAccessTime.dwLowDateTime=0x279f1d50, ftLastAccessTime.dwHighDateTime=0x1d3a16e, ftLastWriteTime.dwLowDateTime=0x4309cc0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x63e0)) returned 1 [0089.517] GetLastError () returned 0xb7 [0089.517] SetErrorMode (uMode=0x0) returned 0x1 [0089.518] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\akc-l-vx\\wy6oe3new26uepdqh_\\_unfijl-.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\AKC-l-Vx\\wY6OE3NEW26UepDqh_\\_UNFIJl-.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\akc-l-vx\\wy6oe3new26uepdqh_\\_unfijl-.mp3.lanran2.0.5")) returned 1 [0089.518] GetLastError () returned 0xb7 [0089.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2", lpFilePart=0x0) returned 0x39 [0089.518] GetLastError () returned 0xb7 [0089.518] SetErrorMode (uMode=0x1) returned 0x0 [0089.518] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430 [0089.518] GetLastError () returned 0xb7 [0089.518] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.518] GetLastError () returned 0xb7 [0089.518] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.518] GetLastError () returned 0xb7 [0089.518] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.518] GetLastError () returned 0xb7 [0089.518] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.519] GetLastError () returned 0xb7 [0089.519] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.519] GetLastError () returned 0x12 [0089.519] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1 [0089.519] SetErrorMode (uMode=0x0) returned 0x1 [0089.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2", lpFilePart=0x0) returned 0x39 [0089.519] GetLastError () returned 0x12 [0089.519] SetErrorMode (uMode=0x1) returned 0x0 [0089.519] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430 [0089.519] GetLastError () returned 0x12 [0089.519] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.519] GetLastError () returned 0x12 [0089.519] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.519] GetLastError () returned 0x12 [0089.519] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.519] GetLastError () returned 0x12 [0089.519] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.577] GetLastError () returned 0x12 [0089.577] FindNextFileW (in: hFindFile=0x42c430, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.577] GetLastError () returned 0x12 [0089.578] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1 [0089.578] SetErrorMode (uMode=0x0) returned 0x1 [0089.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3", lpFilePart=0x0) returned 0x4e [0089.578] GetLastError () returned 0x12 [0089.578] SetErrorMode (uMode=0x1) returned 0x0 [0089.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\jgsuiwu2\\skovqzoy8i53arrb.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.578] GetLastError () returned 0x0 [0089.578] GetFileType (hFile=0x220) returned 0x1 [0089.578] GetFileType (hFile=0x220) returned 0x1 [0089.578] ReadFile (in: hFile=0x220, lpBuffer=0x362b3a8, nNumberOfBytesToRead=0x16390, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x362b3a8*, lpNumberOfBytesRead=0x39eb58*=0x16390, lpOverlapped=0x0) returned 1 [0089.580] GetLastError () returned 0x0 [0089.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3", lpFilePart=0x0) returned 0x4e [0089.609] GetLastError () returned 0x0 [0089.609] SetErrorMode (uMode=0x1) returned 0x0 [0089.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\jgsuiwu2\\skovqzoy8i53arrb.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.610] GetLastError () returned 0xb7 [0089.610] GetFileType (hFile=0x220) returned 0x1 [0089.610] GetFileType (hFile=0x220) returned 0x1 [0089.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3", lpFilePart=0x0) returned 0x4e [0089.612] GetLastError () returned 0xb7 [0089.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x5a [0089.612] GetLastError () returned 0xb7 [0089.612] SetErrorMode (uMode=0x1) returned 0x0 [0089.612] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\jgsuiwu2\\skovqzoy8i53arrb.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56afc00, ftCreationTime.dwHighDateTime=0x1d3a5d7, ftLastAccessTime.dwLowDateTime=0xf39e1f30, ftLastAccessTime.dwHighDateTime=0x1d3a7e2, ftLastWriteTime.dwLowDateTime=0x43ee500, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x163a0)) returned 1 [0089.612] GetLastError () returned 0xb7 [0089.612] SetErrorMode (uMode=0x0) returned 0x1 [0089.612] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\jgsuiwu2\\skovqzoy8i53arrb.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\tKHyuA06i3Ez\\jGSuiwU2\\skoVQzoY8I53ARRB.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\tkhyua06i3ez\\jgsuiwu2\\skovqzoy8i53arrb.mp3.lanran2.0.5")) returned 1 [0089.613] GetLastError () returned 0xb7 [0089.613] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x0 [0089.613] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0089.613] GetLastError () returned 0x3f0 [0089.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0089.621] GetLastError () returned 0x3f0 [0089.621] SetErrorMode (uMode=0x1) returned 0x0 [0089.621] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270 [0089.621] GetLastError () returned 0x3f0 [0089.621] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.621] GetLastError () returned 0x3f0 [0089.621] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.621] GetLastError () returned 0x3f0 [0089.621] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.621] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.622] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.622] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.623] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.623] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.623] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.623] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.623] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.623] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.623] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.623] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.623] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.623] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.623] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.623] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.623] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.623] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.623] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.623] GetLastError () returned 0x3f0 [0089.623] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.624] GetLastError () returned 0x12 [0089.624] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1 [0089.624] SetErrorMode (uMode=0x0) returned 0x1 [0089.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0089.624] GetLastError () returned 0x12 [0089.624] SetErrorMode (uMode=0x1) returned 0x0 [0089.624] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c270 [0089.624] GetLastError () returned 0x12 [0089.624] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.624] GetLastError () returned 0x12 [0089.624] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.624] GetLastError () returned 0x12 [0089.624] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.624] GetLastError () returned 0x12 [0089.624] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.624] GetLastError () returned 0x12 [0089.624] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.625] GetLastError () returned 0x12 [0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.625] GetLastError () returned 0x12 [0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.625] GetLastError () returned 0x12 [0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.625] GetLastError () returned 0x12 [0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.625] GetLastError () returned 0x12 [0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.625] GetLastError () returned 0x12 [0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.625] GetLastError () returned 0x12 [0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.625] GetLastError () returned 0x12 [0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.625] GetLastError () returned 0x12 [0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.625] GetLastError () returned 0x12 [0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.625] GetLastError () returned 0x12 [0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.625] GetLastError () returned 0x12 [0089.625] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.626] GetLastError () returned 0x12 [0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.626] GetLastError () returned 0x12 [0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.626] GetLastError () returned 0x12 [0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.626] GetLastError () returned 0x12 [0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.626] GetLastError () returned 0x12 [0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.626] GetLastError () returned 0x12 [0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.626] GetLastError () returned 0x12 [0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.626] GetLastError () returned 0x12 [0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.626] GetLastError () returned 0x12 [0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.626] GetLastError () returned 0x12 [0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.626] GetLastError () returned 0x12 [0089.626] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.626] GetLastError () returned 0x12 [0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.627] GetLastError () returned 0x12 [0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.627] GetLastError () returned 0x12 [0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.627] GetLastError () returned 0x12 [0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.627] GetLastError () returned 0x12 [0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.627] GetLastError () returned 0x12 [0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.627] GetLastError () returned 0x12 [0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.627] GetLastError () returned 0x12 [0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.627] GetLastError () returned 0x12 [0089.627] FindNextFileW (in: hFindFile=0x42c270, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.627] GetLastError () returned 0x12 [0089.627] FindClose (in: hFindFile=0x42c270 | out: hFindFile=0x42c270) returned 1 [0089.627] SetErrorMode (uMode=0x0) returned 0x1 [0089.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38 [0089.628] GetLastError () returned 0x12 [0089.628] SetErrorMode (uMode=0x1) returned 0x0 [0089.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.628] GetLastError () returned 0x0 [0089.628] GetFileType (hFile=0x220) returned 0x1 [0089.628] GetFileType (hFile=0x220) returned 0x1 [0089.628] ReadFile (in: hFile=0x220, lpBuffer=0x36b09b8, nNumberOfBytesToRead=0x34400, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x36b09b8*, lpNumberOfBytesRead=0x39ec18*=0x34400, lpOverlapped=0x0) returned 1 [0089.631] GetLastError () returned 0x0 [0089.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe", lpFilePart=0x0) returned 0x38 [0089.678] GetLastError () returned 0x0 [0089.678] SetErrorMode (uMode=0x1) returned 0x0 [0089.678] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KryptoTrojaner.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kryptotrojaner.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0089.678] GetLastError () returned 0x20 [0089.679] SetErrorMode (uMode=0x0) returned 0x1 [0089.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX", lpFilePart=0x0) returned 0x32 [0089.679] GetLastError () returned 0x20 [0089.679] SetErrorMode (uMode=0x1) returned 0x0 [0089.679] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.679] GetLastError () returned 0x20 [0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.680] GetLastError () returned 0x20 [0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.680] GetLastError () returned 0x20 [0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.680] GetLastError () returned 0x20 [0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.680] GetLastError () returned 0x20 [0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.680] GetLastError () returned 0x20 [0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.680] GetLastError () returned 0x20 [0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.680] GetLastError () returned 0x12 [0089.680] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.680] SetErrorMode (uMode=0x0) returned 0x1 [0089.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX", lpFilePart=0x0) returned 0x32 [0089.680] GetLastError () returned 0x12 [0089.680] SetErrorMode (uMode=0x1) returned 0x0 [0089.680] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.680] GetLastError () returned 0x12 [0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.680] GetLastError () returned 0x12 [0089.680] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.680] GetLastError () returned 0x12 [0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.681] GetLastError () returned 0x12 [0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.681] GetLastError () returned 0x12 [0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.681] GetLastError () returned 0x12 [0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.681] GetLastError () returned 0x12 [0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.681] GetLastError () returned 0x12 [0089.681] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.681] SetErrorMode (uMode=0x0) returned 0x1 [0089.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC", lpFilePart=0x0) returned 0x37 [0089.681] GetLastError () returned 0x12 [0089.681] SetErrorMode (uMode=0x1) returned 0x0 [0089.681] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.681] GetLastError () returned 0x12 [0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.681] GetLastError () returned 0x12 [0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.681] GetLastError () returned 0x12 [0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.681] GetLastError () returned 0x12 [0089.681] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.681] GetLastError () returned 0x12 [0089.682] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.682] GetLastError () returned 0x12 [0089.682] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.682] SetErrorMode (uMode=0x0) returned 0x1 [0089.682] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC", lpFilePart=0x0) returned 0x37 [0089.682] GetLastError () returned 0x12 [0089.682] SetErrorMode (uMode=0x1) returned 0x0 [0089.683] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\53otCpmPe7hX\\dhcC\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.683] GetLastError () returned 0x12 [0089.683] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.683] GetLastError () returned 0x12 [0089.683] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.683] GetLastError () returned 0x12 [0089.683] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.683] GetLastError () returned 0x12 [0089.683] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.683] GetLastError () returned 0x12 [0089.683] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.683] GetLastError () returned 0x12 [0089.684] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.684] SetErrorMode (uMode=0x0) returned 0x1 [0089.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4", lpFilePart=0x0) returned 0x39 [0089.684] GetLastError () returned 0x12 [0089.684] SetErrorMode (uMode=0x1) returned 0x0 [0089.684] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.684] GetLastError () returned 0x12 [0089.684] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.684] GetLastError () returned 0x12 [0089.684] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.684] GetLastError () returned 0x12 [0089.684] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.684] GetLastError () returned 0x12 [0089.684] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.684] GetLastError () returned 0x12 [0089.684] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.684] GetLastError () returned 0x12 [0089.684] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.684] GetLastError () returned 0x12 [0089.684] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.684] GetLastError () returned 0x12 [0089.684] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.684] SetErrorMode (uMode=0x0) returned 0x1 [0089.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4", lpFilePart=0x0) returned 0x39 [0089.685] GetLastError () returned 0x12 [0089.685] SetErrorMode (uMode=0x1) returned 0x0 [0089.685] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.685] GetLastError () returned 0x12 [0089.685] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.685] GetLastError () returned 0x12 [0089.685] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.685] GetLastError () returned 0x12 [0089.685] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.685] GetLastError () returned 0x12 [0089.685] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.685] GetLastError () returned 0x12 [0089.685] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.685] GetLastError () returned 0x12 [0089.685] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.685] GetLastError () returned 0x12 [0089.685] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.685] GetLastError () returned 0x12 [0089.685] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.685] SetErrorMode (uMode=0x0) returned 0x1 [0089.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg", lpFilePart=0x0) returned 0x48 [0089.685] GetLastError () returned 0x12 [0089.685] SetErrorMode (uMode=0x1) returned 0x0 [0089.685] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.686] GetLastError () returned 0x12 [0089.686] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.686] GetLastError () returned 0x12 [0089.686] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.686] GetLastError () returned 0x12 [0089.686] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.686] GetLastError () returned 0x12 [0089.686] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.686] GetLastError () returned 0x12 [0089.686] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.686] SetErrorMode (uMode=0x0) returned 0x1 [0089.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg", lpFilePart=0x0) returned 0x48 [0089.686] GetLastError () returned 0x12 [0089.686] SetErrorMode (uMode=0x1) returned 0x0 [0089.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\PBCSaW8baRzkhg\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.686] GetLastError () returned 0x12 [0089.686] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.686] GetLastError () returned 0x12 [0089.686] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.686] GetLastError () returned 0x12 [0089.686] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.686] GetLastError () returned 0x12 [0089.686] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.687] GetLastError () returned 0x12 [0089.687] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.687] SetErrorMode (uMode=0x0) returned 0x1 [0089.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z", lpFilePart=0x0) returned 0x42 [0089.687] GetLastError () returned 0x12 [0089.687] SetErrorMode (uMode=0x1) returned 0x0 [0089.687] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.687] GetLastError () returned 0x12 [0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.687] GetLastError () returned 0x12 [0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.687] GetLastError () returned 0x12 [0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.687] GetLastError () returned 0x12 [0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.687] GetLastError () returned 0x12 [0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.687] GetLastError () returned 0x12 [0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.687] GetLastError () returned 0x12 [0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.687] GetLastError () returned 0x12 [0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.687] GetLastError () returned 0x12 [0089.687] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.687] GetLastError () returned 0x12 [0089.687] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.687] SetErrorMode (uMode=0x0) returned 0x1 [0089.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z", lpFilePart=0x0) returned 0x42 [0089.688] GetLastError () returned 0x12 [0089.688] SetErrorMode (uMode=0x1) returned 0x0 [0089.688] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\hu-0kPxnlm7RItR_t 4\\tjTCOb3z\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.688] GetLastError () returned 0x12 [0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.688] GetLastError () returned 0x12 [0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.688] GetLastError () returned 0x12 [0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.688] GetLastError () returned 0x12 [0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.688] GetLastError () returned 0x12 [0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.688] GetLastError () returned 0x12 [0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.688] GetLastError () returned 0x12 [0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.688] GetLastError () returned 0x12 [0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.688] GetLastError () returned 0x12 [0089.688] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.688] GetLastError () returned 0x12 [0089.688] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.688] SetErrorMode (uMode=0x0) returned 0x1 [0089.688] SHGetFolderPathW (in: hwnd=0x0, csidl=7, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x0 [0089.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0089.689] GetLastError () returned 0x3f0 [0089.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x5c [0089.689] GetLastError () returned 0x3f0 [0089.689] SetErrorMode (uMode=0x1) returned 0x0 [0089.689] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.689] GetLastError () returned 0x3f0 [0089.690] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.690] GetLastError () returned 0x3f0 [0089.690] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.690] GetLastError () returned 0x3f0 [0089.690] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.690] GetLastError () returned 0x12 [0089.690] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.690] SetErrorMode (uMode=0x0) returned 0x1 [0089.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\", lpFilePart=0x0) returned 0x5c [0089.690] GetLastError () returned 0x12 [0089.690] SetErrorMode (uMode=0x1) returned 0x0 [0089.690] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.690] GetLastError () returned 0x12 [0089.690] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.690] GetLastError () returned 0x12 [0089.690] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.690] GetLastError () returned 0x12 [0089.690] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.690] GetLastError () returned 0x12 [0089.690] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.690] SetErrorMode (uMode=0x0) returned 0x1 [0089.690] SHGetFolderPathW (in: hwnd=0x0, csidl=2, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs") returned 0x0 [0089.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x53 [0089.691] GetLastError () returned 0x3f0 [0089.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x54 [0089.691] GetLastError () returned 0x3f0 [0089.691] SetErrorMode (uMode=0x1) returned 0x0 [0089.691] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.691] GetLastError () returned 0x3f0 [0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.692] GetLastError () returned 0x3f0 [0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.692] GetLastError () returned 0x3f0 [0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.692] GetLastError () returned 0x3f0 [0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.692] GetLastError () returned 0x3f0 [0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.692] GetLastError () returned 0x3f0 [0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.692] GetLastError () returned 0x3f0 [0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.692] GetLastError () returned 0x3f0 [0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.692] GetLastError () returned 0x3f0 [0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.692] GetLastError () returned 0x12 [0089.692] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.692] SetErrorMode (uMode=0x0) returned 0x1 [0089.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\", lpFilePart=0x0) returned 0x54 [0089.692] GetLastError () returned 0x12 [0089.692] SetErrorMode (uMode=0x1) returned 0x0 [0089.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.692] GetLastError () returned 0x12 [0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.692] GetLastError () returned 0x12 [0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.692] GetLastError () returned 0x12 [0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.692] GetLastError () returned 0x12 [0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.692] GetLastError () returned 0x12 [0089.692] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.692] GetLastError () returned 0x12 [0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.693] GetLastError () returned 0x12 [0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.693] GetLastError () returned 0x12 [0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.693] GetLastError () returned 0x12 [0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.693] GetLastError () returned 0x12 [0089.693] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.693] SetErrorMode (uMode=0x0) returned 0x1 [0089.693] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x5f [0089.693] GetLastError () returned 0x12 [0089.693] SetErrorMode (uMode=0x1) returned 0x0 [0089.693] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.693] GetLastError () returned 0x12 [0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.693] GetLastError () returned 0x12 [0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.693] GetLastError () returned 0x12 [0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.693] GetLastError () returned 0x12 [0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.693] GetLastError () returned 0x12 [0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.693] GetLastError () returned 0x12 [0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.693] GetLastError () returned 0x12 [0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.693] GetLastError () returned 0x12 [0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.693] GetLastError () returned 0x12 [0089.693] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.693] GetLastError () returned 0x12 [0089.693] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.694] SetErrorMode (uMode=0x0) returned 0x1 [0089.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x5f [0089.694] GetLastError () returned 0x12 [0089.694] SetErrorMode (uMode=0x1) returned 0x0 [0089.694] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.694] GetLastError () returned 0x12 [0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.694] GetLastError () returned 0x12 [0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.694] GetLastError () returned 0x12 [0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.694] GetLastError () returned 0x12 [0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.694] GetLastError () returned 0x12 [0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.694] GetLastError () returned 0x12 [0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.694] GetLastError () returned 0x12 [0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.694] GetLastError () returned 0x12 [0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.694] GetLastError () returned 0x12 [0089.694] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.694] GetLastError () returned 0x12 [0089.694] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.694] SetErrorMode (uMode=0x0) returned 0x1 [0089.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x6d [0089.694] GetLastError () returned 0x12 [0089.694] SetErrorMode (uMode=0x1) returned 0x0 [0089.694] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.695] GetLastError () returned 0x12 [0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.695] GetLastError () returned 0x12 [0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.695] GetLastError () returned 0x12 [0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.695] GetLastError () returned 0x12 [0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.695] GetLastError () returned 0x12 [0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.695] GetLastError () returned 0x12 [0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.695] GetLastError () returned 0x12 [0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.695] GetLastError () returned 0x12 [0089.695] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.695] SetErrorMode (uMode=0x0) returned 0x1 [0089.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x6d [0089.695] GetLastError () returned 0x12 [0089.695] SetErrorMode (uMode=0x1) returned 0x0 [0089.695] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.695] GetLastError () returned 0x12 [0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.695] GetLastError () returned 0x12 [0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.695] GetLastError () returned 0x12 [0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.695] GetLastError () returned 0x12 [0089.695] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.695] GetLastError () returned 0x12 [0089.696] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.696] GetLastError () returned 0x12 [0089.696] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.696] GetLastError () returned 0x12 [0089.696] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0089.696] GetLastError () returned 0x12 [0089.696] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.696] SetErrorMode (uMode=0x0) returned 0x1 [0089.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x6c [0089.696] GetLastError () returned 0x12 [0089.696] SetErrorMode (uMode=0x1) returned 0x0 [0089.696] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.696] GetLastError () returned 0x12 [0089.696] FindNextFileW (in: hFindFile=0x42c4f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0089.696] GetLastError () returned 0x12 [0089.696] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.696] SetErrorMode (uMode=0x0) returned 0x1 [0089.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x6c [0089.696] GetLastError () returned 0x12 [0089.696] SetErrorMode (uMode=0x1) returned 0x0 [0089.697] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.697] GetLastError () returned 0x12 [0089.697] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.697] SetErrorMode (uMode=0x0) returned 0x1 [0089.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x68 [0089.697] GetLastError () returned 0x12 [0089.697] SetErrorMode (uMode=0x1) returned 0x0 [0089.697] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.697] GetLastError () returned 0x12 [0089.697] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.697] SetErrorMode (uMode=0x0) returned 0x1 [0089.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x68 [0089.697] GetLastError () returned 0x12 [0089.697] SetErrorMode (uMode=0x1) returned 0x0 [0089.697] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.697] GetLastError () returned 0x12 [0089.697] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.697] SetErrorMode (uMode=0x0) returned 0x1 [0089.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x5f [0089.698] GetLastError () returned 0x12 [0089.698] SetErrorMode (uMode=0x1) returned 0x0 [0089.698] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.698] GetLastError () returned 0x12 [0089.698] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.698] SetErrorMode (uMode=0x0) returned 0x1 [0089.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x5f [0089.698] GetLastError () returned 0x12 [0089.698] SetErrorMode (uMode=0x1) returned 0x0 [0089.698] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.698] GetLastError () returned 0x12 [0089.698] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.698] SetErrorMode (uMode=0x0) returned 0x1 [0089.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0089.698] GetLastError () returned 0x12 [0089.698] SetErrorMode (uMode=0x1) returned 0x0 [0089.698] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.698] GetLastError () returned 0x12 [0089.698] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.698] SetErrorMode (uMode=0x0) returned 0x1 [0089.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0089.699] GetLastError () returned 0x12 [0089.699] SetErrorMode (uMode=0x1) returned 0x0 [0089.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.699] GetLastError () returned 0x12 [0089.699] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.699] SetErrorMode (uMode=0x0) returned 0x1 [0089.699] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0089.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d [0089.699] GetLastError () returned 0x3f0 [0089.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x2e [0089.699] GetLastError () returned 0x3f0 [0089.699] SetErrorMode (uMode=0x1) returned 0x0 [0089.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.699] GetLastError () returned 0x3f0 [0089.699] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.699] SetErrorMode (uMode=0x0) returned 0x1 [0089.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x2e [0089.699] GetLastError () returned 0x12 [0089.699] SetErrorMode (uMode=0x1) returned 0x0 [0089.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4f0 [0089.700] GetLastError () returned 0x12 [0089.700] FindClose (in: hFindFile=0x42c4f0 | out: hFindFile=0x42c4f0) returned 1 [0089.700] SetErrorMode (uMode=0x0) returned 0x1 [0089.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf", lpFilePart=0x0) returned 0x3a [0089.700] GetLastError () returned 0x12 [0089.700] SetErrorMode (uMode=0x1) returned 0x0 [0089.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3zwe2-nh.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.700] GetLastError () returned 0x0 [0089.700] GetFileType (hFile=0x220) returned 0x1 [0089.700] GetFileType (hFile=0x220) returned 0x1 [0089.700] ReadFile (in: hFile=0x220, lpBuffer=0x24d37a4, nNumberOfBytesToRead=0x8ffd, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x24d37a4*, lpNumberOfBytesRead=0x39ec18*=0x8ffd, lpOverlapped=0x0) returned 1 [0089.701] GetLastError () returned 0x0 [0089.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf", lpFilePart=0x0) returned 0x3a [0089.723] GetLastError () returned 0x0 [0089.723] SetErrorMode (uMode=0x1) returned 0x0 [0089.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3zwe2-nh.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.724] GetLastError () returned 0xb7 [0089.724] GetFileType (hFile=0x220) returned 0x1 [0089.724] GetFileType (hFile=0x220) returned 0x1 [0089.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf", lpFilePart=0x0) returned 0x3a [0089.725] GetLastError () returned 0xb7 [0089.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf.LanRan2.0.5", lpFilePart=0x0) returned 0x46 [0089.725] GetLastError () returned 0xb7 [0089.725] SetErrorMode (uMode=0x1) returned 0x0 [0089.725] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3zwe2-nh.rtf"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb58bef60, ftCreationTime.dwHighDateTime=0x1d3aeef, ftLastAccessTime.dwLowDateTime=0x72bf2000, ftLastAccessTime.dwHighDateTime=0x1d3afa1, ftLastWriteTime.dwLowDateTime=0x451f000, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x9000)) returned 1 [0089.725] GetLastError () returned 0xb7 [0089.725] SetErrorMode (uMode=0x0) returned 0x1 [0089.725] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3zwe2-nh.rtf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\3ZwE2-Nh.rtf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\3zwe2-nh.rtf.lanran2.0.5")) returned 1 [0089.725] GetLastError () returned 0xb7 [0089.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi", lpFilePart=0x0) returned 0x43 [0089.725] GetLastError () returned 0xb7 [0089.725] SetErrorMode (uMode=0x1) returned 0x0 [0089.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b m-6pzp2cxtexe n.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.726] GetLastError () returned 0x0 [0089.726] GetFileType (hFile=0x220) returned 0x1 [0089.726] GetFileType (hFile=0x220) returned 0x1 [0089.726] ReadFile (in: hFile=0x220, lpBuffer=0x2591a1c, nNumberOfBytesToRead=0x1e83, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2591a1c*, lpNumberOfBytesRead=0x39ec18*=0x1e83, lpOverlapped=0x0) returned 1 [0089.726] GetLastError () returned 0x0 [0089.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi", lpFilePart=0x0) returned 0x43 [0089.743] GetLastError () returned 0x0 [0089.743] SetErrorMode (uMode=0x1) returned 0x0 [0089.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b m-6pzp2cxtexe n.avi"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.744] GetLastError () returned 0xb7 [0089.744] GetFileType (hFile=0x220) returned 0x1 [0089.744] GetFileType (hFile=0x220) returned 0x1 [0089.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi", lpFilePart=0x0) returned 0x43 [0089.744] GetLastError () returned 0xb7 [0089.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi.LanRan2.0.5", lpFilePart=0x0) returned 0x4f [0089.744] GetLastError () returned 0xb7 [0089.744] SetErrorMode (uMode=0x1) returned 0x0 [0089.744] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b m-6pzp2cxtexe n.avi"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc46e5b40, ftCreationTime.dwHighDateTime=0x1d3ad72, ftLastAccessTime.dwLowDateTime=0x7c10a800, ftLastAccessTime.dwHighDateTime=0x1d3a2d0, ftLastWriteTime.dwLowDateTime=0x4545160, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x1e90)) returned 1 [0089.744] GetLastError () returned 0xb7 [0089.744] SetErrorMode (uMode=0x0) returned 0x1 [0089.744] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b m-6pzp2cxtexe n.avi"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\b M-6pZp2CxTeXe N.avi.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\b m-6pzp2cxtexe n.avi.lanran2.0.5")) returned 1 [0089.745] GetLastError () returned 0xb7 [0089.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp", lpFilePart=0x0) returned 0x45 [0089.745] GetLastError () returned 0xb7 [0089.745] SetErrorMode (uMode=0x1) returned 0x0 [0089.745] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dr1a9fjyb6ohzsgyw1x.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.745] GetLastError () returned 0x0 [0089.745] GetFileType (hFile=0x220) returned 0x1 [0089.745] GetFileType (hFile=0x220) returned 0x1 [0089.746] ReadFile (in: hFile=0x220, lpBuffer=0x34cb210, nNumberOfBytesToRead=0x161ef, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x34cb210*, lpNumberOfBytesRead=0x39ec18*=0x161ef, lpOverlapped=0x0) returned 1 [0089.746] GetLastError () returned 0x0 [0089.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp", lpFilePart=0x0) returned 0x45 [0089.766] GetLastError () returned 0x0 [0089.766] SetErrorMode (uMode=0x1) returned 0x0 [0089.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dr1a9fjyb6ohzsgyw1x.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.767] GetLastError () returned 0xb7 [0089.767] GetFileType (hFile=0x220) returned 0x1 [0089.767] GetFileType (hFile=0x220) returned 0x1 [0089.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp", lpFilePart=0x0) returned 0x45 [0089.768] GetLastError () returned 0xb7 [0089.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp.LanRan2.0.5", lpFilePart=0x0) returned 0x51 [0089.768] GetLastError () returned 0xb7 [0089.768] SetErrorMode (uMode=0x1) returned 0x0 [0089.768] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dr1a9fjyb6ohzsgyw1x.bmp"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe69256a0, ftCreationTime.dwHighDateTime=0x1d3aba5, ftLastAccessTime.dwLowDateTime=0x38afc690, ftLastAccessTime.dwHighDateTime=0x1d3ae65, ftLastWriteTime.dwLowDateTime=0x456b2c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x161f0)) returned 1 [0089.768] GetLastError () returned 0xb7 [0089.768] SetErrorMode (uMode=0x0) returned 0x1 [0089.768] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dr1a9fjyb6ohzsgyw1x.bmp"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DR1A9fjyB6ohZsGYw1x.bmp.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dr1a9fjyb6ohzsgyw1x.bmp.lanran2.0.5")) returned 1 [0089.769] GetLastError () returned 0xb7 [0089.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png", lpFilePart=0x0) returned 0x3c [0089.769] GetLastError () returned 0xb7 [0089.769] SetErrorMode (uMode=0x1) returned 0x0 [0089.769] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\exlimxnopc.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.769] GetLastError () returned 0x0 [0089.769] GetFileType (hFile=0x220) returned 0x1 [0089.769] GetFileType (hFile=0x220) returned 0x1 [0089.769] ReadFile (in: hFile=0x220, lpBuffer=0x26ad324, nNumberOfBytesToRead=0x10352, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26ad324*, lpNumberOfBytesRead=0x39ec18*=0x10352, lpOverlapped=0x0) returned 1 [0089.770] GetLastError () returned 0x0 [0089.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png", lpFilePart=0x0) returned 0x3c [0089.798] GetLastError () returned 0x0 [0089.798] SetErrorMode (uMode=0x1) returned 0x0 [0089.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\exlimxnopc.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.799] GetLastError () returned 0xb7 [0089.799] GetFileType (hFile=0x220) returned 0x1 [0089.800] GetFileType (hFile=0x220) returned 0x1 [0089.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png", lpFilePart=0x0) returned 0x3c [0089.801] GetLastError () returned 0xb7 [0089.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png.LanRan2.0.5", lpFilePart=0x0) returned 0x48 [0089.801] GetLastError () returned 0xb7 [0089.801] SetErrorMode (uMode=0x1) returned 0x0 [0089.801] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\exlimxnopc.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x741e37a0, ftCreationTime.dwHighDateTime=0x1d3a0f7, ftLastAccessTime.dwLowDateTime=0xe5956490, ftLastAccessTime.dwHighDateTime=0x1d3a6b9, ftLastWriteTime.dwLowDateTime=0x45b7580, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x10360)) returned 1 [0089.801] GetLastError () returned 0xb7 [0089.801] SetErrorMode (uMode=0x0) returned 0x1 [0089.802] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\exlimxnopc.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Exlimxnopc.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\exlimxnopc.png.lanran2.0.5")) returned 1 [0089.802] GetLastError () returned 0xb7 [0089.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3", lpFilePart=0x0) returned 0x43 [0089.802] GetLastError () returned 0xb7 [0089.802] SetErrorMode (uMode=0x1) returned 0x0 [0089.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fyvnazxtqq2juonn6.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.803] GetLastError () returned 0x0 [0089.803] GetFileType (hFile=0x220) returned 0x1 [0089.803] GetFileType (hFile=0x220) returned 0x1 [0089.803] ReadFile (in: hFile=0x220, lpBuffer=0x35704d0, nNumberOfBytesToRead=0x16fe7, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x35704d0*, lpNumberOfBytesRead=0x39ec18*=0x16fe7, lpOverlapped=0x0) returned 1 [0089.804] GetLastError () returned 0x0 [0089.829] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3", lpFilePart=0x0) returned 0x43 [0089.829] GetLastError () returned 0x0 [0089.829] SetErrorMode (uMode=0x1) returned 0x0 [0089.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fyvnazxtqq2juonn6.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.830] GetLastError () returned 0xb7 [0089.830] GetFileType (hFile=0x220) returned 0x1 [0089.830] GetFileType (hFile=0x220) returned 0x1 [0089.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3", lpFilePart=0x0) returned 0x43 [0089.831] GetLastError () returned 0xb7 [0089.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x4f [0089.832] GetLastError () returned 0xb7 [0089.832] SetErrorMode (uMode=0x1) returned 0x0 [0089.832] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fyvnazxtqq2juonn6.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9ecc8e70, ftCreationTime.dwHighDateTime=0x1d3a8d6, ftLastAccessTime.dwLowDateTime=0xd61ca3b0, ftLastAccessTime.dwHighDateTime=0x1d3a908, ftLastWriteTime.dwLowDateTime=0x4603840, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x16ff0)) returned 1 [0089.832] GetLastError () returned 0xb7 [0089.832] SetErrorMode (uMode=0x0) returned 0x1 [0089.832] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fyvnazxtqq2juonn6.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fYvNAZXTqQ2JUONn6.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fyvnazxtqq2juonn6.mp3.lanran2.0.5")) returned 1 [0089.833] GetLastError () returned 0xb7 [0089.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png", lpFilePart=0x0) returned 0x44 [0089.834] GetLastError () returned 0xb7 [0089.834] SetErrorMode (uMode=0x1) returned 0x0 [0089.834] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k-qbfp1vgociynj1 n.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.834] GetLastError () returned 0x0 [0089.834] GetFileType (hFile=0x220) returned 0x1 [0089.834] GetFileType (hFile=0x220) returned 0x1 [0089.834] ReadFile (in: hFile=0x220, lpBuffer=0x260bf40, nNumberOfBytesToRead=0x79af, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x260bf40*, lpNumberOfBytesRead=0x39ec18*=0x79af, lpOverlapped=0x0) returned 1 [0089.835] GetLastError () returned 0x0 [0089.878] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png", lpFilePart=0x0) returned 0x44 [0089.878] GetLastError () returned 0x0 [0089.878] SetErrorMode (uMode=0x1) returned 0x0 [0089.878] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k-qbfp1vgociynj1 n.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.879] GetLastError () returned 0xb7 [0089.879] GetFileType (hFile=0x220) returned 0x1 [0089.879] GetFileType (hFile=0x220) returned 0x1 [0089.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png", lpFilePart=0x0) returned 0x44 [0089.880] GetLastError () returned 0xb7 [0089.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png.LanRan2.0.5", lpFilePart=0x0) returned 0x50 [0089.880] GetLastError () returned 0xb7 [0089.880] SetErrorMode (uMode=0x1) returned 0x0 [0089.880] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k-qbfp1vgociynj1 n.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24063e10, ftCreationTime.dwHighDateTime=0x1d3ae72, ftLastAccessTime.dwLowDateTime=0x4b5f3a0, ftLastAccessTime.dwHighDateTime=0x1d3acf3, ftLastWriteTime.dwLowDateTime=0x469bdc0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x79b0)) returned 1 [0089.880] GetLastError () returned 0xb7 [0089.880] SetErrorMode (uMode=0x0) returned 0x1 [0089.880] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k-qbfp1vgociynj1 n.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\K-qbFP1VgOcIyNJ1 N.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\k-qbfp1vgociynj1 n.png.lanran2.0.5")) returned 1 [0089.880] GetLastError () returned 0xb7 [0089.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv", lpFilePart=0x0) returned 0x39 [0089.880] GetLastError () returned 0xb7 [0089.880] SetErrorMode (uMode=0x1) returned 0x0 [0089.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kveoden.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.881] GetLastError () returned 0x0 [0089.881] GetFileType (hFile=0x220) returned 0x1 [0089.881] GetFileType (hFile=0x220) returned 0x1 [0089.881] ReadFile (in: hFile=0x220, lpBuffer=0x26c1a1c, nNumberOfBytesToRead=0x6c0e, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26c1a1c*, lpNumberOfBytesRead=0x39ec18*=0x6c0e, lpOverlapped=0x0) returned 1 [0089.881] GetLastError () returned 0x0 [0089.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv", lpFilePart=0x0) returned 0x39 [0089.903] GetLastError () returned 0x0 [0089.903] SetErrorMode (uMode=0x1) returned 0x0 [0089.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kveoden.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.904] GetLastError () returned 0xb7 [0089.904] GetFileType (hFile=0x220) returned 0x1 [0089.904] GetFileType (hFile=0x220) returned 0x1 [0089.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv", lpFilePart=0x0) returned 0x39 [0089.905] GetLastError () returned 0xb7 [0089.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv.LanRan2.0.5", lpFilePart=0x0) returned 0x45 [0089.905] GetLastError () returned 0xb7 [0089.905] SetErrorMode (uMode=0x1) returned 0x0 [0089.905] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kveoden.flv"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa62d90, ftCreationTime.dwHighDateTime=0x1d3ad3c, ftLastAccessTime.dwLowDateTime=0x6a5ad1b0, ftLastAccessTime.dwHighDateTime=0x1d3a5ca, ftLastWriteTime.dwLowDateTime=0x46c1f20, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x6c10)) returned 1 [0089.905] GetLastError () returned 0xb7 [0089.905] SetErrorMode (uMode=0x0) returned 0x1 [0089.905] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kveoden.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kveODEn.flv.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kveoden.flv.lanran2.0.5")) returned 1 [0089.906] GetLastError () returned 0xb7 [0089.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3", lpFilePart=0x0) returned 0x3e [0089.906] GetLastError () returned 0xb7 [0089.906] SetErrorMode (uMode=0x1) returned 0x0 [0089.906] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m-1llo1xsmqy.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.906] GetLastError () returned 0x0 [0089.906] GetFileType (hFile=0x220) returned 0x1 [0089.906] GetFileType (hFile=0x220) returned 0x1 [0089.906] ReadFile (in: hFile=0x220, lpBuffer=0x35fa4c8, nNumberOfBytesToRead=0x17dd6, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x35fa4c8*, lpNumberOfBytesRead=0x39ec18*=0x17dd6, lpOverlapped=0x0) returned 1 [0089.907] GetLastError () returned 0x0 [0089.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3", lpFilePart=0x0) returned 0x3e [0089.932] GetLastError () returned 0x0 [0089.932] SetErrorMode (uMode=0x1) returned 0x0 [0089.932] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m-1llo1xsmqy.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.933] GetLastError () returned 0xb7 [0089.933] GetFileType (hFile=0x220) returned 0x1 [0089.933] GetFileType (hFile=0x220) returned 0x1 [0089.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3", lpFilePart=0x0) returned 0x3e [0089.934] GetLastError () returned 0xb7 [0089.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x4a [0089.934] GetLastError () returned 0xb7 [0089.934] SetErrorMode (uMode=0x1) returned 0x0 [0089.934] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m-1llo1xsmqy.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xddc428a0, ftCreationTime.dwHighDateTime=0x1d3a7d1, ftLastAccessTime.dwLowDateTime=0x77afda0, ftLastAccessTime.dwHighDateTime=0x1d3add0, ftLastWriteTime.dwLowDateTime=0x470e1e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x17de0)) returned 1 [0089.934] GetLastError () returned 0xb7 [0089.934] SetErrorMode (uMode=0x0) returned 0x1 [0089.934] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m-1llo1xsmqy.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M-1Llo1xSmqy.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m-1llo1xsmqy.mp3.lanran2.0.5")) returned 1 [0089.935] GetLastError () returned 0xb7 [0089.935] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx", lpFilePart=0x0) returned 0x42 [0089.935] GetLastError () returned 0xb7 [0089.935] SetErrorMode (uMode=0x1) returned 0x0 [0089.935] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oujzqbivduif6pi.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.935] GetLastError () returned 0x0 [0089.935] GetFileType (hFile=0x220) returned 0x1 [0089.935] GetFileType (hFile=0x220) returned 0x1 [0089.935] ReadFile (in: hFile=0x220, lpBuffer=0x260151c, nNumberOfBytesToRead=0x988f, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x260151c*, lpNumberOfBytesRead=0x39ec18*=0x988f, lpOverlapped=0x0) returned 1 [0089.936] GetLastError () returned 0x0 [0089.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx", lpFilePart=0x0) returned 0x42 [0089.960] GetLastError () returned 0x0 [0089.960] SetErrorMode (uMode=0x1) returned 0x0 [0089.960] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oujzqbivduif6pi.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.961] GetLastError () returned 0xb7 [0089.961] GetFileType (hFile=0x220) returned 0x1 [0089.961] GetFileType (hFile=0x220) returned 0x1 [0089.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx", lpFilePart=0x0) returned 0x42 [0089.962] GetLastError () returned 0xb7 [0089.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx.LanRan2.0.5", lpFilePart=0x0) returned 0x4e [0089.962] GetLastError () returned 0xb7 [0089.962] SetErrorMode (uMode=0x1) returned 0x0 [0089.963] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oujzqbivduif6pi.docx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x72cef550, ftCreationTime.dwHighDateTime=0x1d3a3aa, ftLastAccessTime.dwLowDateTime=0x191d9de0, ftLastAccessTime.dwHighDateTime=0x1d3a0c1, ftLastWriteTime.dwLowDateTime=0x475a4a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x9890)) returned 1 [0089.963] GetLastError () returned 0xb7 [0089.963] SetErrorMode (uMode=0x0) returned 0x1 [0089.963] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oujzqbivduif6pi.docx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\OuJZQBIvdUif6pI.docx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\oujzqbivduif6pi.docx.lanran2.0.5")) returned 1 [0089.963] GetLastError () returned 0xb7 [0089.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls", lpFilePart=0x0) returned 0x39 [0089.963] GetLastError () returned 0xb7 [0089.963] SetErrorMode (uMode=0x1) returned 0x0 [0089.964] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pqinwrm.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.964] GetLastError () returned 0x0 [0089.964] GetFileType (hFile=0x220) returned 0x1 [0089.964] GetFileType (hFile=0x220) returned 0x1 [0089.964] ReadFile (in: hFile=0x220, lpBuffer=0x26c295c, nNumberOfBytesToRead=0x111d0, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x26c295c*, lpNumberOfBytesRead=0x39ec18*=0x111d0, lpOverlapped=0x0) returned 1 [0089.964] GetLastError () returned 0x0 [0089.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls", lpFilePart=0x0) returned 0x39 [0089.989] GetLastError () returned 0x0 [0089.989] SetErrorMode (uMode=0x1) returned 0x0 [0089.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pqinwrm.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.990] GetLastError () returned 0xb7 [0089.990] GetFileType (hFile=0x220) returned 0x1 [0089.990] GetFileType (hFile=0x220) returned 0x1 [0089.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls", lpFilePart=0x0) returned 0x39 [0089.991] GetLastError () returned 0xb7 [0089.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls.LanRan2.0.5", lpFilePart=0x0) returned 0x45 [0089.992] GetLastError () returned 0xb7 [0089.992] SetErrorMode (uMode=0x1) returned 0x0 [0089.992] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pqinwrm.xls"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc61fa760, ftCreationTime.dwHighDateTime=0x1d3b028, ftLastAccessTime.dwLowDateTime=0xe6228840, ftLastAccessTime.dwHighDateTime=0x1d3a84c, ftLastWriteTime.dwLowDateTime=0x47a6760, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x111e0)) returned 1 [0089.992] GetLastError () returned 0xb7 [0089.992] SetErrorMode (uMode=0x0) returned 0x1 [0089.992] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pqinwrm.xls"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PqINwRM.xls.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pqinwrm.xls.lanran2.0.5")) returned 1 [0089.992] GetLastError () returned 0xb7 [0089.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png", lpFilePart=0x0) returned 0x42 [0089.992] GetLastError () returned 0xb7 [0089.992] SetErrorMode (uMode=0x1) returned 0x0 [0089.992] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tdbbjpidntvk8-du.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0089.992] GetLastError () returned 0x0 [0089.992] GetFileType (hFile=0x220) returned 0x1 [0089.992] GetFileType (hFile=0x220) returned 0x1 [0089.993] ReadFile (in: hFile=0x220, lpBuffer=0x25abd58, nNumberOfBytesToRead=0x10200, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x25abd58*, lpNumberOfBytesRead=0x39ec18*=0x10200, lpOverlapped=0x0) returned 1 [0089.993] GetLastError () returned 0x0 [0090.012] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png", lpFilePart=0x0) returned 0x42 [0090.012] GetLastError () returned 0x0 [0090.012] SetErrorMode (uMode=0x1) returned 0x0 [0090.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tdbbjpidntvk8-du.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.013] GetLastError () returned 0xb7 [0090.013] GetFileType (hFile=0x220) returned 0x1 [0090.013] GetFileType (hFile=0x220) returned 0x1 [0090.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png", lpFilePart=0x0) returned 0x42 [0090.014] GetLastError () returned 0xb7 [0090.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png.LanRan2.0.5", lpFilePart=0x0) returned 0x4e [0090.014] GetLastError () returned 0xb7 [0090.014] SetErrorMode (uMode=0x1) returned 0x0 [0090.014] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tdbbjpidntvk8-du.png"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf33389a0, ftCreationTime.dwHighDateTime=0x1d3af4d, ftLastAccessTime.dwLowDateTime=0xd7571180, ftLastAccessTime.dwHighDateTime=0x1d3a24f, ftLastWriteTime.dwLowDateTime=0x47cc8c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x10210)) returned 1 [0090.014] GetLastError () returned 0xb7 [0090.014] SetErrorMode (uMode=0x0) returned 0x1 [0090.014] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tdbbjpidntvk8-du.png"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TDBbJpIDntVK8-dU.png.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tdbbjpidntvk8-du.png.lanran2.0.5")) returned 1 [0090.016] GetLastError () returned 0xb7 [0090.016] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif", lpFilePart=0x0) returned 0x3d [0090.016] GetLastError () returned 0xb7 [0090.016] SetErrorMode (uMode=0x1) returned 0x0 [0090.016] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vepxh_ jzar.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.016] GetLastError () returned 0x0 [0090.016] GetFileType (hFile=0x220) returned 0x1 [0090.016] GetFileType (hFile=0x220) returned 0x1 [0090.016] ReadFile (in: hFile=0x220, lpBuffer=0x2674820, nNumberOfBytesToRead=0x8605, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2674820*, lpNumberOfBytesRead=0x39ec18*=0x8605, lpOverlapped=0x0) returned 1 [0090.017] GetLastError () returned 0x0 [0090.035] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif", lpFilePart=0x0) returned 0x3d [0090.035] GetLastError () returned 0x0 [0090.035] SetErrorMode (uMode=0x1) returned 0x0 [0090.035] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vepxh_ jzar.gif"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.036] GetLastError () returned 0xb7 [0090.036] GetFileType (hFile=0x220) returned 0x1 [0090.036] GetFileType (hFile=0x220) returned 0x1 [0090.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif", lpFilePart=0x0) returned 0x3d [0090.038] GetLastError () returned 0xb7 [0090.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif.LanRan2.0.5", lpFilePart=0x0) returned 0x49 [0090.038] GetLastError () returned 0xb7 [0090.038] SetErrorMode (uMode=0x1) returned 0x0 [0090.038] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vepxh_ jzar.gif"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc4d2c5f0, ftCreationTime.dwHighDateTime=0x1d3a3fc, ftLastAccessTime.dwLowDateTime=0xcbbc9690, ftLastAccessTime.dwHighDateTime=0x1d3afb2, ftLastWriteTime.dwLowDateTime=0x4818b80, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x8610)) returned 1 [0090.038] GetLastError () returned 0xb7 [0090.038] SetErrorMode (uMode=0x0) returned 0x1 [0090.038] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vepxh_ jzar.gif"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\VEPxh_ jzar.gif.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\vepxh_ jzar.gif.lanran2.0.5")) returned 1 [0090.039] GetLastError () returned 0xb7 [0090.039] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3", lpFilePart=0x0) returned 0x41 [0090.039] GetLastError () returned 0xb7 [0090.039] SetErrorMode (uMode=0x1) returned 0x0 [0090.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wvhdidgpq5gsdm_.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.039] GetLastError () returned 0x0 [0090.039] GetFileType (hFile=0x220) returned 0x1 [0090.039] GetFileType (hFile=0x220) returned 0x1 [0090.039] ReadFile (in: hFile=0x220, lpBuffer=0x24f2b5c, nNumberOfBytesToRead=0x5903, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x24f2b5c*, lpNumberOfBytesRead=0x39ec18*=0x5903, lpOverlapped=0x0) returned 1 [0090.039] GetLastError () returned 0x0 [0090.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3", lpFilePart=0x0) returned 0x41 [0090.058] GetLastError () returned 0x0 [0090.058] SetErrorMode (uMode=0x1) returned 0x0 [0090.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wvhdidgpq5gsdm_.mp3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.059] GetLastError () returned 0xb7 [0090.059] GetFileType (hFile=0x220) returned 0x1 [0090.059] GetFileType (hFile=0x220) returned 0x1 [0090.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3", lpFilePart=0x0) returned 0x41 [0090.060] GetLastError () returned 0xb7 [0090.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3.LanRan2.0.5", lpFilePart=0x0) returned 0x4d [0090.060] GetLastError () returned 0xb7 [0090.060] SetErrorMode (uMode=0x1) returned 0x0 [0090.060] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wvhdidgpq5gsdm_.mp3"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62f4ce30, ftCreationTime.dwHighDateTime=0x1d3a8a4, ftLastAccessTime.dwLowDateTime=0x2cacc950, ftLastAccessTime.dwHighDateTime=0x1d3abc3, ftLastWriteTime.dwLowDateTime=0x483ece0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x5910)) returned 1 [0090.060] GetLastError () returned 0xb7 [0090.060] SetErrorMode (uMode=0x0) returned 0x1 [0090.060] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wvhdidgpq5gsdm_.mp3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\wVHDIdgpq5gSDM_.mp3.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\wvhdidgpq5gsdm_.mp3.lanran2.0.5")) returned 1 [0090.060] GetLastError () returned 0xb7 [0090.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv", lpFilePart=0x0) returned 0x37 [0090.060] GetLastError () returned 0xb7 [0090.061] SetErrorMode (uMode=0x1) returned 0x0 [0090.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9rrw.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.061] GetLastError () returned 0x0 [0090.061] GetFileType (hFile=0x220) returned 0x1 [0090.061] GetFileType (hFile=0x220) returned 0x1 [0090.061] ReadFile (in: hFile=0x220, lpBuffer=0x259ca8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x259ca8c*, lpNumberOfBytesRead=0x39ec18*=0x640, lpOverlapped=0x0) returned 1 [0090.061] GetLastError () returned 0x0 [0090.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv", lpFilePart=0x0) returned 0x37 [0090.077] GetLastError () returned 0x0 [0090.077] SetErrorMode (uMode=0x1) returned 0x0 [0090.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9rrw.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.078] GetLastError () returned 0xb7 [0090.078] GetFileType (hFile=0x220) returned 0x1 [0090.078] GetFileType (hFile=0x220) returned 0x1 [0090.078] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv", lpFilePart=0x0) returned 0x37 [0090.078] GetLastError () returned 0xb7 [0090.078] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv.LanRan2.0.5", lpFilePart=0x0) returned 0x43 [0090.078] GetLastError () returned 0xb7 [0090.078] SetErrorMode (uMode=0x1) returned 0x0 [0090.078] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9rrw.flv"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x217a6b00, ftCreationTime.dwHighDateTime=0x1d3a2a9, ftLastAccessTime.dwLowDateTime=0xab32e0c0, ftLastAccessTime.dwHighDateTime=0x1d3a6eb, ftLastWriteTime.dwLowDateTime=0x4864e40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x650)) returned 1 [0090.078] GetLastError () returned 0xb7 [0090.078] SetErrorMode (uMode=0x0) returned 0x1 [0090.079] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9rrw.flv"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9RRw.flv.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9rrw.flv.lanran2.0.5")) returned 1 [0090.079] GetLastError () returned 0xb7 [0090.079] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf", lpFilePart=0x0) returned 0x38 [0090.079] GetLastError () returned 0xb7 [0090.079] SetErrorMode (uMode=0x1) returned 0x0 [0090.079] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9uzbi.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.079] GetLastError () returned 0x0 [0090.079] GetFileType (hFile=0x220) returned 0x1 [0090.079] GetFileType (hFile=0x220) returned 0x1 [0090.079] ReadFile (in: hFile=0x220, lpBuffer=0x2628a64, nNumberOfBytesToRead=0x136b3, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x2628a64*, lpNumberOfBytesRead=0x39ec18*=0x136b3, lpOverlapped=0x0) returned 1 [0090.080] GetLastError () returned 0x0 [0090.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf", lpFilePart=0x0) returned 0x38 [0090.099] GetLastError () returned 0x0 [0090.099] SetErrorMode (uMode=0x1) returned 0x0 [0090.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9uzbi.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.100] GetLastError () returned 0xb7 [0090.100] GetFileType (hFile=0x220) returned 0x1 [0090.100] GetFileType (hFile=0x220) returned 0x1 [0090.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf", lpFilePart=0x0) returned 0x38 [0090.101] GetLastError () returned 0xb7 [0090.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf.LanRan2.0.5", lpFilePart=0x0) returned 0x44 [0090.101] GetLastError () returned 0xb7 [0090.101] SetErrorMode (uMode=0x1) returned 0x0 [0090.101] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9uzbi.pdf"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4aba1a80, ftCreationTime.dwHighDateTime=0x1d3a973, ftLastAccessTime.dwLowDateTime=0xb6cb6e20, ftLastAccessTime.dwHighDateTime=0x1d3abd7, ftLastWriteTime.dwLowDateTime=0x48b1100, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x136c0)) returned 1 [0090.101] GetLastError () returned 0xb7 [0090.101] SetErrorMode (uMode=0x0) returned 0x1 [0090.101] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9uzbi.pdf"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_9UZbI.pdf.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_9uzbi.pdf.lanran2.0.5")) returned 1 [0090.102] GetLastError () returned 0xb7 [0090.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx", nBufferLength=0x105, lpBuffer=0x39e6bc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx", lpFilePart=0x0) returned 0x42 [0090.102] GetLastError () returned 0xb7 [0090.102] SetErrorMode (uMode=0x1) returned 0x0 [0090.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_fwwi71jjtryvqn.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.102] GetLastError () returned 0x0 [0090.102] GetFileType (hFile=0x220) returned 0x1 [0090.102] GetFileType (hFile=0x220) returned 0x1 [0090.104] ReadFile (in: hFile=0x220, lpBuffer=0x24f2610, nNumberOfBytesToRead=0x14259, lpNumberOfBytesRead=0x39ec18, lpOverlapped=0x0 | out: lpBuffer=0x24f2610*, lpNumberOfBytesRead=0x39ec18*=0x14259, lpOverlapped=0x0) returned 1 [0090.104] GetLastError () returned 0x0 [0090.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx", nBufferLength=0x105, lpBuffer=0x39e6c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx", lpFilePart=0x0) returned 0x42 [0090.125] GetLastError () returned 0x0 [0090.125] SetErrorMode (uMode=0x1) returned 0x0 [0090.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_fwwi71jjtryvqn.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.126] GetLastError () returned 0xb7 [0090.126] GetFileType (hFile=0x220) returned 0x1 [0090.126] GetFileType (hFile=0x220) returned 0x1 [0090.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx", lpFilePart=0x0) returned 0x42 [0090.127] GetLastError () returned 0xb7 [0090.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e7e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx.LanRan2.0.5", lpFilePart=0x0) returned 0x4e [0090.127] GetLastError () returned 0xb7 [0090.127] SetErrorMode (uMode=0x1) returned 0x0 [0090.127] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_fwwi71jjtryvqn.pptx"), fInfoLevelId=0x0, lpFileInformation=0x39ec68 | out: lpFileInformation=0x39ec68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9339fe30, ftCreationTime.dwHighDateTime=0x1d3a4df, ftLastAccessTime.dwLowDateTime=0xb6c992d0, ftLastAccessTime.dwHighDateTime=0x1d3a457, ftLastWriteTime.dwLowDateTime=0x48d7260, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x14260)) returned 1 [0090.127] GetLastError () returned 0xb7 [0090.127] SetErrorMode (uMode=0x0) returned 0x1 [0090.127] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_fwwi71jjtryvqn.pptx"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\_Fwwi71JjtrYVqN.pptx.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\_fwwi71jjtryvqn.pptx.lanran2.0.5")) returned 1 [0090.129] GetLastError () returned 0xb7 [0090.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x33 [0090.129] GetLastError () returned 0xb7 [0090.129] SetErrorMode (uMode=0x1) returned 0x0 [0090.129] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.190] GetLastError () returned 0xb7 [0090.191] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.191] SetErrorMode (uMode=0x0) returned 0x1 [0090.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x33 [0090.191] GetLastError () returned 0x12 [0090.191] SetErrorMode (uMode=0x1) returned 0x0 [0090.191] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.192] GetLastError () returned 0x12 [0090.192] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.193] SetErrorMode (uMode=0x0) returned 0x1 [0090.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3b [0090.193] GetLastError () returned 0x12 [0090.193] SetErrorMode (uMode=0x1) returned 0x0 [0090.193] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.194] GetLastError () returned 0x12 [0090.194] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.194] SetErrorMode (uMode=0x0) returned 0x1 [0090.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3b [0090.194] GetLastError () returned 0x12 [0090.194] SetErrorMode (uMode=0x1) returned 0x0 [0090.194] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.194] GetLastError () returned 0x12 [0090.194] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.194] SetErrorMode (uMode=0x0) returned 0x1 [0090.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x40 [0090.194] GetLastError () returned 0x12 [0090.194] SetErrorMode (uMode=0x1) returned 0x0 [0090.195] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.198] GetLastError () returned 0x12 [0090.198] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.198] SetErrorMode (uMode=0x0) returned 0x1 [0090.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x40 [0090.198] GetLastError () returned 0x12 [0090.198] SetErrorMode (uMode=0x1) returned 0x0 [0090.198] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.198] GetLastError () returned 0x12 [0090.198] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.198] SetErrorMode (uMode=0x0) returned 0x1 [0090.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x47 [0090.198] GetLastError () returned 0x12 [0090.199] SetErrorMode (uMode=0x1) returned 0x0 [0090.199] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.295] GetLastError () returned 0x12 [0090.295] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.295] SetErrorMode (uMode=0x0) returned 0x1 [0090.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x47 [0090.295] GetLastError () returned 0x12 [0090.295] SetErrorMode (uMode=0x1) returned 0x0 [0090.295] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.295] GetLastError () returned 0x12 [0090.295] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.295] SetErrorMode (uMode=0x0) returned 0x1 [0090.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x46 [0090.295] GetLastError () returned 0x12 [0090.296] SetErrorMode (uMode=0x1) returned 0x0 [0090.296] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.296] GetLastError () returned 0x12 [0090.296] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.296] SetErrorMode (uMode=0x0) returned 0x1 [0090.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x46 [0090.296] GetLastError () returned 0x12 [0090.296] SetErrorMode (uMode=0x1) returned 0x0 [0090.296] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.296] GetLastError () returned 0x12 [0090.296] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.296] SetErrorMode (uMode=0x0) returned 0x1 [0090.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x4c [0090.296] GetLastError () returned 0x12 [0090.296] SetErrorMode (uMode=0x1) returned 0x0 [0090.297] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.345] GetLastError () returned 0x12 [0090.346] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.346] SetErrorMode (uMode=0x0) returned 0x1 [0090.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x4c [0090.346] GetLastError () returned 0x12 [0090.346] SetErrorMode (uMode=0x1) returned 0x0 [0090.346] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.346] GetLastError () returned 0x12 [0090.346] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.346] SetErrorMode (uMode=0x0) returned 0x1 [0090.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", lpFilePart=0x0) returned 0x49 [0090.346] GetLastError () returned 0x12 [0090.347] SetErrorMode (uMode=0x1) returned 0x0 [0090.347] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.347] GetLastError () returned 0x12 [0090.347] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.347] SetErrorMode (uMode=0x0) returned 0x1 [0090.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", lpFilePart=0x0) returned 0x49 [0090.347] GetLastError () returned 0x12 [0090.347] SetErrorMode (uMode=0x1) returned 0x0 [0090.347] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.347] GetLastError () returned 0x12 [0090.347] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.347] SetErrorMode (uMode=0x0) returned 0x1 [0090.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", lpFilePart=0x0) returned 0x52 [0090.347] GetLastError () returned 0x12 [0090.347] SetErrorMode (uMode=0x1) returned 0x0 [0090.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.348] GetLastError () returned 0x12 [0090.348] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.348] SetErrorMode (uMode=0x0) returned 0x1 [0090.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", lpFilePart=0x0) returned 0x52 [0090.348] GetLastError () returned 0x12 [0090.348] SetErrorMode (uMode=0x1) returned 0x0 [0090.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.349] GetLastError () returned 0x12 [0090.349] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.349] SetErrorMode (uMode=0x0) returned 0x1 [0090.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x40 [0090.349] GetLastError () returned 0x12 [0090.349] SetErrorMode (uMode=0x1) returned 0x0 [0090.349] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.349] GetLastError () returned 0x12 [0090.349] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.350] SetErrorMode (uMode=0x0) returned 0x1 [0090.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x40 [0090.350] GetLastError () returned 0x12 [0090.350] SetErrorMode (uMode=0x1) returned 0x0 [0090.350] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.350] GetLastError () returned 0x12 [0090.350] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.350] SetErrorMode (uMode=0x0) returned 0x1 [0090.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x4b [0090.350] GetLastError () returned 0x12 [0090.350] SetErrorMode (uMode=0x1) returned 0x0 [0090.350] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.351] GetLastError () returned 0x12 [0090.351] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.351] SetErrorMode (uMode=0x0) returned 0x1 [0090.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x4b [0090.351] GetLastError () returned 0x12 [0090.351] SetErrorMode (uMode=0x1) returned 0x0 [0090.351] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.351] GetLastError () returned 0x12 [0090.351] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.351] SetErrorMode (uMode=0x0) returned 0x1 [0090.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", lpFilePart=0x0) returned 0x54 [0090.352] GetLastError () returned 0x12 [0090.352] SetErrorMode (uMode=0x1) returned 0x0 [0090.352] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.361] GetLastError () returned 0x12 [0090.361] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.361] SetErrorMode (uMode=0x0) returned 0x1 [0090.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", lpFilePart=0x0) returned 0x54 [0090.361] GetLastError () returned 0x12 [0090.361] SetErrorMode (uMode=0x1) returned 0x0 [0090.362] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.362] GetLastError () returned 0x12 [0090.362] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.362] SetErrorMode (uMode=0x0) returned 0x1 [0090.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x3e [0090.362] GetLastError () returned 0x12 [0090.362] SetErrorMode (uMode=0x1) returned 0x0 [0090.362] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.362] GetLastError () returned 0x12 [0090.362] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.362] SetErrorMode (uMode=0x0) returned 0x1 [0090.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x3e [0090.362] GetLastError () returned 0x12 [0090.362] SetErrorMode (uMode=0x1) returned 0x0 [0090.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.363] GetLastError () returned 0x12 [0090.363] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.363] SetErrorMode (uMode=0x0) returned 0x1 [0090.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x3f [0090.363] GetLastError () returned 0x12 [0090.363] SetErrorMode (uMode=0x1) returned 0x0 [0090.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.363] GetLastError () returned 0x12 [0090.363] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.363] SetErrorMode (uMode=0x0) returned 0x1 [0090.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x3f [0090.363] GetLastError () returned 0x12 [0090.363] SetErrorMode (uMode=0x1) returned 0x0 [0090.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.364] GetLastError () returned 0x12 [0090.364] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.364] SetErrorMode (uMode=0x0) returned 0x1 [0090.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4c [0090.364] GetLastError () returned 0x12 [0090.364] SetErrorMode (uMode=0x1) returned 0x0 [0090.364] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.364] GetLastError () returned 0x12 [0090.364] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.364] SetErrorMode (uMode=0x0) returned 0x1 [0090.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4c [0090.364] GetLastError () returned 0x12 [0090.364] SetErrorMode (uMode=0x1) returned 0x0 [0090.364] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.364] GetLastError () returned 0x12 [0090.364] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.365] SetErrorMode (uMode=0x0) returned 0x1 [0090.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x41 [0090.365] GetLastError () returned 0x12 [0090.365] SetErrorMode (uMode=0x1) returned 0x0 [0090.365] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.365] GetLastError () returned 0x12 [0090.365] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.365] SetErrorMode (uMode=0x0) returned 0x1 [0090.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x41 [0090.365] GetLastError () returned 0x12 [0090.365] SetErrorMode (uMode=0x1) returned 0x0 [0090.365] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.365] GetLastError () returned 0x12 [0090.365] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.365] SetErrorMode (uMode=0x0) returned 0x1 [0090.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x38 [0090.365] GetLastError () returned 0x12 [0090.366] SetErrorMode (uMode=0x1) returned 0x0 [0090.366] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.366] GetLastError () returned 0x12 [0090.366] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.366] SetErrorMode (uMode=0x0) returned 0x1 [0090.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x38 [0090.366] GetLastError () returned 0x12 [0090.366] SetErrorMode (uMode=0x1) returned 0x0 [0090.366] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.366] GetLastError () returned 0x12 [0090.366] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.367] SetErrorMode (uMode=0x0) returned 0x1 [0090.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x5f [0090.367] GetLastError () returned 0x12 [0090.367] SetErrorMode (uMode=0x1) returned 0x0 [0090.367] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.367] GetLastError () returned 0x12 [0090.367] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.367] SetErrorMode (uMode=0x0) returned 0x1 [0090.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x5f [0090.367] GetLastError () returned 0x12 [0090.367] SetErrorMode (uMode=0x1) returned 0x0 [0090.367] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.367] GetLastError () returned 0x12 [0090.367] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.367] SetErrorMode (uMode=0x0) returned 0x1 [0090.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x38 [0090.368] GetLastError () returned 0x12 [0090.368] SetErrorMode (uMode=0x1) returned 0x0 [0090.368] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.368] GetLastError () returned 0x12 [0090.368] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.368] SetErrorMode (uMode=0x0) returned 0x1 [0090.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x38 [0090.368] GetLastError () returned 0x12 [0090.368] SetErrorMode (uMode=0x1) returned 0x0 [0090.368] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.368] GetLastError () returned 0x12 [0090.368] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.369] SetErrorMode (uMode=0x0) returned 0x1 [0090.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x45 [0090.369] GetLastError () returned 0x12 [0090.369] SetErrorMode (uMode=0x1) returned 0x0 [0090.369] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.369] GetLastError () returned 0x12 [0090.369] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.369] SetErrorMode (uMode=0x0) returned 0x1 [0090.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x45 [0090.369] GetLastError () returned 0x12 [0090.369] SetErrorMode (uMode=0x1) returned 0x0 [0090.369] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.369] GetLastError () returned 0x12 [0090.369] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.369] SetErrorMode (uMode=0x0) returned 0x1 [0090.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpFilePart=0x0) returned 0x54 [0090.370] GetLastError () returned 0x12 [0090.370] SetErrorMode (uMode=0x1) returned 0x0 [0090.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.370] GetLastError () returned 0x12 [0090.370] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.370] SetErrorMode (uMode=0x0) returned 0x1 [0090.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpFilePart=0x0) returned 0x54 [0090.370] GetLastError () returned 0x12 [0090.370] SetErrorMode (uMode=0x1) returned 0x0 [0090.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.371] GetLastError () returned 0x12 [0090.371] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.371] SetErrorMode (uMode=0x0) returned 0x1 [0090.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", lpFilePart=0x0) returned 0x5d [0090.371] GetLastError () returned 0x12 [0090.371] SetErrorMode (uMode=0x1) returned 0x0 [0090.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.373] GetLastError () returned 0x12 [0090.373] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.374] SetErrorMode (uMode=0x0) returned 0x1 [0090.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", lpFilePart=0x0) returned 0x5d [0090.374] GetLastError () returned 0x12 [0090.374] SetErrorMode (uMode=0x1) returned 0x0 [0090.374] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.374] GetLastError () returned 0x12 [0090.374] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.374] SetErrorMode (uMode=0x0) returned 0x1 [0090.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x54 [0090.374] GetLastError () returned 0x12 [0090.374] SetErrorMode (uMode=0x1) returned 0x0 [0090.374] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.375] GetLastError () returned 0x12 [0090.375] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.375] SetErrorMode (uMode=0x0) returned 0x1 [0090.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x54 [0090.375] GetLastError () returned 0x12 [0090.375] SetErrorMode (uMode=0x1) returned 0x0 [0090.375] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.375] GetLastError () returned 0x12 [0090.375] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.375] SetErrorMode (uMode=0x0) returned 0x1 [0090.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x5c [0090.375] GetLastError () returned 0x12 [0090.375] SetErrorMode (uMode=0x1) returned 0x0 [0090.375] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.376] GetLastError () returned 0x12 [0090.376] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.376] SetErrorMode (uMode=0x0) returned 0x1 [0090.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x5c [0090.376] GetLastError () returned 0x12 [0090.376] SetErrorMode (uMode=0x1) returned 0x0 [0090.376] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.376] GetLastError () returned 0x12 [0090.377] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.377] SetErrorMode (uMode=0x0) returned 0x1 [0090.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x68 [0090.377] GetLastError () returned 0x12 [0090.377] SetErrorMode (uMode=0x1) returned 0x0 [0090.377] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.377] GetLastError () returned 0x12 [0090.377] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.378] SetErrorMode (uMode=0x0) returned 0x1 [0090.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x68 [0090.378] GetLastError () returned 0x12 [0090.378] SetErrorMode (uMode=0x1) returned 0x0 [0090.378] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.378] GetLastError () returned 0x12 [0090.378] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.378] SetErrorMode (uMode=0x0) returned 0x1 [0090.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x39e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x6c [0090.378] GetLastError () returned 0x12 [0090.378] SetErrorMode (uMode=0x1) returned 0x0 [0090.378] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.378] GetLastError () returned 0x12 [0090.378] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.378] SetErrorMode (uMode=0x0) returned 0x1 [0090.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x39e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x6c [0090.379] GetLastError () returned 0x12 [0090.379] SetErrorMode (uMode=0x1) returned 0x0 [0090.379] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.379] GetLastError () returned 0x12 [0090.379] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.379] SetErrorMode (uMode=0x0) returned 0x1 [0090.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x37 [0090.379] GetLastError () returned 0x12 [0090.379] SetErrorMode (uMode=0x1) returned 0x0 [0090.379] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.379] GetLastError () returned 0x12 [0090.379] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.379] SetErrorMode (uMode=0x0) returned 0x1 [0090.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x37 [0090.379] GetLastError () returned 0x12 [0090.379] SetErrorMode (uMode=0x1) returned 0x0 [0090.380] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.380] GetLastError () returned 0x12 [0090.380] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.380] SetErrorMode (uMode=0x0) returned 0x1 [0090.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x3e [0090.380] GetLastError () returned 0x12 [0090.380] SetErrorMode (uMode=0x1) returned 0x0 [0090.380] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.381] GetLastError () returned 0x12 [0090.381] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.381] SetErrorMode (uMode=0x0) returned 0x1 [0090.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x3e [0090.381] GetLastError () returned 0x12 [0090.381] SetErrorMode (uMode=0x1) returned 0x0 [0090.381] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.381] GetLastError () returned 0x12 [0090.381] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.381] SetErrorMode (uMode=0x0) returned 0x1 [0090.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x43 [0090.381] GetLastError () returned 0x12 [0090.381] SetErrorMode (uMode=0x1) returned 0x0 [0090.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.382] GetLastError () returned 0x12 [0090.382] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.382] SetErrorMode (uMode=0x0) returned 0x1 [0090.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x43 [0090.382] GetLastError () returned 0x12 [0090.382] SetErrorMode (uMode=0x1) returned 0x0 [0090.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.382] GetLastError () returned 0x12 [0090.382] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.382] SetErrorMode (uMode=0x0) returned 0x1 [0090.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x3e [0090.382] GetLastError () returned 0x12 [0090.382] SetErrorMode (uMode=0x1) returned 0x0 [0090.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.383] GetLastError () returned 0x12 [0090.383] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.383] SetErrorMode (uMode=0x0) returned 0x1 [0090.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x3e [0090.383] GetLastError () returned 0x12 [0090.383] SetErrorMode (uMode=0x1) returned 0x0 [0090.383] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.383] GetLastError () returned 0x12 [0090.383] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.383] SetErrorMode (uMode=0x0) returned 0x1 [0090.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x42 [0090.383] GetLastError () returned 0x12 [0090.383] SetErrorMode (uMode=0x1) returned 0x0 [0090.383] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.384] GetLastError () returned 0x12 [0090.384] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.384] SetErrorMode (uMode=0x0) returned 0x1 [0090.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x42 [0090.384] GetLastError () returned 0x12 [0090.384] SetErrorMode (uMode=0x1) returned 0x0 [0090.384] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.384] GetLastError () returned 0x12 [0090.384] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.384] SetErrorMode (uMode=0x0) returned 0x1 [0090.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x71 [0090.384] GetLastError () returned 0x12 [0090.384] SetErrorMode (uMode=0x1) returned 0x0 [0090.384] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.394] GetLastError () returned 0x12 [0090.394] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.394] SetErrorMode (uMode=0x0) returned 0x1 [0090.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x71 [0090.394] GetLastError () returned 0x12 [0090.394] SetErrorMode (uMode=0x1) returned 0x0 [0090.394] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c470 [0090.395] GetLastError () returned 0x12 [0090.395] FindClose (in: hFindFile=0x42c470 | out: hFindFile=0x42c470) returned 1 [0090.396] SetErrorMode (uMode=0x0) returned 0x1 [0090.426] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFilePart=0x0) returned 0xb7 [0090.426] GetLastError () returned 0x12 [0090.426] SetErrorMode (uMode=0x1) returned 0x0 [0090.426] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.427] GetLastError () returned 0x0 [0090.427] GetFileType (hFile=0x220) returned 0x1 [0090.427] SetErrorMode (uMode=0x0) returned 0x1 [0090.427] GetFileType (hFile=0x220) returned 0x1 [0090.428] GetFileSize (in: hFile=0x220, lpFileSizeHigh=0x39eaf0 | out: lpFileSizeHigh=0x39eaf0*=0x0) returned 0x2d [0090.428] GetLastError () returned 0x0 [0090.428] ReadFile (in: hFile=0x220, lpBuffer=0x25ee5b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x25ee5b8*, lpNumberOfBytesRead=0x39ea98*=0x2d, lpOverlapped=0x0) returned 1 [0090.428] GetLastError () returned 0x0 [0090.428] CloseHandle (hObject=0x220) returned 1 [0090.428] GetLastError () returned 0x0 [0090.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFilePart=0x0) returned 0xb7 [0090.482] GetLastError () returned 0x0 [0090.483] SetErrorMode (uMode=0x1) returned 0x0 [0090.483] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\83aa4cc77f591dfc2374580bbd95f6ba_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0090.483] GetLastError () returned 0x5 [0090.484] SetErrorMode (uMode=0x0) returned 0x1 [0090.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFilePart=0x0) returned 0xb7 [0090.485] GetLastError () returned 0x5 [0090.485] SetErrorMode (uMode=0x1) returned 0x0 [0090.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.486] GetLastError () returned 0x0 [0090.486] GetFileType (hFile=0x220) returned 0x1 [0090.486] GetFileType (hFile=0x220) returned 0x1 [0090.486] ReadFile (in: hFile=0x220, lpBuffer=0x2678070, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2678070*, lpNumberOfBytesRead=0x39ea98*=0x57, lpOverlapped=0x0) returned 1 [0090.486] GetLastError () returned 0x0 [0090.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFilePart=0x0) returned 0xb7 [0090.512] GetLastError () returned 0x0 [0090.512] SetErrorMode (uMode=0x1) returned 0x0 [0090.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\932a2db58c237abd381d22df4c63a04a_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0090.513] GetLastError () returned 0x5 [0090.514] SetErrorMode (uMode=0x0) returned 0x1 [0090.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFilePart=0x0) returned 0xb7 [0090.514] GetLastError () returned 0x5 [0090.514] SetErrorMode (uMode=0x1) returned 0x0 [0090.514] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.515] GetLastError () returned 0x0 [0090.515] GetFileType (hFile=0x220) returned 0x1 [0090.515] GetFileType (hFile=0x220) returned 0x1 [0090.515] ReadFile (in: hFile=0x220, lpBuffer=0x25039e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x25039e8*, lpNumberOfBytesRead=0x39ea98*=0x3d, lpOverlapped=0x0) returned 1 [0090.516] GetLastError () returned 0x0 [0090.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", lpFilePart=0x0) returned 0xb7 [0090.539] GetLastError () returned 0x0 [0090.539] SetErrorMode (uMode=0x1) returned 0x0 [0090.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fda992c8d564f97e48410a19a2e459f6_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0090.539] GetLastError () returned 0x5 [0090.540] SetErrorMode (uMode=0x0) returned 0x1 [0090.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x50 [0090.540] GetLastError () returned 0x5 [0090.540] SetErrorMode (uMode=0x1) returned 0x0 [0090.540] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.541] GetLastError () returned 0x5 [0090.541] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.541] SetErrorMode (uMode=0x0) returned 0x1 [0090.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x50 [0090.541] GetLastError () returned 0x12 [0090.541] SetErrorMode (uMode=0x1) returned 0x0 [0090.541] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.541] GetLastError () returned 0x12 [0090.541] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.541] SetErrorMode (uMode=0x0) returned 0x1 [0090.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x55 [0090.541] GetLastError () returned 0x12 [0090.541] SetErrorMode (uMode=0x1) returned 0x0 [0090.541] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.541] GetLastError () returned 0x12 [0090.541] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.542] SetErrorMode (uMode=0x0) returned 0x1 [0090.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x55 [0090.542] GetLastError () returned 0x12 [0090.542] SetErrorMode (uMode=0x1) returned 0x0 [0090.542] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.542] GetLastError () returned 0x12 [0090.542] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.542] SetErrorMode (uMode=0x0) returned 0x1 [0090.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", lpFilePart=0x0) returned 0x58 [0090.542] GetLastError () returned 0x12 [0090.542] SetErrorMode (uMode=0x1) returned 0x0 [0090.542] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.543] GetLastError () returned 0x12 [0090.543] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.543] SetErrorMode (uMode=0x0) returned 0x1 [0090.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", lpFilePart=0x0) returned 0x58 [0090.543] GetLastError () returned 0x12 [0090.543] SetErrorMode (uMode=0x1) returned 0x0 [0090.543] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.543] GetLastError () returned 0x12 [0090.543] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.543] SetErrorMode (uMode=0x0) returned 0x1 [0090.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x3d [0090.543] GetLastError () returned 0x12 [0090.543] SetErrorMode (uMode=0x1) returned 0x0 [0090.543] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.544] GetLastError () returned 0x12 [0090.544] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.544] SetErrorMode (uMode=0x0) returned 0x1 [0090.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x3d [0090.544] GetLastError () returned 0x12 [0090.544] SetErrorMode (uMode=0x1) returned 0x0 [0090.544] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.544] GetLastError () returned 0x12 [0090.544] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.544] SetErrorMode (uMode=0x0) returned 0x1 [0090.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x45 [0090.544] GetLastError () returned 0x12 [0090.544] SetErrorMode (uMode=0x1) returned 0x0 [0090.544] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.544] GetLastError () returned 0x12 [0090.544] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.544] SetErrorMode (uMode=0x0) returned 0x1 [0090.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x45 [0090.545] GetLastError () returned 0x12 [0090.545] SetErrorMode (uMode=0x1) returned 0x0 [0090.545] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.545] GetLastError () returned 0x12 [0090.545] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.545] SetErrorMode (uMode=0x0) returned 0x1 [0090.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3d [0090.545] GetLastError () returned 0x12 [0090.545] SetErrorMode (uMode=0x1) returned 0x0 [0090.545] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.546] GetLastError () returned 0x12 [0090.546] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.546] SetErrorMode (uMode=0x0) returned 0x1 [0090.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3d [0090.546] GetLastError () returned 0x12 [0090.546] SetErrorMode (uMode=0x1) returned 0x0 [0090.546] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.546] GetLastError () returned 0x12 [0090.546] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.546] SetErrorMode (uMode=0x0) returned 0x1 [0090.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3e [0090.546] GetLastError () returned 0x12 [0090.546] SetErrorMode (uMode=0x1) returned 0x0 [0090.546] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.547] GetLastError () returned 0x12 [0090.547] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.547] SetErrorMode (uMode=0x0) returned 0x1 [0090.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3e [0090.547] GetLastError () returned 0x12 [0090.547] SetErrorMode (uMode=0x1) returned 0x0 [0090.547] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.547] GetLastError () returned 0x12 [0090.547] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.547] SetErrorMode (uMode=0x0) returned 0x1 [0090.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3f [0090.547] GetLastError () returned 0x12 [0090.547] SetErrorMode (uMode=0x1) returned 0x0 [0090.547] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.548] GetLastError () returned 0x12 [0090.548] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.548] SetErrorMode (uMode=0x0) returned 0x1 [0090.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3f [0090.548] GetLastError () returned 0x12 [0090.548] SetErrorMode (uMode=0x1) returned 0x0 [0090.548] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.548] GetLastError () returned 0x12 [0090.548] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.548] SetErrorMode (uMode=0x0) returned 0x1 [0090.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3f [0090.548] GetLastError () returned 0x12 [0090.548] SetErrorMode (uMode=0x1) returned 0x0 [0090.548] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.549] GetLastError () returned 0x12 [0090.549] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.549] SetErrorMode (uMode=0x0) returned 0x1 [0090.549] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3f [0090.549] GetLastError () returned 0x12 [0090.549] SetErrorMode (uMode=0x1) returned 0x0 [0090.549] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.549] GetLastError () returned 0x12 [0090.549] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.549] SetErrorMode (uMode=0x0) returned 0x1 [0090.549] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x49 [0090.549] GetLastError () returned 0x12 [0090.549] SetErrorMode (uMode=0x1) returned 0x0 [0090.549] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.549] GetLastError () returned 0x12 [0090.550] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.550] SetErrorMode (uMode=0x0) returned 0x1 [0090.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x49 [0090.550] GetLastError () returned 0x12 [0090.550] SetErrorMode (uMode=0x1) returned 0x0 [0090.550] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.550] GetLastError () returned 0x12 [0090.550] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.550] SetErrorMode (uMode=0x0) returned 0x1 [0090.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x56 [0090.550] GetLastError () returned 0x12 [0090.550] SetErrorMode (uMode=0x1) returned 0x0 [0090.550] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.550] GetLastError () returned 0x12 [0090.550] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.550] SetErrorMode (uMode=0x0) returned 0x1 [0090.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x56 [0090.550] GetLastError () returned 0x12 [0090.550] SetErrorMode (uMode=0x1) returned 0x0 [0090.551] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.551] GetLastError () returned 0x12 [0090.551] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.551] SetErrorMode (uMode=0x0) returned 0x1 [0090.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x62 [0090.551] GetLastError () returned 0x12 [0090.551] SetErrorMode (uMode=0x1) returned 0x0 [0090.551] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.551] GetLastError () returned 0x12 [0090.551] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.551] SetErrorMode (uMode=0x0) returned 0x1 [0090.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x62 [0090.551] GetLastError () returned 0x12 [0090.551] SetErrorMode (uMode=0x1) returned 0x0 [0090.551] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.551] GetLastError () returned 0x12 [0090.551] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.551] SetErrorMode (uMode=0x0) returned 0x1 [0090.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x77 [0090.552] GetLastError () returned 0x12 [0090.552] SetErrorMode (uMode=0x1) returned 0x0 [0090.552] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.552] GetLastError () returned 0x12 [0090.552] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.552] SetErrorMode (uMode=0x0) returned 0x1 [0090.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x77 [0090.552] GetLastError () returned 0x12 [0090.552] SetErrorMode (uMode=0x1) returned 0x0 [0090.552] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.552] GetLastError () returned 0x12 [0090.552] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.552] SetErrorMode (uMode=0x0) returned 0x1 [0090.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x6a [0090.553] GetLastError () returned 0x12 [0090.553] SetErrorMode (uMode=0x1) returned 0x0 [0090.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.553] GetLastError () returned 0x12 [0090.553] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.553] SetErrorMode (uMode=0x0) returned 0x1 [0090.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x6a [0090.553] GetLastError () returned 0x12 [0090.553] SetErrorMode (uMode=0x1) returned 0x0 [0090.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.553] GetLastError () returned 0x12 [0090.553] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.553] SetErrorMode (uMode=0x0) returned 0x1 [0090.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x52 [0090.553] GetLastError () returned 0x12 [0090.553] SetErrorMode (uMode=0x1) returned 0x0 [0090.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.555] GetLastError () returned 0x12 [0090.555] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.555] SetErrorMode (uMode=0x0) returned 0x1 [0090.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x52 [0090.555] GetLastError () returned 0x12 [0090.555] SetErrorMode (uMode=0x1) returned 0x0 [0090.555] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.555] GetLastError () returned 0x12 [0090.555] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.555] SetErrorMode (uMode=0x0) returned 0x1 [0090.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x56 [0090.555] GetLastError () returned 0x12 [0090.555] SetErrorMode (uMode=0x1) returned 0x0 [0090.555] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.556] GetLastError () returned 0x12 [0090.556] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.556] SetErrorMode (uMode=0x0) returned 0x1 [0090.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x56 [0090.556] GetLastError () returned 0x12 [0090.556] SetErrorMode (uMode=0x1) returned 0x0 [0090.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.556] GetLastError () returned 0x12 [0090.556] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.556] SetErrorMode (uMode=0x0) returned 0x1 [0090.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0", lpFilePart=0x0) returned 0x5f [0090.556] GetLastError () returned 0x12 [0090.556] SetErrorMode (uMode=0x1) returned 0x0 [0090.556] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.557] GetLastError () returned 0x12 [0090.557] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.557] SetErrorMode (uMode=0x0) returned 0x1 [0090.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0", lpFilePart=0x0) returned 0x5f [0090.557] GetLastError () returned 0x12 [0090.557] SetErrorMode (uMode=0x1) returned 0x0 [0090.557] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.557] GetLastError () returned 0x12 [0090.558] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.558] SetErrorMode (uMode=0x0) returned 0x1 [0090.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR", lpFilePart=0x0) returned 0x5f [0090.558] GetLastError () returned 0x12 [0090.558] SetErrorMode (uMode=0x1) returned 0x0 [0090.558] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.558] GetLastError () returned 0x12 [0090.558] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.558] SetErrorMode (uMode=0x0) returned 0x1 [0090.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR", lpFilePart=0x0) returned 0x5f [0090.558] GetLastError () returned 0x12 [0090.558] SetErrorMode (uMode=0x1) returned 0x0 [0090.558] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.558] GetLastError () returned 0x12 [0090.558] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.558] SetErrorMode (uMode=0x0) returned 0x1 [0090.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC", lpFilePart=0x0) returned 0x5f [0090.558] GetLastError () returned 0x12 [0090.559] SetErrorMode (uMode=0x1) returned 0x0 [0090.559] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.559] GetLastError () returned 0x12 [0090.559] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.559] SetErrorMode (uMode=0x0) returned 0x1 [0090.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC", lpFilePart=0x0) returned 0x5f [0090.559] GetLastError () returned 0x12 [0090.559] SetErrorMode (uMode=0x1) returned 0x0 [0090.559] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.559] GetLastError () returned 0x12 [0090.559] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.559] SetErrorMode (uMode=0x0) returned 0x1 [0090.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E", lpFilePart=0x0) returned 0x5f [0090.559] GetLastError () returned 0x12 [0090.559] SetErrorMode (uMode=0x1) returned 0x0 [0090.559] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.560] GetLastError () returned 0x12 [0090.560] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.560] SetErrorMode (uMode=0x0) returned 0x1 [0090.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E", lpFilePart=0x0) returned 0x5f [0090.560] GetLastError () returned 0x12 [0090.560] SetErrorMode (uMode=0x1) returned 0x0 [0090.560] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.560] GetLastError () returned 0x12 [0090.560] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.560] SetErrorMode (uMode=0x0) returned 0x1 [0090.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x3b [0090.560] GetLastError () returned 0x12 [0090.560] SetErrorMode (uMode=0x1) returned 0x0 [0090.560] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.560] GetLastError () returned 0x12 [0090.560] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.561] SetErrorMode (uMode=0x0) returned 0x1 [0090.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x3b [0090.561] GetLastError () returned 0x12 [0090.561] SetErrorMode (uMode=0x1) returned 0x0 [0090.561] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.561] GetLastError () returned 0x12 [0090.561] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.561] SetErrorMode (uMode=0x0) returned 0x1 [0090.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x42 [0090.561] GetLastError () returned 0x12 [0090.561] SetErrorMode (uMode=0x1) returned 0x0 [0090.561] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.562] GetLastError () returned 0x12 [0090.562] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.562] SetErrorMode (uMode=0x0) returned 0x1 [0090.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x42 [0090.562] GetLastError () returned 0x12 [0090.562] SetErrorMode (uMode=0x1) returned 0x0 [0090.562] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.562] GetLastError () returned 0x12 [0090.562] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.562] SetErrorMode (uMode=0x0) returned 0x1 [0090.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14", lpFilePart=0x0) returned 0x45 [0090.562] GetLastError () returned 0x12 [0090.562] SetErrorMode (uMode=0x1) returned 0x0 [0090.562] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.563] GetLastError () returned 0x12 [0090.563] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.563] SetErrorMode (uMode=0x0) returned 0x1 [0090.563] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14", lpFilePart=0x0) returned 0x45 [0090.563] GetLastError () returned 0x12 [0090.563] SetErrorMode (uMode=0x1) returned 0x0 [0090.564] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.564] GetLastError () returned 0x12 [0090.564] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.564] SetErrorMode (uMode=0x0) returned 0x1 [0090.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033", lpFilePart=0x0) returned 0x4a [0090.564] GetLastError () returned 0x12 [0090.564] SetErrorMode (uMode=0x1) returned 0x0 [0090.564] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.565] GetLastError () returned 0x12 [0090.565] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.565] SetErrorMode (uMode=0x0) returned 0x1 [0090.565] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033", lpFilePart=0x0) returned 0x4a [0090.565] GetLastError () returned 0x12 [0090.566] SetErrorMode (uMode=0x1) returned 0x0 [0090.566] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.566] GetLastError () returned 0x12 [0090.566] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.566] SetErrorMode (uMode=0x0) returned 0x1 [0090.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x3f [0090.566] GetLastError () returned 0x12 [0090.566] SetErrorMode (uMode=0x1) returned 0x0 [0090.566] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.566] GetLastError () returned 0x12 [0090.567] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.567] SetErrorMode (uMode=0x0) returned 0x1 [0090.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x3f [0090.567] GetLastError () returned 0x12 [0090.567] SetErrorMode (uMode=0x1) returned 0x0 [0090.567] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.567] GetLastError () returned 0x12 [0090.567] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.567] SetErrorMode (uMode=0x0) returned 0x1 [0090.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x4b [0090.567] GetLastError () returned 0x12 [0090.567] SetErrorMode (uMode=0x1) returned 0x0 [0090.567] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.568] GetLastError () returned 0x12 [0090.568] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.568] SetErrorMode (uMode=0x0) returned 0x1 [0090.568] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x4b [0090.568] GetLastError () returned 0x12 [0090.568] SetErrorMode (uMode=0x1) returned 0x0 [0090.568] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.568] GetLastError () returned 0x12 [0090.568] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.568] SetErrorMode (uMode=0x0) returned 0x1 [0090.568] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpFilePart=0x0) returned 0x4f [0090.568] GetLastError () returned 0x12 [0090.568] SetErrorMode (uMode=0x1) returned 0x0 [0090.568] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.569] GetLastError () returned 0x12 [0090.569] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.569] SetErrorMode (uMode=0x0) returned 0x1 [0090.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpFilePart=0x0) returned 0x4f [0090.569] GetLastError () returned 0x12 [0090.569] SetErrorMode (uMode=0x1) returned 0x0 [0090.569] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.569] GetLastError () returned 0x12 [0090.569] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.569] SetErrorMode (uMode=0x0) returned 0x1 [0090.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpFilePart=0x0) returned 0x5a [0090.569] GetLastError () returned 0x12 [0090.569] SetErrorMode (uMode=0x1) returned 0x0 [0090.569] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.570] GetLastError () returned 0x12 [0090.570] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.570] SetErrorMode (uMode=0x0) returned 0x1 [0090.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpFilePart=0x0) returned 0x5a [0090.570] GetLastError () returned 0x12 [0090.570] SetErrorMode (uMode=0x1) returned 0x0 [0090.570] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.570] GetLastError () returned 0x12 [0090.570] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.570] SetErrorMode (uMode=0x0) returned 0x1 [0090.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x3e [0090.570] GetLastError () returned 0x12 [0090.570] SetErrorMode (uMode=0x1) returned 0x0 [0090.571] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.582] GetLastError () returned 0x12 [0090.582] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.583] SetErrorMode (uMode=0x0) returned 0x1 [0090.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x3e [0090.583] GetLastError () returned 0x12 [0090.583] SetErrorMode (uMode=0x1) returned 0x0 [0090.583] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.583] GetLastError () returned 0x12 [0090.583] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.583] SetErrorMode (uMode=0x0) returned 0x1 [0090.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpFilePart=0x0) returned 0x45 [0090.583] GetLastError () returned 0x12 [0090.583] SetErrorMode (uMode=0x1) returned 0x0 [0090.583] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.584] GetLastError () returned 0x12 [0090.584] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.584] SetErrorMode (uMode=0x0) returned 0x1 [0090.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpFilePart=0x0) returned 0x45 [0090.584] GetLastError () returned 0x12 [0090.584] SetErrorMode (uMode=0x1) returned 0x0 [0090.585] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.585] GetLastError () returned 0x12 [0090.585] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.585] SetErrorMode (uMode=0x0) returned 0x1 [0090.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3f [0090.585] GetLastError () returned 0x12 [0090.585] SetErrorMode (uMode=0x1) returned 0x0 [0090.585] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.586] GetLastError () returned 0x12 [0090.586] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.586] SetErrorMode (uMode=0x0) returned 0x1 [0090.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3f [0090.586] GetLastError () returned 0x12 [0090.586] SetErrorMode (uMode=0x1) returned 0x0 [0090.586] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0090.587] GetLastError () returned 0x12 [0090.587] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0090.587] SetErrorMode (uMode=0x0) returned 0x1 [0090.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", lpFilePart=0x0) returned 0x4b [0090.587] GetLastError () returned 0x12 [0090.587] SetErrorMode (uMode=0x1) returned 0x0 [0090.587] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.587] GetLastError () returned 0x0 [0090.587] GetFileType (hFile=0x220) returned 0x1 [0090.587] GetFileType (hFile=0x220) returned 0x1 [0090.587] ReadFile (in: hFile=0x220, lpBuffer=0x25b0ab8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x25b0ab8*, lpNumberOfBytesRead=0x39eb58*=0x9a2, lpOverlapped=0x0) returned 1 [0090.598] GetLastError () returned 0x0 [0090.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", lpFilePart=0x0) returned 0x4b [0090.623] GetLastError () returned 0x0 [0090.623] SetErrorMode (uMode=0x1) returned 0x0 [0090.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.624] GetLastError () returned 0xb7 [0090.624] GetFileType (hFile=0x220) returned 0x1 [0090.624] GetFileType (hFile=0x220) returned 0x1 [0090.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", lpFilePart=0x0) returned 0x4b [0090.624] GetLastError () returned 0xb7 [0090.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.LanRan2.0.5", lpFilePart=0x0) returned 0x57 [0090.624] GetLastError () returned 0xb7 [0090.624] SetErrorMode (uMode=0x1) returned 0x0 [0090.625] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6215c440, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x6215c440, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x4d99e60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x9b0)) returned 1 [0090.625] GetLastError () returned 0xb7 [0090.625] SetErrorMode (uMode=0x0) returned 0x1 [0090.625] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.lanran2.0.5")) returned 1 [0090.625] GetLastError () returned 0xb7 [0090.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", lpFilePart=0x0) returned 0x42 [0090.625] GetLastError () returned 0xb7 [0090.625] SetErrorMode (uMode=0x1) returned 0x0 [0090.625] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c5b0 [0090.626] GetLastError () returned 0xb7 [0090.626] FindClose (in: hFindFile=0x42c5b0 | out: hFindFile=0x42c5b0) returned 1 [0090.626] SetErrorMode (uMode=0x0) returned 0x1 [0090.626] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", lpFilePart=0x0) returned 0x42 [0090.626] GetLastError () returned 0x12 [0090.627] SetErrorMode (uMode=0x1) returned 0x0 [0090.627] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c5b0 [0090.627] GetLastError () returned 0x12 [0090.627] FindClose (in: hFindFile=0x42c5b0 | out: hFindFile=0x42c5b0) returned 1 [0090.627] SetErrorMode (uMode=0x0) returned 0x1 [0090.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", lpFilePart=0x0) returned 0x3d [0090.627] GetLastError () returned 0x12 [0090.627] SetErrorMode (uMode=0x1) returned 0x0 [0090.627] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c5b0 [0090.634] GetLastError () returned 0x12 [0090.634] FindClose (in: hFindFile=0x42c5b0 | out: hFindFile=0x42c5b0) returned 1 [0090.634] SetErrorMode (uMode=0x0) returned 0x1 [0090.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", lpFilePart=0x0) returned 0x3d [0090.634] GetLastError () returned 0x12 [0090.634] SetErrorMode (uMode=0x1) returned 0x0 [0090.634] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c5b0 [0090.634] GetLastError () returned 0x12 [0090.634] FindClose (in: hFindFile=0x42c5b0 | out: hFindFile=0x42c5b0) returned 1 [0090.635] SetErrorMode (uMode=0x0) returned 0x1 [0090.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x3f [0090.635] GetLastError () returned 0x12 [0090.635] SetErrorMode (uMode=0x1) returned 0x0 [0090.635] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c5b0 [0090.635] GetLastError () returned 0x12 [0090.635] FindClose (in: hFindFile=0x42c5b0 | out: hFindFile=0x42c5b0) returned 1 [0090.635] SetErrorMode (uMode=0x0) returned 0x1 [0090.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x3f [0090.635] GetLastError () returned 0x12 [0090.635] SetErrorMode (uMode=0x1) returned 0x0 [0090.635] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c5b0 [0090.636] GetLastError () returned 0x12 [0090.636] FindClose (in: hFindFile=0x42c5b0 | out: hFindFile=0x42c5b0) returned 1 [0090.636] SetErrorMode (uMode=0x0) returned 0x1 [0090.636] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST", lpFilePart=0x0) returned 0x48 [0090.636] GetLastError () returned 0x12 [0090.636] SetErrorMode (uMode=0x1) returned 0x0 [0090.636] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\credhist"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.636] GetLastError () returned 0x0 [0090.636] GetFileType (hFile=0x220) returned 0x1 [0090.636] GetFileType (hFile=0x220) returned 0x1 [0090.636] ReadFile (in: hFile=0x220, lpBuffer=0x2640d84, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x2640d84*, lpNumberOfBytesRead=0x39eb58*=0xa8, lpOverlapped=0x0) returned 1 [0090.637] GetLastError () returned 0x0 [0090.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST", lpFilePart=0x0) returned 0x48 [0090.666] GetLastError () returned 0x0 [0090.666] SetErrorMode (uMode=0x1) returned 0x0 [0090.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\CREDHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\credhist"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0090.667] GetLastError () returned 0x5 [0090.668] SetErrorMode (uMode=0x0) returned 0x1 [0090.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST", lpFilePart=0x0) returned 0x48 [0090.669] GetLastError () returned 0x5 [0090.669] SetErrorMode (uMode=0x1) returned 0x0 [0090.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\synchist"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.669] GetLastError () returned 0x0 [0090.669] GetFileType (hFile=0x220) returned 0x1 [0090.669] GetFileType (hFile=0x220) returned 0x1 [0090.669] ReadFile (in: hFile=0x220, lpBuffer=0x26ca3f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x26ca3f4*, lpNumberOfBytesRead=0x39eb58*=0x4c, lpOverlapped=0x0) returned 1 [0090.670] GetLastError () returned 0x0 [0090.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST", lpFilePart=0x0) returned 0x48 [0090.705] GetLastError () returned 0x0 [0090.705] SetErrorMode (uMode=0x1) returned 0x0 [0090.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\SYNCHIST" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\synchist"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0090.705] GetLastError () returned 0x5 [0090.707] SetErrorMode (uMode=0x0) returned 0x1 [0090.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x6d [0090.707] GetLastError () returned 0x5 [0090.707] SetErrorMode (uMode=0x1) returned 0x0 [0090.707] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3b0 [0090.716] GetLastError () returned 0x5 [0090.716] FindClose (in: hFindFile=0x42c3b0 | out: hFindFile=0x42c3b0) returned 1 [0090.716] SetErrorMode (uMode=0x0) returned 0x1 [0090.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x6d [0090.716] GetLastError () returned 0x12 [0090.716] SetErrorMode (uMode=0x1) returned 0x0 [0090.717] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3b0 [0090.717] GetLastError () returned 0x12 [0090.717] FindClose (in: hFindFile=0x42c3b0 | out: hFindFile=0x42c3b0) returned 1 [0090.719] SetErrorMode (uMode=0x0) returned 0x1 [0090.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", lpFilePart=0x0) returned 0x92 [0090.719] GetLastError () returned 0x12 [0090.719] SetErrorMode (uMode=0x1) returned 0x0 [0090.720] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.721] GetLastError () returned 0x0 [0090.721] GetFileType (hFile=0x220) returned 0x1 [0090.721] GetFileType (hFile=0x220) returned 0x1 [0090.721] ReadFile (in: hFile=0x220, lpBuffer=0x25551e4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x25551e4*, lpNumberOfBytesRead=0x39eaf8*=0x1d4, lpOverlapped=0x0) returned 1 [0090.722] GetLastError () returned 0x0 [0090.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", lpFilePart=0x0) returned 0x92 [0090.750] GetLastError () returned 0x0 [0090.750] SetErrorMode (uMode=0x1) returned 0x0 [0090.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\be5b4fbd-cb99-45f5-9462-5f896dd3a6b9"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0090.750] GetLastError () returned 0x5 [0090.751] SetErrorMode (uMode=0x0) returned 0x1 [0090.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred", lpFilePart=0x0) returned 0x77 [0090.751] GetLastError () returned 0x5 [0090.751] SetErrorMode (uMode=0x1) returned 0x0 [0090.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.752] GetLastError () returned 0x0 [0090.752] GetFileType (hFile=0x220) returned 0x1 [0090.752] GetFileType (hFile=0x220) returned 0x1 [0090.752] ReadFile (in: hFile=0x220, lpBuffer=0x25df388, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x25df388*, lpNumberOfBytesRead=0x39eaf8*=0x18, lpOverlapped=0x0) returned 1 [0090.753] GetLastError () returned 0x0 [0090.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred", lpFilePart=0x0) returned 0x77 [0090.781] GetLastError () returned 0x0 [0090.781] SetErrorMode (uMode=0x1) returned 0x0 [0090.781] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\preferred"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0090.781] GetLastError () returned 0x5 [0090.782] SetErrorMode (uMode=0x0) returned 0x1 [0090.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x6e [0090.783] GetLastError () returned 0x5 [0090.783] SetErrorMode (uMode=0x1) returned 0x0 [0090.783] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0 [0090.784] GetLastError () returned 0x5 [0090.784] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1 [0090.784] SetErrorMode (uMode=0x0) returned 0x1 [0090.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x6e [0090.784] GetLastError () returned 0x12 [0090.784] SetErrorMode (uMode=0x1) returned 0x0 [0090.784] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0 [0090.784] GetLastError () returned 0x12 [0090.784] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1 [0090.784] SetErrorMode (uMode=0x0) returned 0x1 [0090.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c", lpFilePart=0x0) returned 0x93 [0090.784] GetLastError () returned 0x12 [0090.784] SetErrorMode (uMode=0x1) returned 0x0 [0090.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.801] GetLastError () returned 0x0 [0090.801] GetFileType (hFile=0x220) returned 0x1 [0090.801] GetFileType (hFile=0x220) returned 0x1 [0090.801] ReadFile (in: hFile=0x220, lpBuffer=0x266a944, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x266a944*, lpNumberOfBytesRead=0x39eaf8*=0x1d4, lpOverlapped=0x0) returned 1 [0090.802] GetLastError () returned 0x0 [0090.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c", lpFilePart=0x0) returned 0x93 [0090.841] GetLastError () returned 0x0 [0090.841] SetErrorMode (uMode=0x1) returned 0x0 [0090.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\02540a10-7eb7-4b20-a8c7-470f8986389c"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0090.842] GetLastError () returned 0x5 [0090.847] SetErrorMode (uMode=0x0) returned 0x1 [0090.848] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d", lpFilePart=0x0) returned 0x93 [0090.848] GetLastError () returned 0x5 [0090.848] SetErrorMode (uMode=0x1) returned 0x0 [0090.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.848] GetLastError () returned 0x0 [0090.848] GetFileType (hFile=0x220) returned 0x1 [0090.848] GetFileType (hFile=0x220) returned 0x1 [0090.848] ReadFile (in: hFile=0x220, lpBuffer=0x24f4e38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x24f4e38*, lpNumberOfBytesRead=0x39eaf8*=0x1d4, lpOverlapped=0x0) returned 1 [0090.849] GetLastError () returned 0x0 [0090.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d", lpFilePart=0x0) returned 0x93 [0090.874] GetLastError () returned 0x0 [0090.874] SetErrorMode (uMode=0x1) returned 0x0 [0090.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\2be989a0-16a1-424b-9211-51aa3bb43e5d"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0090.874] GetLastError () returned 0x5 [0090.875] SetErrorMode (uMode=0x0) returned 0x1 [0090.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d", lpFilePart=0x0) returned 0x93 [0090.876] GetLastError () returned 0x5 [0090.876] SetErrorMode (uMode=0x1) returned 0x0 [0090.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.876] GetLastError () returned 0x0 [0090.876] GetFileType (hFile=0x220) returned 0x1 [0090.876] GetFileType (hFile=0x220) returned 0x1 [0090.876] ReadFile (in: hFile=0x220, lpBuffer=0x257f20c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x257f20c*, lpNumberOfBytesRead=0x39eaf8*=0x1d4, lpOverlapped=0x0) returned 1 [0090.877] GetLastError () returned 0x0 [0090.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d", lpFilePart=0x0) returned 0x93 [0090.902] GetLastError () returned 0x0 [0090.902] SetErrorMode (uMode=0x1) returned 0x0 [0090.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\fbbe72db-afd8-443b-88dd-64b20388700d"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0090.902] GetLastError () returned 0x5 [0090.903] SetErrorMode (uMode=0x0) returned 0x1 [0090.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", lpFilePart=0x0) returned 0x78 [0090.904] GetLastError () returned 0x5 [0090.904] SetErrorMode (uMode=0x1) returned 0x0 [0090.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\preferred"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.904] GetLastError () returned 0x0 [0090.904] GetFileType (hFile=0x220) returned 0x1 [0090.904] GetFileType (hFile=0x220) returned 0x1 [0090.905] ReadFile (in: hFile=0x220, lpBuffer=0x2609214, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x2609214*, lpNumberOfBytesRead=0x39eaf8*=0x18, lpOverlapped=0x0) returned 1 [0090.905] GetLastError () returned 0x0 [0090.930] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred", lpFilePart=0x0) returned 0x78 [0090.930] GetLastError () returned 0x0 [0090.930] SetErrorMode (uMode=0x1) returned 0x0 [0090.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Preferred" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\preferred"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0090.930] GetLastError () returned 0x5 [0090.931] SetErrorMode (uMode=0x0) returned 0x1 [0090.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x41 [0090.932] GetLastError () returned 0x5 [0090.932] SetErrorMode (uMode=0x1) returned 0x0 [0090.932] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3b0 [0090.933] GetLastError () returned 0x5 [0090.933] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.933] GetLastError () returned 0x5 [0090.933] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.933] GetLastError () returned 0x12 [0090.933] FindClose (in: hFindFile=0x42c3b0 | out: hFindFile=0x42c3b0) returned 1 [0090.933] SetErrorMode (uMode=0x0) returned 0x1 [0090.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x41 [0090.933] GetLastError () returned 0x12 [0090.933] SetErrorMode (uMode=0x1) returned 0x0 [0090.933] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3b0 [0090.933] GetLastError () returned 0x12 [0090.933] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.933] GetLastError () returned 0x12 [0090.934] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.934] GetLastError () returned 0x12 [0090.934] FindClose (in: hFindFile=0x42c3b0 | out: hFindFile=0x42c3b0) returned 1 [0090.934] SetErrorMode (uMode=0x0) returned 0x1 [0090.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", lpFilePart=0x0) returned 0x51 [0090.934] GetLastError () returned 0x12 [0090.934] SetErrorMode (uMode=0x1) returned 0x0 [0090.934] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3b0 [0090.945] GetLastError () returned 0x12 [0090.945] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.945] GetLastError () returned 0x12 [0090.945] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.945] GetLastError () returned 0x12 [0090.945] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.945] GetLastError () returned 0x12 [0090.945] FindClose (in: hFindFile=0x42c3b0 | out: hFindFile=0x42c3b0) returned 1 [0090.945] SetErrorMode (uMode=0x0) returned 0x1 [0090.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", lpFilePart=0x0) returned 0x51 [0090.946] GetLastError () returned 0x12 [0090.946] SetErrorMode (uMode=0x1) returned 0x0 [0090.946] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3b0 [0090.946] GetLastError () returned 0x12 [0090.946] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.946] GetLastError () returned 0x12 [0090.946] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.946] GetLastError () returned 0x12 [0090.946] FindNextFileW (in: hFindFile=0x42c3b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.946] GetLastError () returned 0x12 [0090.946] FindClose (in: hFindFile=0x42c3b0 | out: hFindFile=0x42c3b0) returned 1 [0090.947] SetErrorMode (uMode=0x0) returned 0x1 [0090.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", nBufferLength=0x105, lpBuffer=0x39e5fc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", lpFilePart=0x0) returned 0x62 [0090.947] GetLastError () returned 0x12 [0090.947] SetErrorMode (uMode=0x1) returned 0x0 [0090.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.948] GetLastError () returned 0x0 [0090.948] GetFileType (hFile=0x220) returned 0x1 [0090.948] GetFileType (hFile=0x220) returned 0x1 [0090.948] ReadFile (in: hFile=0x220, lpBuffer=0x2694940, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eb58, lpOverlapped=0x0 | out: lpBuffer=0x2694940*, lpNumberOfBytesRead=0x39eb58*=0xa8, lpOverlapped=0x0) returned 1 [0090.949] GetLastError () returned 0x0 [0090.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", nBufferLength=0x105, lpBuffer=0x39e604, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", lpFilePart=0x0) returned 0x62 [0090.976] GetLastError () returned 0x0 [0090.977] SetErrorMode (uMode=0x1) returned 0x0 [0090.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0090.977] GetLastError () returned 0xb7 [0090.977] GetFileType (hFile=0x220) returned 0x1 [0090.977] GetFileType (hFile=0x220) returned 0x1 [0090.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", lpFilePart=0x0) returned 0x62 [0090.978] GetLastError () returned 0xb7 [0090.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e728, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.LanRan2.0.5", lpFilePart=0x0) returned 0x6e [0090.978] GetLastError () returned 0xb7 [0090.978] SetErrorMode (uMode=0x1) returned 0x0 [0090.978] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), fInfoLevelId=0x0, lpFileInformation=0x39eba8 | out: lpFileInformation=0x39eba8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5105e00, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0090.978] GetLastError () returned 0xb7 [0090.979] SetErrorMode (uMode=0x0) returned 0x1 [0090.979] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml.lanran2.0.5")) returned 1 [0090.979] GetLastError () returned 0xb7 [0090.979] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x3e [0090.979] GetLastError () returned 0xb7 [0090.979] SetErrorMode (uMode=0x1) returned 0x0 [0090.979] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.980] GetLastError () returned 0xb7 [0090.980] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.980] GetLastError () returned 0xb7 [0090.980] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.980] GetLastError () returned 0x12 [0090.980] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.980] SetErrorMode (uMode=0x0) returned 0x1 [0090.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x3e [0090.980] GetLastError () returned 0x12 [0090.980] SetErrorMode (uMode=0x1) returned 0x0 [0090.980] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.980] GetLastError () returned 0x12 [0090.981] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.981] GetLastError () returned 0x12 [0090.981] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.981] GetLastError () returned 0x12 [0090.981] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.981] SetErrorMode (uMode=0x0) returned 0x1 [0090.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x4a [0090.981] GetLastError () returned 0x12 [0090.981] SetErrorMode (uMode=0x1) returned 0x0 [0090.981] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.981] GetLastError () returned 0x12 [0090.982] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.982] GetLastError () returned 0x12 [0090.982] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.982] GetLastError () returned 0x12 [0090.982] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.982] GetLastError () returned 0x12 [0090.982] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.982] SetErrorMode (uMode=0x0) returned 0x1 [0090.982] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x4a [0090.982] GetLastError () returned 0x12 [0090.982] SetErrorMode (uMode=0x1) returned 0x0 [0090.982] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.982] GetLastError () returned 0x12 [0090.982] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.982] GetLastError () returned 0x12 [0090.982] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.982] GetLastError () returned 0x12 [0090.983] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.983] GetLastError () returned 0x12 [0090.983] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.983] SetErrorMode (uMode=0x0) returned 0x1 [0090.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x4d [0090.983] GetLastError () returned 0x12 [0090.983] SetErrorMode (uMode=0x1) returned 0x0 [0090.983] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.983] GetLastError () returned 0x12 [0090.983] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.983] GetLastError () returned 0x12 [0090.983] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.983] GetLastError () returned 0x12 [0090.983] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.983] GetLastError () returned 0x12 [0090.983] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.984] GetLastError () returned 0x12 [0090.984] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.984] GetLastError () returned 0x12 [0090.984] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.984] SetErrorMode (uMode=0x0) returned 0x1 [0090.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x4d [0090.984] GetLastError () returned 0x12 [0090.984] SetErrorMode (uMode=0x1) returned 0x0 [0090.984] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.984] GetLastError () returned 0x12 [0090.984] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.984] GetLastError () returned 0x12 [0090.984] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.984] GetLastError () returned 0x12 [0090.984] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.984] GetLastError () returned 0x12 [0090.984] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.984] GetLastError () returned 0x12 [0090.985] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.985] GetLastError () returned 0x12 [0090.985] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.985] SetErrorMode (uMode=0x0) returned 0x1 [0090.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x5a [0090.985] GetLastError () returned 0x12 [0090.985] SetErrorMode (uMode=0x1) returned 0x0 [0090.985] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.985] GetLastError () returned 0x12 [0090.985] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.985] GetLastError () returned 0x12 [0090.985] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.985] GetLastError () returned 0x12 [0090.985] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.986] SetErrorMode (uMode=0x0) returned 0x1 [0090.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x5a [0090.986] GetLastError () returned 0x12 [0090.986] SetErrorMode (uMode=0x1) returned 0x0 [0090.987] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.987] GetLastError () returned 0x12 [0090.987] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.987] GetLastError () returned 0x12 [0090.987] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.987] GetLastError () returned 0x12 [0090.987] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.987] SetErrorMode (uMode=0x0) returned 0x1 [0090.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x52 [0090.987] GetLastError () returned 0x12 [0090.987] SetErrorMode (uMode=0x1) returned 0x0 [0090.987] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.987] GetLastError () returned 0x12 [0090.988] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.988] GetLastError () returned 0x12 [0090.988] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.988] GetLastError () returned 0x12 [0090.988] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.988] SetErrorMode (uMode=0x0) returned 0x1 [0090.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x52 [0090.988] GetLastError () returned 0x12 [0090.988] SetErrorMode (uMode=0x1) returned 0x0 [0090.988] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.988] GetLastError () returned 0x12 [0090.988] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.988] GetLastError () returned 0x12 [0090.988] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.988] GetLastError () returned 0x12 [0090.988] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.989] SetErrorMode (uMode=0x0) returned 0x1 [0090.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x52 [0090.989] GetLastError () returned 0x12 [0090.989] SetErrorMode (uMode=0x1) returned 0x0 [0090.989] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.989] GetLastError () returned 0x12 [0090.989] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.989] GetLastError () returned 0x12 [0090.989] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.989] GetLastError () returned 0x12 [0090.989] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.989] SetErrorMode (uMode=0x0) returned 0x1 [0090.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x52 [0090.989] GetLastError () returned 0x12 [0090.989] SetErrorMode (uMode=0x1) returned 0x0 [0090.990] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.990] GetLastError () returned 0x12 [0090.990] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.990] GetLastError () returned 0x12 [0090.990] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.990] GetLastError () returned 0x12 [0090.990] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.990] SetErrorMode (uMode=0x0) returned 0x1 [0090.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x41 [0090.990] GetLastError () returned 0x12 [0090.990] SetErrorMode (uMode=0x1) returned 0x0 [0090.990] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.991] GetLastError () returned 0x12 [0090.991] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.991] GetLastError () returned 0x12 [0090.991] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.991] GetLastError () returned 0x12 [0090.991] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.991] GetLastError () returned 0x12 [0090.991] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.991] SetErrorMode (uMode=0x0) returned 0x1 [0090.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x41 [0090.992] GetLastError () returned 0x12 [0090.992] SetErrorMode (uMode=0x1) returned 0x0 [0090.992] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.992] GetLastError () returned 0x12 [0090.992] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.992] GetLastError () returned 0x12 [0090.992] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.992] GetLastError () returned 0x12 [0090.992] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.992] GetLastError () returned 0x12 [0090.992] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.992] SetErrorMode (uMode=0x0) returned 0x1 [0090.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x3e [0090.992] GetLastError () returned 0x12 [0090.992] SetErrorMode (uMode=0x1) returned 0x0 [0090.993] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.993] GetLastError () returned 0x12 [0090.993] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.993] GetLastError () returned 0x12 [0090.993] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.993] GetLastError () returned 0x12 [0090.994] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.994] GetLastError () returned 0x12 [0090.994] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.994] SetErrorMode (uMode=0x0) returned 0x1 [0090.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x3e [0090.994] GetLastError () returned 0x12 [0090.994] SetErrorMode (uMode=0x1) returned 0x0 [0090.994] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.994] GetLastError () returned 0x12 [0090.994] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.994] GetLastError () returned 0x12 [0090.994] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.994] GetLastError () returned 0x12 [0090.994] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.994] GetLastError () returned 0x12 [0090.994] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.995] SetErrorMode (uMode=0x0) returned 0x1 [0090.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x3f [0090.995] GetLastError () returned 0x12 [0090.995] SetErrorMode (uMode=0x1) returned 0x0 [0090.995] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.995] GetLastError () returned 0x12 [0090.995] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.995] GetLastError () returned 0x12 [0090.995] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.995] GetLastError () returned 0x12 [0090.995] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.995] GetLastError () returned 0x12 [0090.995] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.995] GetLastError () returned 0x12 [0090.995] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.995] GetLastError () returned 0x12 [0090.995] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.995] GetLastError () returned 0x12 [0090.995] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.996] GetLastError () returned 0x12 [0090.996] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.996] GetLastError () returned 0x12 [0090.996] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.996] GetLastError () returned 0x12 [0090.996] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.996] GetLastError () returned 0x12 [0090.996] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.996] GetLastError () returned 0x12 [0090.996] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.996] GetLastError () returned 0x12 [0090.996] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.996] GetLastError () returned 0x12 [0090.996] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.996] GetLastError () returned 0x12 [0090.996] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.996] SetErrorMode (uMode=0x0) returned 0x1 [0090.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x3f [0090.996] GetLastError () returned 0x12 [0090.996] SetErrorMode (uMode=0x1) returned 0x0 [0090.997] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.997] GetLastError () returned 0x12 [0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.997] GetLastError () returned 0x12 [0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.997] GetLastError () returned 0x12 [0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.997] GetLastError () returned 0x12 [0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.997] GetLastError () returned 0x12 [0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.997] GetLastError () returned 0x12 [0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.997] GetLastError () returned 0x12 [0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.997] GetLastError () returned 0x12 [0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.997] GetLastError () returned 0x12 [0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.997] GetLastError () returned 0x12 [0090.997] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.998] GetLastError () returned 0x12 [0090.998] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.998] GetLastError () returned 0x12 [0090.998] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.998] GetLastError () returned 0x12 [0090.998] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.998] GetLastError () returned 0x12 [0090.998] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0090.998] GetLastError () returned 0x12 [0090.998] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0090.998] SetErrorMode (uMode=0x0) returned 0x1 [0090.998] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x47 [0090.998] GetLastError () returned 0x12 [0090.998] SetErrorMode (uMode=0x1) returned 0x0 [0090.998] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0090.998] GetLastError () returned 0x12 [0090.998] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.999] GetLastError () returned 0x12 [0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.999] GetLastError () returned 0x12 [0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.999] GetLastError () returned 0x12 [0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.999] GetLastError () returned 0x12 [0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.999] GetLastError () returned 0x12 [0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.999] GetLastError () returned 0x12 [0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.999] GetLastError () returned 0x12 [0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.999] GetLastError () returned 0x12 [0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.999] GetLastError () returned 0x12 [0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.999] GetLastError () returned 0x12 [0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0090.999] GetLastError () returned 0x12 [0090.999] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0091.000] GetLastError () returned 0x12 [0091.000] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0091.000] SetErrorMode (uMode=0x0) returned 0x1 [0091.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies", lpFilePart=0x0) returned 0x47 [0091.000] GetLastError () returned 0x12 [0091.000] SetErrorMode (uMode=0x1) returned 0x0 [0091.000] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0091.000] GetLastError () returned 0x12 [0091.000] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.000] GetLastError () returned 0x12 [0091.000] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.000] GetLastError () returned 0x12 [0091.000] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.000] GetLastError () returned 0x12 [0091.000] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.000] GetLastError () returned 0x12 [0091.000] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.000] GetLastError () returned 0x12 [0091.001] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.001] GetLastError () returned 0x12 [0091.001] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.001] GetLastError () returned 0x12 [0091.001] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.001] GetLastError () returned 0x12 [0091.001] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.001] GetLastError () returned 0x12 [0091.001] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.001] GetLastError () returned 0x12 [0091.001] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.001] GetLastError () returned 0x12 [0091.001] FindNextFileW (in: hFindFile=0x42c630, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0091.001] GetLastError () returned 0x12 [0091.001] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0091.001] SetErrorMode (uMode=0x0) returned 0x1 [0091.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", lpFilePart=0x0) returned 0x69 [0091.002] GetLastError () returned 0x12 [0091.002] SetErrorMode (uMode=0x1) returned 0x0 [0091.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.003] GetLastError () returned 0x0 [0091.003] GetFileType (hFile=0x220) returned 0x1 [0091.003] GetFileType (hFile=0x220) returned 0x1 [0091.003] ReadFile (in: hFile=0x220, lpBuffer=0x252a6b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x252a6b4*, lpNumberOfBytesRead=0x39eaf8*=0x53, lpOverlapped=0x0) returned 1 [0091.003] GetLastError () returned 0x0 [0091.039] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", lpFilePart=0x0) returned 0x69 [0091.039] GetLastError () returned 0x0 [0091.039] SetErrorMode (uMode=0x1) returned 0x0 [0091.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.040] GetLastError () returned 0xb7 [0091.040] GetFileType (hFile=0x220) returned 0x1 [0091.040] GetFileType (hFile=0x220) returned 0x1 [0091.041] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt", lpFilePart=0x0) returned 0x69 [0091.041] GetLastError () returned 0xb7 [0091.041] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x75 [0091.041] GetLastError () returned 0xb7 [0091.041] SetErrorMode (uMode=0x1) returned 0x0 [0091.041] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x519e380, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0091.041] GetLastError () returned 0xb7 [0091.041] SetErrorMode (uMode=0x0) returned 0x1 [0091.041] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[1].txt.lanran2.0.5")) returned 1 [0091.042] GetLastError () returned 0xb7 [0091.042] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", lpFilePart=0x0) returned 0x69 [0091.042] GetLastError () returned 0xb7 [0091.042] SetErrorMode (uMode=0x1) returned 0x0 [0091.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.043] GetLastError () returned 0x0 [0091.043] GetFileType (hFile=0x220) returned 0x1 [0091.044] GetFileType (hFile=0x220) returned 0x1 [0091.044] ReadFile (in: hFile=0x220, lpBuffer=0x25b4f04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x25b4f04*, lpNumberOfBytesRead=0x39eaf8*=0x227, lpOverlapped=0x0) returned 1 [0091.044] GetLastError () returned 0x0 [0091.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", lpFilePart=0x0) returned 0x69 [0091.069] GetLastError () returned 0x0 [0091.069] SetErrorMode (uMode=0x1) returned 0x0 [0091.069] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.070] GetLastError () returned 0xb7 [0091.070] GetFileType (hFile=0x220) returned 0x1 [0091.070] GetFileType (hFile=0x220) returned 0x1 [0091.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt", lpFilePart=0x0) returned 0x69 [0091.071] GetLastError () returned 0xb7 [0091.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x75 [0091.071] GetLastError () returned 0xb7 [0091.071] SetErrorMode (uMode=0x1) returned 0x0 [0091.071] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d72bcd0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e6a4bd0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x51ea640, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x230)) returned 1 [0091.071] GetLastError () returned 0xb7 [0091.071] SetErrorMode (uMode=0x0) returned 0x1 [0091.071] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@adobe[3].txt.lanran2.0.5")) returned 1 [0091.075] GetLastError () returned 0xb7 [0091.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", lpFilePart=0x0) returned 0x6a [0091.075] GetLastError () returned 0xb7 [0091.075] SetErrorMode (uMode=0x1) returned 0x0 [0091.075] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.076] GetLastError () returned 0x0 [0091.076] GetFileType (hFile=0x220) returned 0x1 [0091.076] GetFileType (hFile=0x220) returned 0x1 [0091.076] ReadFile (in: hFile=0x220, lpBuffer=0x263fd8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x263fd8c*, lpNumberOfBytesRead=0x39eaf8*=0xf1, lpOverlapped=0x0) returned 1 [0091.077] GetLastError () returned 0x0 [0091.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", lpFilePart=0x0) returned 0x6a [0091.102] GetLastError () returned 0x0 [0091.102] SetErrorMode (uMode=0x1) returned 0x0 [0091.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.102] GetLastError () returned 0xb7 [0091.103] GetFileType (hFile=0x220) returned 0x1 [0091.103] GetFileType (hFile=0x220) returned 0x1 [0091.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt", lpFilePart=0x0) returned 0x6a [0091.103] GetLastError () returned 0xb7 [0091.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x76 [0091.103] GetLastError () returned 0xb7 [0091.103] SetErrorMode (uMode=0x1) returned 0x0 [0091.103] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d8f4d50, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x5236900, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x100)) returned 1 [0091.104] GetLastError () returned 0xb7 [0091.104] SetErrorMode (uMode=0x0) returned 0x1 [0091.104] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@demdex[1].txt.lanran2.0.5")) returned 1 [0091.104] GetLastError () returned 0xb7 [0091.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpFilePart=0x0) returned 0x6e [0091.104] GetLastError () returned 0xb7 [0091.105] SetErrorMode (uMode=0x1) returned 0x0 [0091.105] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.106] GetLastError () returned 0x0 [0091.106] GetFileType (hFile=0x220) returned 0x1 [0091.106] GetFileType (hFile=0x220) returned 0x1 [0091.106] ReadFile (in: hFile=0x220, lpBuffer=0x26ca3ec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x26ca3ec*, lpNumberOfBytesRead=0x39eaf8*=0x6f, lpOverlapped=0x0) returned 1 [0091.106] GetLastError () returned 0x0 [0091.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpFilePart=0x0) returned 0x6e [0091.133] GetLastError () returned 0x0 [0091.133] SetErrorMode (uMode=0x1) returned 0x0 [0091.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.136] GetLastError () returned 0xb7 [0091.136] GetFileType (hFile=0x220) returned 0x1 [0091.137] GetFileType (hFile=0x220) returned 0x1 [0091.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt", lpFilePart=0x0) returned 0x6e [0091.137] GetLastError () returned 0xb7 [0091.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7a [0091.137] GetLastError () returned 0xb7 [0091.137] SetErrorMode (uMode=0x1) returned 0x0 [0091.137] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e658910, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e658910, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x5282bc0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0091.138] GetLastError () returned 0xb7 [0091.138] SetErrorMode (uMode=0x0) returned 0x1 [0091.138] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@dpm.demdex[2].txt.lanran2.0.5")) returned 1 [0091.138] GetLastError () returned 0xb7 [0091.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpFilePart=0x0) returned 0x6f [0091.138] GetLastError () returned 0xb7 [0091.139] SetErrorMode (uMode=0x1) returned 0x0 [0091.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.139] GetLastError () returned 0x0 [0091.139] GetFileType (hFile=0x220) returned 0x1 [0091.139] GetFileType (hFile=0x220) returned 0x1 [0091.139] ReadFile (in: hFile=0x220, lpBuffer=0x25552d4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x25552d4*, lpNumberOfBytesRead=0x39eaf8*=0x6e, lpOverlapped=0x0) returned 1 [0091.140] GetLastError () returned 0x0 [0091.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpFilePart=0x0) returned 0x6f [0091.165] GetLastError () returned 0x0 [0091.165] SetErrorMode (uMode=0x1) returned 0x0 [0091.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.166] GetLastError () returned 0xb7 [0091.166] GetFileType (hFile=0x220) returned 0x1 [0091.166] GetFileType (hFile=0x220) returned 0x1 [0091.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt", lpFilePart=0x0) returned 0x6f [0091.166] GetLastError () returned 0xb7 [0091.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7b [0091.167] GetLastError () returned 0xb7 [0091.167] SetErrorMode (uMode=0x1) returned 0x0 [0091.167] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x52cee80, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0091.167] GetLastError () returned 0xb7 [0091.167] SetErrorMode (uMode=0x0) returned 0x1 [0091.167] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@everesttech[1].txt.lanran2.0.5")) returned 1 [0091.168] GetLastError () returned 0xb7 [0091.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", lpFilePart=0x0) returned 0x6a [0091.168] GetLastError () returned 0xb7 [0091.168] SetErrorMode (uMode=0x1) returned 0x0 [0091.168] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.181] GetLastError () returned 0x0 [0091.182] GetFileType (hFile=0x220) returned 0x1 [0091.182] GetFileType (hFile=0x220) returned 0x1 [0091.182] ReadFile (in: hFile=0x220, lpBuffer=0x25dfa68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x25dfa68*, lpNumberOfBytesRead=0x39eaf8*=0x114, lpOverlapped=0x0) returned 1 [0091.182] GetLastError () returned 0x0 [0091.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", lpFilePart=0x0) returned 0x6a [0091.208] GetLastError () returned 0x0 [0091.208] SetErrorMode (uMode=0x1) returned 0x0 [0091.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.209] GetLastError () returned 0xb7 [0091.209] GetFileType (hFile=0x220) returned 0x1 [0091.209] GetFileType (hFile=0x220) returned 0x1 [0091.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt", lpFilePart=0x0) returned 0x6a [0091.210] GetLastError () returned 0xb7 [0091.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x76 [0091.210] GetLastError () returned 0xb7 [0091.210] SetErrorMode (uMode=0x1) returned 0x0 [0091.210] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86af2d0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x53412a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x120)) returned 1 [0091.210] GetLastError () returned 0xb7 [0091.210] SetErrorMode (uMode=0x0) returned 0x1 [0091.210] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@google[2].txt.lanran2.0.5")) returned 1 [0091.211] GetLastError () returned 0xb7 [0091.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", lpFilePart=0x0) returned 0x69 [0091.211] GetLastError () returned 0xb7 [0091.211] SetErrorMode (uMode=0x1) returned 0x0 [0091.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.211] GetLastError () returned 0x0 [0091.211] GetFileType (hFile=0x220) returned 0x1 [0091.211] GetFileType (hFile=0x220) returned 0x1 [0091.211] ReadFile (in: hFile=0x220, lpBuffer=0x266a310, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x266a310*, lpNumberOfBytesRead=0x39eaf8*=0x56, lpOverlapped=0x0) returned 1 [0091.212] GetLastError () returned 0x0 [0091.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", lpFilePart=0x0) returned 0x69 [0091.228] GetLastError () returned 0x0 [0091.228] SetErrorMode (uMode=0x1) returned 0x0 [0091.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.228] GetLastError () returned 0xb7 [0091.228] GetFileType (hFile=0x220) returned 0x1 [0091.228] GetFileType (hFile=0x220) returned 0x1 [0091.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt", lpFilePart=0x0) returned 0x69 [0091.229] GetLastError () returned 0xb7 [0091.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x75 [0091.229] GetLastError () returned 0xb7 [0091.229] SetErrorMode (uMode=0x1) returned 0x0 [0091.229] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1dcf9270, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1dcf9270, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x5367400, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0091.229] GetLastError () returned 0xb7 [0091.229] SetErrorMode (uMode=0x0) returned 0x1 [0091.229] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@ml314[1].txt.lanran2.0.5")) returned 1 [0091.231] GetLastError () returned 0xb7 [0091.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpFilePart=0x0) returned 0x69 [0091.231] GetLastError () returned 0xb7 [0091.231] SetErrorMode (uMode=0x1) returned 0x0 [0091.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.231] GetLastError () returned 0x0 [0091.231] GetFileType (hFile=0x220) returned 0x1 [0091.232] GetFileType (hFile=0x220) returned 0x1 [0091.232] ReadFile (in: hFile=0x220, lpBuffer=0x26f4930, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x26f4930*, lpNumberOfBytesRead=0x39eaf8*=0x19e, lpOverlapped=0x0) returned 1 [0091.232] GetLastError () returned 0x0 [0091.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpFilePart=0x0) returned 0x69 [0091.250] GetLastError () returned 0x0 [0091.250] SetErrorMode (uMode=0x1) returned 0x0 [0091.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.251] GetLastError () returned 0xb7 [0091.251] GetFileType (hFile=0x220) returned 0x1 [0091.251] GetFileType (hFile=0x220) returned 0x1 [0091.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt", lpFilePart=0x0) returned 0x69 [0091.251] GetLastError () returned 0xb7 [0091.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x75 [0091.251] GetLastError () returned 0xb7 [0091.251] SetErrorMode (uMode=0x1) returned 0x0 [0091.251] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1e5e64f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1e5e64f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x53b36c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x1a0)) returned 1 [0091.251] GetLastError () returned 0xb7 [0091.252] SetErrorMode (uMode=0x0) returned 0x1 [0091.252] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\5p5nrgjn0js_halpmcxz@rlcdn[2].txt.lanran2.0.5")) returned 1 [0091.252] GetLastError () returned 0xb7 [0091.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", lpFilePart=0x0) returned 0x4b [0091.252] GetLastError () returned 0xb7 [0091.252] SetErrorMode (uMode=0x1) returned 0x0 [0091.252] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0 [0091.267] GetLastError () returned 0xb7 [0091.267] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.285] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.285] GetLastError () returned 0xb7 [0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.286] GetLastError () returned 0xb7 [0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.286] GetLastError () returned 0xb7 [0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.286] GetLastError () returned 0xb7 [0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.286] GetLastError () returned 0xb7 [0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.286] GetLastError () returned 0xb7 [0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.286] GetLastError () returned 0xb7 [0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.286] GetLastError () returned 0xb7 [0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.286] GetLastError () returned 0xb7 [0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.286] GetLastError () returned 0xb7 [0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.286] GetLastError () returned 0xb7 [0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.286] GetLastError () returned 0xb7 [0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.286] GetLastError () returned 0xb7 [0091.286] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0091.286] GetLastError () returned 0x12 [0091.286] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1 [0091.287] SetErrorMode (uMode=0x0) returned 0x1 [0091.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low", lpFilePart=0x0) returned 0x4b [0091.287] GetLastError () returned 0x12 [0091.287] SetErrorMode (uMode=0x1) returned 0x0 [0091.287] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c3f0 [0091.287] GetLastError () returned 0x12 [0091.287] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.288] GetLastError () returned 0x12 [0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.288] GetLastError () returned 0x12 [0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.288] GetLastError () returned 0x12 [0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.288] GetLastError () returned 0x12 [0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.288] GetLastError () returned 0x12 [0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.288] GetLastError () returned 0x12 [0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.288] GetLastError () returned 0x12 [0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.288] GetLastError () returned 0x12 [0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.288] GetLastError () returned 0x12 [0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.288] GetLastError () returned 0x12 [0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.288] GetLastError () returned 0x12 [0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.288] GetLastError () returned 0x12 [0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.288] GetLastError () returned 0x12 [0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.288] GetLastError () returned 0x12 [0091.288] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.288] GetLastError () returned 0x12 [0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.289] GetLastError () returned 0x12 [0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.289] GetLastError () returned 0x12 [0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.289] GetLastError () returned 0x12 [0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.289] GetLastError () returned 0x12 [0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.289] GetLastError () returned 0x12 [0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.289] GetLastError () returned 0x12 [0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.289] GetLastError () returned 0x12 [0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.289] GetLastError () returned 0x12 [0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.289] GetLastError () returned 0x12 [0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.289] GetLastError () returned 0x12 [0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.289] GetLastError () returned 0x12 [0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.289] GetLastError () returned 0x12 [0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.289] GetLastError () returned 0x12 [0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0091.289] GetLastError () returned 0x12 [0091.289] FindNextFileW (in: hFindFile=0x42c3f0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0091.289] GetLastError () returned 0x12 [0091.289] FindClose (in: hFindFile=0x42c3f0 | out: hFindFile=0x42c3f0) returned 1 [0091.290] SetErrorMode (uMode=0x0) returned 0x1 [0091.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", lpFilePart=0x0) returned 0x7c [0091.290] GetLastError () returned 0x12 [0091.290] SetErrorMode (uMode=0x1) returned 0x0 [0091.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.291] GetLastError () returned 0x0 [0091.291] GetFileType (hFile=0x220) returned 0x1 [0091.291] GetFileType (hFile=0x220) returned 0x1 [0091.291] ReadFile (in: hFile=0x220, lpBuffer=0x2583158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2583158*, lpNumberOfBytesRead=0x39ea98*=0x66, lpOverlapped=0x0) returned 1 [0091.291] GetLastError () returned 0x0 [0091.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", lpFilePart=0x0) returned 0x7c [0091.308] GetLastError () returned 0x0 [0091.308] SetErrorMode (uMode=0x1) returned 0x0 [0091.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.308] GetLastError () returned 0xb7 [0091.308] GetFileType (hFile=0x220) returned 0x1 [0091.308] GetFileType (hFile=0x220) returned 0x1 [0091.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt", lpFilePart=0x0) returned 0x7c [0091.309] GetLastError () returned 0xb7 [0091.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x88 [0091.309] GetLastError () returned 0xb7 [0091.309] SetErrorMode (uMode=0x1) returned 0x0 [0091.309] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44eb6480, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44eb6480, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5425ae0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0091.309] GetLastError () returned 0xb7 [0091.309] SetErrorMode (uMode=0x0) returned 0x1 [0091.309] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@ad13.adfarm1.adition[1].txt.lanran2.0.5")) returned 1 [0091.310] GetLastError () returned 0xb7 [0091.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x77 [0091.310] GetLastError () returned 0xb7 [0091.310] SetErrorMode (uMode=0x1) returned 0x0 [0091.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.310] GetLastError () returned 0x0 [0091.310] GetFileType (hFile=0x220) returned 0x1 [0091.310] GetFileType (hFile=0x220) returned 0x1 [0091.310] ReadFile (in: hFile=0x220, lpBuffer=0x260d750, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x260d750*, lpNumberOfBytesRead=0x39ea98*=0x66, lpOverlapped=0x0) returned 1 [0091.311] GetLastError () returned 0x0 [0091.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x77 [0091.327] GetLastError () returned 0x0 [0091.327] SetErrorMode (uMode=0x1) returned 0x0 [0091.327] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.327] GetLastError () returned 0xb7 [0091.327] GetFileType (hFile=0x220) returned 0x1 [0091.327] GetFileType (hFile=0x220) returned 0x1 [0091.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt", lpFilePart=0x0) returned 0x77 [0091.328] GetLastError () returned 0xb7 [0091.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x83 [0091.328] GetLastError () returned 0xb7 [0091.328] SetErrorMode (uMode=0x1) returned 0x0 [0091.328] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44bd95f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x44bd95f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x544bc40, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0091.328] GetLastError () returned 0xb7 [0091.328] SetErrorMode (uMode=0x0) returned 0x1 [0091.328] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adfarm1.adition[2].txt.lanran2.0.5")) returned 1 [0091.329] GetLastError () returned 0xb7 [0091.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpFilePart=0x0) returned 0x71 [0091.329] GetLastError () returned 0xb7 [0091.329] SetErrorMode (uMode=0x1) returned 0x0 [0091.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.330] GetLastError () returned 0x0 [0091.330] GetFileType (hFile=0x220) returned 0x1 [0091.330] GetFileType (hFile=0x220) returned 0x1 [0091.330] ReadFile (in: hFile=0x220, lpBuffer=0x2697cec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2697cec*, lpNumberOfBytesRead=0x39ea98*=0x5d, lpOverlapped=0x0) returned 1 [0091.330] GetLastError () returned 0x0 [0091.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpFilePart=0x0) returned 0x71 [0091.355] GetLastError () returned 0x0 [0091.355] SetErrorMode (uMode=0x1) returned 0x0 [0091.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.355] GetLastError () returned 0xb7 [0091.355] GetFileType (hFile=0x220) returned 0x1 [0091.356] GetFileType (hFile=0x220) returned 0x1 [0091.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt", lpFilePart=0x0) returned 0x71 [0091.356] GetLastError () returned 0xb7 [0091.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7d [0091.356] GetLastError () returned 0xb7 [0091.356] SetErrorMode (uMode=0x1) returned 0x0 [0091.356] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0x5497f00, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0091.356] GetLastError () returned 0xb7 [0091.356] SetErrorMode (uMode=0x0) returned 0x1 [0091.356] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adformdsp[1].txt.lanran2.0.5")) returned 1 [0091.357] GetLastError () returned 0xb7 [0091.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", lpFilePart=0x0) returned 0x6e [0091.357] GetLastError () returned 0xb7 [0091.357] SetErrorMode (uMode=0x1) returned 0x0 [0091.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.358] GetLastError () returned 0x0 [0091.358] GetFileType (hFile=0x220) returned 0x1 [0091.358] GetFileType (hFile=0x220) returned 0x1 [0091.358] ReadFile (in: hFile=0x220, lpBuffer=0x2523f3c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2523f3c*, lpNumberOfBytesRead=0x39ea98*=0xea, lpOverlapped=0x0) returned 1 [0091.358] GetLastError () returned 0x0 [0091.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", lpFilePart=0x0) returned 0x6e [0091.383] GetLastError () returned 0x0 [0091.383] SetErrorMode (uMode=0x1) returned 0x0 [0091.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.384] GetLastError () returned 0xb7 [0091.384] GetFileType (hFile=0x220) returned 0x1 [0091.384] GetFileType (hFile=0x220) returned 0x1 [0091.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt", lpFilePart=0x0) returned 0x6e [0091.384] GetLastError () returned 0xb7 [0091.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7a [0091.385] GetLastError () returned 0xb7 [0091.385] SetErrorMode (uMode=0x1) returned 0x0 [0091.385] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf2a0770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf7d5790, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0x54e41c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xf0)) returned 1 [0091.385] GetLastError () returned 0xb7 [0091.385] SetErrorMode (uMode=0x0) returned 0x1 [0091.385] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adform[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adform[1].txt.lanran2.0.5")) returned 1 [0091.385] GetLastError () returned 0xb7 [0091.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpFilePart=0x0) returned 0x6d [0091.385] GetLastError () returned 0xb7 [0091.385] SetErrorMode (uMode=0x1) returned 0x0 [0091.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.386] GetLastError () returned 0x0 [0091.386] GetFileType (hFile=0x220) returned 0x1 [0091.386] GetFileType (hFile=0x220) returned 0x1 [0091.386] ReadFile (in: hFile=0x220, lpBuffer=0x25ae8fc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x25ae8fc*, lpNumberOfBytesRead=0x39ea98*=0x242, lpOverlapped=0x0) returned 1 [0091.400] GetLastError () returned 0x0 [0091.427] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpFilePart=0x0) returned 0x6d [0091.427] GetLastError () returned 0x0 [0091.427] SetErrorMode (uMode=0x1) returned 0x0 [0091.427] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.428] GetLastError () returned 0xb7 [0091.428] GetFileType (hFile=0x220) returned 0x1 [0091.428] GetFileType (hFile=0x220) returned 0x1 [0091.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt", lpFilePart=0x0) returned 0x6d [0091.429] GetLastError () returned 0xb7 [0091.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x79 [0091.429] GetLastError () returned 0xb7 [0091.429] SetErrorMode (uMode=0x1) returned 0x0 [0091.429] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbe5d5130, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0x45f08810, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x55565e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x250)) returned 1 [0091.429] GetLastError () returned 0xb7 [0091.429] SetErrorMode (uMode=0x0) returned 0x1 [0091.429] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adnxs[1].txt.lanran2.0.5")) returned 1 [0091.430] GetLastError () returned 0xb7 [0091.430] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", lpFilePart=0x0) returned 0x6e [0091.430] GetLastError () returned 0xb7 [0091.430] SetErrorMode (uMode=0x1) returned 0x0 [0091.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.431] GetLastError () returned 0x0 [0091.431] GetFileType (hFile=0x220) returned 0x1 [0091.431] GetFileType (hFile=0x220) returned 0x1 [0091.431] ReadFile (in: hFile=0x220, lpBuffer=0x26397c4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x26397c4*, lpNumberOfBytesRead=0x39ea98*=0x65, lpOverlapped=0x0) returned 1 [0091.431] GetLastError () returned 0x0 [0091.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", lpFilePart=0x0) returned 0x6e [0091.456] GetLastError () returned 0x0 [0091.456] SetErrorMode (uMode=0x1) returned 0x0 [0091.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.457] GetLastError () returned 0xb7 [0091.457] GetFileType (hFile=0x220) returned 0x1 [0091.457] GetFileType (hFile=0x220) returned 0x1 [0091.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt", lpFilePart=0x0) returned 0x6e [0091.458] GetLastError () returned 0xb7 [0091.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7a [0091.458] GetLastError () returned 0xb7 [0091.458] SetErrorMode (uMode=0x1) returned 0x0 [0091.458] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x52fcb4b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52fcb4b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55a28a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0091.458] GetLastError () returned 0xb7 [0091.458] SetErrorMode (uMode=0x0) returned 0x1 [0091.458] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtech[2].txt.lanran2.0.5")) returned 1 [0091.459] GetLastError () returned 0xb7 [0091.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpFilePart=0x0) returned 0x6e [0091.459] GetLastError () returned 0xb7 [0091.459] SetErrorMode (uMode=0x1) returned 0x0 [0091.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.459] GetLastError () returned 0x0 [0091.459] GetFileType (hFile=0x220) returned 0x1 [0091.459] GetFileType (hFile=0x220) returned 0x1 [0091.460] ReadFile (in: hFile=0x220, lpBuffer=0x26c3cfc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x26c3cfc*, lpNumberOfBytesRead=0x39ea98*=0x52, lpOverlapped=0x0) returned 1 [0091.460] GetLastError () returned 0x0 [0091.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpFilePart=0x0) returned 0x6e [0091.487] GetLastError () returned 0x0 [0091.487] SetErrorMode (uMode=0x1) returned 0x0 [0091.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.488] GetLastError () returned 0xb7 [0091.488] GetFileType (hFile=0x220) returned 0x1 [0091.488] GetFileType (hFile=0x220) returned 0x1 [0091.489] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt", lpFilePart=0x0) returned 0x6e [0091.489] GetLastError () returned 0xb7 [0091.489] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7a [0091.489] GetLastError () returned 0xb7 [0091.489] SetErrorMode (uMode=0x1) returned 0x0 [0091.489] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53c70990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x53c70990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x55eeb60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x60)) returned 1 [0091.489] GetLastError () returned 0xb7 [0091.489] SetErrorMode (uMode=0x0) returned 0x1 [0091.489] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@adtr02[1].txt.lanran2.0.5")) returned 1 [0091.490] GetLastError () returned 0xb7 [0091.490] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", lpFilePart=0x0) returned 0x73 [0091.490] GetLastError () returned 0xb7 [0091.490] SetErrorMode (uMode=0x1) returned 0x0 [0091.490] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.490] GetLastError () returned 0x0 [0091.490] GetFileType (hFile=0x220) returned 0x1 [0091.490] GetFileType (hFile=0x220) returned 0x1 [0091.490] ReadFile (in: hFile=0x220, lpBuffer=0x254e2f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x254e2f4*, lpNumberOfBytesRead=0x39ea98*=0x125, lpOverlapped=0x0) returned 1 [0091.491] GetLastError () returned 0x0 [0091.515] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", lpFilePart=0x0) returned 0x73 [0091.515] GetLastError () returned 0x0 [0091.515] SetErrorMode (uMode=0x1) returned 0x0 [0091.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.516] GetLastError () returned 0xb7 [0091.516] GetFileType (hFile=0x220) returned 0x1 [0091.516] GetFileType (hFile=0x220) returned 0x1 [0091.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt", lpFilePart=0x0) returned 0x73 [0091.517] GetLastError () returned 0xb7 [0091.517] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7f [0091.517] GetLastError () returned 0xb7 [0091.517] SetErrorMode (uMode=0x1) returned 0x0 [0091.517] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x517fd8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51332930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x563ae20, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x130)) returned 1 [0091.517] GetLastError () returned 0xb7 [0091.518] SetErrorMode (uMode=0x0) returned 0x1 [0091.518] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@advertising[1].txt.lanran2.0.5")) returned 1 [0091.518] GetLastError () returned 0xb7 [0091.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpFilePart=0x0) returned 0x70 [0091.518] GetLastError () returned 0xb7 [0091.518] SetErrorMode (uMode=0x1) returned 0x0 [0091.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.522] GetLastError () returned 0x0 [0091.522] GetFileType (hFile=0x220) returned 0x1 [0091.522] GetFileType (hFile=0x220) returned 0x1 [0091.522] ReadFile (in: hFile=0x220, lpBuffer=0x25d8e78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x25d8e78*, lpNumberOfBytesRead=0x39ea98*=0xdd, lpOverlapped=0x0) returned 1 [0091.523] GetLastError () returned 0x0 [0091.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpFilePart=0x0) returned 0x70 [0091.547] GetLastError () returned 0x0 [0091.547] SetErrorMode (uMode=0x1) returned 0x0 [0091.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.548] GetLastError () returned 0xb7 [0091.548] GetFileType (hFile=0x220) returned 0x1 [0091.548] GetFileType (hFile=0x220) returned 0x1 [0091.549] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt", lpFilePart=0x0) returned 0x70 [0091.549] GetLastError () returned 0xb7 [0091.549] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7c [0091.549] GetLastError () returned 0xb7 [0091.549] SetErrorMode (uMode=0x1) returned 0x0 [0091.549] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54cce0d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54cce0d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x56870e0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xe0)) returned 1 [0091.549] GetLastError () returned 0xb7 [0091.549] SetErrorMode (uMode=0x0) returned 0x1 [0091.549] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@api.bing[2].txt.lanran2.0.5")) returned 1 [0091.550] GetLastError () returned 0xb7 [0091.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", lpFilePart=0x0) returned 0x71 [0091.550] GetLastError () returned 0xb7 [0091.550] SetErrorMode (uMode=0x1) returned 0x0 [0091.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.550] GetLastError () returned 0x0 [0091.550] GetFileType (hFile=0x220) returned 0x1 [0091.551] GetFileType (hFile=0x220) returned 0x1 [0091.551] ReadFile (in: hFile=0x220, lpBuffer=0x2663654, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2663654*, lpNumberOfBytesRead=0x39ea98*=0x201, lpOverlapped=0x0) returned 1 [0091.551] GetLastError () returned 0x0 [0091.576] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", lpFilePart=0x0) returned 0x71 [0091.576] GetLastError () returned 0x0 [0091.576] SetErrorMode (uMode=0x1) returned 0x0 [0091.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.577] GetLastError () returned 0xb7 [0091.577] GetFileType (hFile=0x220) returned 0x1 [0091.577] GetFileType (hFile=0x220) returned 0x1 [0091.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt", lpFilePart=0x0) returned 0x71 [0091.578] GetLastError () returned 0xb7 [0091.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7d [0091.578] GetLastError () returned 0xb7 [0091.578] SetErrorMode (uMode=0x1) returned 0x0 [0091.578] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4611db50, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x4611db50, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x56ad240, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x210)) returned 1 [0091.578] GetLastError () returned 0xb7 [0091.578] SetErrorMode (uMode=0x0) returned 0x1 [0091.578] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@at.atwola[1].txt.lanran2.0.5")) returned 1 [0091.578] GetLastError () returned 0xb7 [0091.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", lpFilePart=0x0) returned 0x6c [0091.579] GetLastError () returned 0xb7 [0091.579] SetErrorMode (uMode=0x1) returned 0x0 [0091.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.580] GetLastError () returned 0x0 [0091.580] GetFileType (hFile=0x220) returned 0x1 [0091.580] GetFileType (hFile=0x220) returned 0x1 [0091.580] ReadFile (in: hFile=0x220, lpBuffer=0x26ee580, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x26ee580*, lpNumberOfBytesRead=0x39ea98*=0x1ea, lpOverlapped=0x0) returned 1 [0091.581] GetLastError () returned 0x0 [0091.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", lpFilePart=0x0) returned 0x6c [0091.609] GetLastError () returned 0x0 [0091.609] SetErrorMode (uMode=0x1) returned 0x0 [0091.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.610] GetLastError () returned 0xb7 [0091.610] GetFileType (hFile=0x220) returned 0x1 [0091.610] GetFileType (hFile=0x220) returned 0x1 [0091.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt", lpFilePart=0x0) returned 0x6c [0091.611] GetLastError () returned 0xb7 [0091.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x78 [0091.611] GetLastError () returned 0xb7 [0091.611] SetErrorMode (uMode=0x1) returned 0x0 [0091.611] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x534b4210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x562c6900, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x571f660, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x1f0)) returned 1 [0091.611] GetLastError () returned 0xb7 [0091.611] SetErrorMode (uMode=0x0) returned 0x1 [0091.611] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@bing[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@bing[1].txt.lanran2.0.5")) returned 1 [0091.611] GetLastError () returned 0xb7 [0091.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", lpFilePart=0x0) returned 0x6e [0091.611] GetLastError () returned 0xb7 [0091.612] SetErrorMode (uMode=0x1) returned 0x0 [0091.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.612] GetLastError () returned 0x0 [0091.612] GetFileType (hFile=0x220) returned 0x1 [0091.612] GetFileType (hFile=0x220) returned 0x1 [0091.612] ReadFile (in: hFile=0x220, lpBuffer=0x2579534, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2579534*, lpNumberOfBytesRead=0x39ea98*=0x1c8, lpOverlapped=0x0) returned 1 [0091.613] GetLastError () returned 0x0 [0091.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", lpFilePart=0x0) returned 0x6e [0091.638] GetLastError () returned 0x0 [0091.639] SetErrorMode (uMode=0x1) returned 0x0 [0091.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.639] GetLastError () returned 0xb7 [0091.640] GetFileType (hFile=0x220) returned 0x1 [0091.640] GetFileType (hFile=0x220) returned 0x1 [0091.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt", lpFilePart=0x0) returned 0x6e [0091.640] GetLastError () returned 0xb7 [0091.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7a [0091.641] GetLastError () returned 0xb7 [0091.641] SetErrorMode (uMode=0x1) returned 0x0 [0091.641] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x45798350, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45798350, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x57457c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x1d0)) returned 1 [0091.641] GetLastError () returned 0xb7 [0091.641] SetErrorMode (uMode=0x0) returned 0x1 [0091.641] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.bing[1].txt.lanran2.0.5")) returned 1 [0091.642] GetLastError () returned 0xb7 [0091.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", lpFilePart=0x0) returned 0x6d [0091.642] GetLastError () returned 0xb7 [0091.642] SetErrorMode (uMode=0x1) returned 0x0 [0091.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.643] GetLastError () returned 0x0 [0091.643] GetFileType (hFile=0x220) returned 0x1 [0091.643] GetFileType (hFile=0x220) returned 0x1 [0091.643] ReadFile (in: hFile=0x220, lpBuffer=0x2604340, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2604340*, lpNumberOfBytesRead=0x39ea98*=0x82, lpOverlapped=0x0) returned 1 [0091.644] GetLastError () returned 0x0 [0091.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", lpFilePart=0x0) returned 0x6d [0091.671] GetLastError () returned 0x0 [0091.671] SetErrorMode (uMode=0x1) returned 0x0 [0091.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.676] GetLastError () returned 0xb7 [0091.676] GetFileType (hFile=0x220) returned 0x1 [0091.676] GetFileType (hFile=0x220) returned 0x1 [0091.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt", lpFilePart=0x0) returned 0x6d [0091.677] GetLastError () returned 0xb7 [0091.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x79 [0091.677] GetLastError () returned 0xb7 [0091.677] SetErrorMode (uMode=0x1) returned 0x0 [0091.677] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbdf95770, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbdf95770, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0x57b7be0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x90)) returned 1 [0091.677] GetLastError () returned 0xb7 [0091.677] SetErrorMode (uMode=0x0) returned 0x1 [0091.677] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@c.msn[1].txt.lanran2.0.5")) returned 1 [0091.677] GetLastError () returned 0xb7 [0091.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", lpFilePart=0x0) returned 0x73 [0091.678] GetLastError () returned 0xb7 [0091.678] SetErrorMode (uMode=0x1) returned 0x0 [0091.678] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.678] GetLastError () returned 0x0 [0091.678] GetFileType (hFile=0x220) returned 0x1 [0091.678] GetFileType (hFile=0x220) returned 0x1 [0091.679] ReadFile (in: hFile=0x220, lpBuffer=0x268e974, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x268e974*, lpNumberOfBytesRead=0x39ea98*=0x110, lpOverlapped=0x0) returned 1 [0091.679] GetLastError () returned 0x0 [0091.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", lpFilePart=0x0) returned 0x73 [0091.705] GetLastError () returned 0x0 [0091.705] SetErrorMode (uMode=0x1) returned 0x0 [0091.706] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.706] GetLastError () returned 0xb7 [0091.706] GetFileType (hFile=0x220) returned 0x1 [0091.706] GetFileType (hFile=0x220) returned 0x1 [0091.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt", lpFilePart=0x0) returned 0x73 [0091.707] GetLastError () returned 0xb7 [0091.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7f [0091.707] GetLastError () returned 0xb7 [0091.707] SetErrorMode (uMode=0x1) returned 0x0 [0091.707] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6301df20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x63a15b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5803ea0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x120)) returned 1 [0091.707] GetLastError () returned 0xb7 [0091.707] SetErrorMode (uMode=0x0) returned 0x1 [0091.707] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@doubleclick[2].txt.lanran2.0.5")) returned 1 [0091.707] GetLastError () returned 0xb7 [0091.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", lpFilePart=0x0) returned 0x6e [0091.707] GetLastError () returned 0xb7 [0091.707] SetErrorMode (uMode=0x1) returned 0x0 [0091.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.708] GetLastError () returned 0x0 [0091.708] GetFileType (hFile=0x220) returned 0x1 [0091.708] GetFileType (hFile=0x220) returned 0x1 [0091.708] ReadFile (in: hFile=0x220, lpBuffer=0x2519374, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2519374*, lpNumberOfBytesRead=0x39ea98*=0x256, lpOverlapped=0x0) returned 1 [0091.723] GetLastError () returned 0x0 [0091.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", lpFilePart=0x0) returned 0x6e [0091.740] GetLastError () returned 0x0 [0091.740] SetErrorMode (uMode=0x1) returned 0x0 [0091.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.741] GetLastError () returned 0xb7 [0091.741] GetFileType (hFile=0x220) returned 0x1 [0091.741] GetFileType (hFile=0x220) returned 0x1 [0091.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt", lpFilePart=0x0) returned 0x6e [0091.742] GetLastError () returned 0xb7 [0091.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7a [0091.742] GetLastError () returned 0xb7 [0091.742] SetErrorMode (uMode=0x1) returned 0x0 [0091.742] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61093ba0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61093ba0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5850160, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x260)) returned 1 [0091.742] GetLastError () returned 0xb7 [0091.742] SetErrorMode (uMode=0x0) returned 0x1 [0091.742] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[1].txt.lanran2.0.5")) returned 1 [0091.742] GetLastError () returned 0xb7 [0091.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", lpFilePart=0x0) returned 0x6e [0091.742] GetLastError () returned 0xb7 [0091.742] SetErrorMode (uMode=0x1) returned 0x0 [0091.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.743] GetLastError () returned 0x0 [0091.743] GetFileType (hFile=0x220) returned 0x1 [0091.743] GetFileType (hFile=0x220) returned 0x1 [0091.743] ReadFile (in: hFile=0x220, lpBuffer=0x25a449c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x25a449c*, lpNumberOfBytesRead=0x39ea98*=0xc4, lpOverlapped=0x0) returned 1 [0091.744] GetLastError () returned 0x0 [0091.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", lpFilePart=0x0) returned 0x6e [0091.759] GetLastError () returned 0x0 [0091.759] SetErrorMode (uMode=0x1) returned 0x0 [0091.759] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.760] GetLastError () returned 0xb7 [0091.760] GetFileType (hFile=0x220) returned 0x1 [0091.760] GetFileType (hFile=0x220) returned 0x1 [0091.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt", lpFilePart=0x0) returned 0x6e [0091.761] GetLastError () returned 0xb7 [0091.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7a [0091.761] GetLastError () returned 0xb7 [0091.761] SetErrorMode (uMode=0x1) returned 0x0 [0091.761] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x610b9d00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x61282d80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x58762c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xd0)) returned 1 [0091.761] GetLastError () returned 0xb7 [0091.761] SetErrorMode (uMode=0x0) returned 0x1 [0091.761] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[3].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[3].txt.lanran2.0.5")) returned 1 [0091.762] GetLastError () returned 0xb7 [0091.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", lpFilePart=0x0) returned 0x6e [0091.762] GetLastError () returned 0xb7 [0091.762] SetErrorMode (uMode=0x1) returned 0x0 [0091.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.762] GetLastError () returned 0x0 [0091.762] GetFileType (hFile=0x220) returned 0x1 [0091.762] GetFileType (hFile=0x220) returned 0x1 [0091.762] ReadFile (in: hFile=0x220, lpBuffer=0x262ec60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x262ec60*, lpNumberOfBytesRead=0x39ea98*=0x21f, lpOverlapped=0x0) returned 1 [0091.763] GetLastError () returned 0x0 [0091.780] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", lpFilePart=0x0) returned 0x6e [0091.780] GetLastError () returned 0x0 [0091.780] SetErrorMode (uMode=0x1) returned 0x0 [0091.780] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.780] GetLastError () returned 0xb7 [0091.780] GetFileType (hFile=0x220) returned 0x1 [0091.781] GetFileType (hFile=0x220) returned 0x1 [0091.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt", lpFilePart=0x0) returned 0x6e [0091.781] GetLastError () returned 0xb7 [0091.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7a [0091.781] GetLastError () returned 0xb7 [0091.781] SetErrorMode (uMode=0x1) returned 0x0 [0091.781] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x64e777a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x64e777a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x589c420, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x220)) returned 1 [0091.781] GetLastError () returned 0xb7 [0091.781] SetErrorMode (uMode=0x0) returned 0x1 [0091.782] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@google[4].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@google[4].txt.lanran2.0.5")) returned 1 [0091.782] GetLastError () returned 0xb7 [0091.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", lpFilePart=0x0) returned 0x70 [0091.782] GetLastError () returned 0xb7 [0091.782] SetErrorMode (uMode=0x1) returned 0x0 [0091.782] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.783] GetLastError () returned 0x0 [0091.783] GetFileType (hFile=0x220) returned 0x1 [0091.783] GetFileType (hFile=0x220) returned 0x1 [0091.783] ReadFile (in: hFile=0x220, lpBuffer=0x26b9af0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x26b9af0*, lpNumberOfBytesRead=0x39ea98*=0x110, lpOverlapped=0x0) returned 1 [0091.783] GetLastError () returned 0x0 [0091.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", lpFilePart=0x0) returned 0x70 [0091.823] GetLastError () returned 0x0 [0091.823] SetErrorMode (uMode=0x1) returned 0x0 [0091.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.824] GetLastError () returned 0xb7 [0091.824] GetFileType (hFile=0x220) returned 0x1 [0091.824] GetFileType (hFile=0x220) returned 0x1 [0091.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt", lpFilePart=0x0) returned 0x70 [0091.824] GetLastError () returned 0xb7 [0091.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7c [0091.824] GetLastError () returned 0xb7 [0091.824] SetErrorMode (uMode=0x1) returned 0x0 [0091.824] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x465ba5f0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x465ba5f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x590e840, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x120)) returned 1 [0091.824] GetLastError () returned 0xb7 [0091.824] SetErrorMode (uMode=0x0) returned 0x1 [0091.824] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@linkedin[1].txt.lanran2.0.5")) returned 1 [0091.825] GetLastError () returned 0xb7 [0091.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", lpFilePart=0x0) returned 0x71 [0091.825] GetLastError () returned 0xb7 [0091.825] SetErrorMode (uMode=0x1) returned 0x0 [0091.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.826] GetLastError () returned 0x0 [0091.826] GetFileType (hFile=0x220) returned 0x1 [0091.826] GetFileType (hFile=0x220) returned 0x1 [0091.826] ReadFile (in: hFile=0x220, lpBuffer=0x2544420, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2544420*, lpNumberOfBytesRead=0x39ea98*=0x76, lpOverlapped=0x0) returned 1 [0091.826] GetLastError () returned 0x0 [0091.842] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", lpFilePart=0x0) returned 0x71 [0091.842] GetLastError () returned 0x0 [0091.842] SetErrorMode (uMode=0x1) returned 0x0 [0091.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.843] GetLastError () returned 0xb7 [0091.843] GetFileType (hFile=0x220) returned 0x1 [0091.843] GetFileType (hFile=0x220) returned 0x1 [0091.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt", lpFilePart=0x0) returned 0x71 [0091.844] GetLastError () returned 0xb7 [0091.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7d [0091.844] GetLastError () returned 0xb7 [0091.844] SetErrorMode (uMode=0x1) returned 0x0 [0091.844] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbfa5cef0, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbfa5cef0, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0x59349a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x80)) returned 1 [0091.845] GetLastError () returned 0xb7 [0091.845] SetErrorMode (uMode=0x0) returned 0x1 [0091.845] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@m.exactag[1].txt.lanran2.0.5")) returned 1 [0091.845] GetLastError () returned 0xb7 [0091.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", lpFilePart=0x0) returned 0x6b [0091.845] GetLastError () returned 0xb7 [0091.845] SetErrorMode (uMode=0x1) returned 0x0 [0091.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.845] GetLastError () returned 0x0 [0091.845] GetFileType (hFile=0x220) returned 0x1 [0091.845] GetFileType (hFile=0x220) returned 0x1 [0091.845] ReadFile (in: hFile=0x220, lpBuffer=0x25cee04, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x25cee04*, lpNumberOfBytesRead=0x39ea98*=0x337, lpOverlapped=0x0) returned 1 [0091.859] GetLastError () returned 0x0 [0091.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", lpFilePart=0x0) returned 0x6b [0091.876] GetLastError () returned 0x0 [0091.876] SetErrorMode (uMode=0x1) returned 0x0 [0091.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.877] GetLastError () returned 0xb7 [0091.877] GetFileType (hFile=0x220) returned 0x1 [0091.877] GetFileType (hFile=0x220) returned 0x1 [0091.878] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt", lpFilePart=0x0) returned 0x6b [0091.878] GetLastError () returned 0xb7 [0091.878] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x77 [0091.878] GetLastError () returned 0xb7 [0091.878] SetErrorMode (uMode=0x1) returned 0x0 [0091.878] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50b50050, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x50b50050, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x59a6dc0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x340)) returned 1 [0091.878] GetLastError () returned 0xb7 [0091.878] SetErrorMode (uMode=0x0) returned 0x1 [0091.878] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@msn[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@msn[1].txt.lanran2.0.5")) returned 1 [0091.878] GetLastError () returned 0xb7 [0091.879] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", lpFilePart=0x0) returned 0x79 [0091.879] GetLastError () returned 0xb7 [0091.879] SetErrorMode (uMode=0x1) returned 0x0 [0091.879] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.879] GetLastError () returned 0x0 [0091.879] GetFileType (hFile=0x220) returned 0x1 [0091.879] GetFileType (hFile=0x220) returned 0x1 [0091.880] ReadFile (in: hFile=0x220, lpBuffer=0x265a1f4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x265a1f4*, lpNumberOfBytesRead=0x39ea98*=0xce, lpOverlapped=0x0) returned 1 [0091.880] GetLastError () returned 0x0 [0091.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", lpFilePart=0x0) returned 0x79 [0091.905] GetLastError () returned 0x0 [0091.905] SetErrorMode (uMode=0x1) returned 0x0 [0091.905] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.907] GetLastError () returned 0xb7 [0091.907] GetFileType (hFile=0x220) returned 0x1 [0091.907] GetFileType (hFile=0x220) returned 0x1 [0091.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt", lpFilePart=0x0) returned 0x79 [0091.908] GetLastError () returned 0xb7 [0091.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x85 [0091.908] GetLastError () returned 0xb7 [0091.908] SetErrorMode (uMode=0x1) returned 0x0 [0091.909] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5348e0b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5348e0b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x59f3080, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xd0)) returned 1 [0091.909] GetLastError () returned 0xb7 [0091.909] SetErrorMode (uMode=0x0) returned 0x1 [0091.909] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@scorecardresearch[2].txt.lanran2.0.5")) returned 1 [0091.909] GetLastError () returned 0xb7 [0091.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", lpFilePart=0x0) returned 0x78 [0091.909] GetLastError () returned 0xb7 [0091.909] SetErrorMode (uMode=0x1) returned 0x0 [0091.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.910] GetLastError () returned 0x0 [0091.910] GetFileType (hFile=0x220) returned 0x1 [0091.910] GetFileType (hFile=0x220) returned 0x1 [0091.910] ReadFile (in: hFile=0x220, lpBuffer=0x26e4888, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x26e4888*, lpNumberOfBytesRead=0x39ea98*=0x6c, lpOverlapped=0x0) returned 1 [0091.910] GetLastError () returned 0x0 [0091.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", lpFilePart=0x0) returned 0x78 [0091.939] GetLastError () returned 0x0 [0091.939] SetErrorMode (uMode=0x1) returned 0x0 [0091.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.940] GetLastError () returned 0xb7 [0091.940] GetFileType (hFile=0x220) returned 0x1 [0091.940] GetFileType (hFile=0x220) returned 0x1 [0091.940] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt", lpFilePart=0x0) returned 0x78 [0091.941] GetLastError () returned 0xb7 [0091.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x84 [0091.941] GetLastError () returned 0xb7 [0091.941] SetErrorMode (uMode=0x1) returned 0x0 [0091.941] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf73d210, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf73d210, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0x5a3f340, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0091.941] GetLastError () returned 0xb7 [0091.941] SetErrorMode (uMode=0x0) returned 0x1 [0091.941] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@server.adformdsp[1].txt.lanran2.0.5")) returned 1 [0091.942] GetLastError () returned 0xb7 [0091.942] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", lpFilePart=0x0) returned 0x6f [0091.942] GetLastError () returned 0xb7 [0091.942] SetErrorMode (uMode=0x1) returned 0x0 [0091.942] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.942] GetLastError () returned 0x0 [0091.942] GetFileType (hFile=0x220) returned 0x1 [0091.942] GetFileType (hFile=0x220) returned 0x1 [0091.942] ReadFile (in: hFile=0x220, lpBuffer=0x256ed6c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x256ed6c*, lpNumberOfBytesRead=0x39ea98*=0x68, lpOverlapped=0x0) returned 1 [0091.943] GetLastError () returned 0x0 [0091.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", lpFilePart=0x0) returned 0x6f [0091.962] GetLastError () returned 0x0 [0091.962] SetErrorMode (uMode=0x1) returned 0x0 [0091.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.962] GetLastError () returned 0xb7 [0091.962] GetFileType (hFile=0x220) returned 0x1 [0091.962] GetFileType (hFile=0x220) returned 0x1 [0091.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt", lpFilePart=0x0) returned 0x6f [0091.963] GetLastError () returned 0xb7 [0091.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7b [0091.963] GetLastError () returned 0xb7 [0091.963] SetErrorMode (uMode=0x1) returned 0x0 [0091.963] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf99e810, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf99e810, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0x5a654a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x70)) returned 1 [0091.963] GetLastError () returned 0xb7 [0091.963] SetErrorMode (uMode=0x0) returned 0x1 [0091.963] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@skadtec[1].txt.lanran2.0.5")) returned 1 [0091.964] GetLastError () returned 0xb7 [0091.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", lpFilePart=0x0) returned 0x74 [0091.964] GetLastError () returned 0xb7 [0091.964] SetErrorMode (uMode=0x1) returned 0x0 [0091.964] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.964] GetLastError () returned 0x0 [0091.964] GetFileType (hFile=0x220) returned 0x1 [0091.964] GetFileType (hFile=0x220) returned 0x1 [0091.965] ReadFile (in: hFile=0x220, lpBuffer=0x25f94bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x25f94bc*, lpNumberOfBytesRead=0x39ea98*=0xb2, lpOverlapped=0x0) returned 1 [0091.965] GetLastError () returned 0x0 [0091.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", lpFilePart=0x0) returned 0x74 [0091.983] GetLastError () returned 0x0 [0091.983] SetErrorMode (uMode=0x1) returned 0x0 [0091.983] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.984] GetLastError () returned 0xb7 [0091.984] GetFileType (hFile=0x220) returned 0x1 [0091.984] GetFileType (hFile=0x220) returned 0x1 [0091.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt", lpFilePart=0x0) returned 0x74 [0091.984] GetLastError () returned 0xb7 [0091.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x80 [0091.984] GetLastError () returned 0xb7 [0091.984] SetErrorMode (uMode=0x1) returned 0x0 [0091.984] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf54e030, ftCreationTime.dwHighDateTime=0x1d2faf2, ftLastAccessTime.dwLowDateTime=0xbf54e030, ftLastAccessTime.dwHighDateTime=0x1d2faf2, ftLastWriteTime.dwLowDateTime=0x5ab1760, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xc0)) returned 1 [0091.984] GetLastError () returned 0xb7 [0091.985] SetErrorMode (uMode=0x0) returned 0x1 [0091.985] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@track.adform[2].txt.lanran2.0.5")) returned 1 [0091.985] GetLastError () returned 0xb7 [0091.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", lpFilePart=0x0) returned 0x70 [0091.985] GetLastError () returned 0xb7 [0091.985] SetErrorMode (uMode=0x1) returned 0x0 [0091.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0091.986] GetLastError () returned 0x0 [0091.986] GetFileType (hFile=0x220) returned 0x1 [0091.986] GetFileType (hFile=0x220) returned 0x1 [0091.986] ReadFile (in: hFile=0x220, lpBuffer=0x2683b60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2683b60*, lpNumberOfBytesRead=0x39ea98*=0xd7, lpOverlapped=0x0) returned 1 [0091.986] GetLastError () returned 0x0 [0092.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", lpFilePart=0x0) returned 0x70 [0092.007] GetLastError () returned 0x0 [0092.007] SetErrorMode (uMode=0x1) returned 0x0 [0092.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0092.007] GetLastError () returned 0xb7 [0092.007] GetFileType (hFile=0x220) returned 0x1 [0092.008] GetFileType (hFile=0x220) returned 0x1 [0092.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt", lpFilePart=0x0) returned 0x70 [0092.008] GetLastError () returned 0xb7 [0092.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7c [0092.008] GetLastError () returned 0xb7 [0092.008] SetErrorMode (uMode=0x1) returned 0x0 [0092.008] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x555a9a10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x555a9a10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5ad78c0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xe0)) returned 1 [0092.008] GetLastError () returned 0xb7 [0092.008] SetErrorMode (uMode=0x0) returned 0x1 [0092.008] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.bing[2].txt.lanran2.0.5")) returned 1 [0092.009] GetLastError () returned 0xb7 [0092.009] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", lpFilePart=0x0) returned 0x74 [0092.009] GetLastError () returned 0xb7 [0092.009] SetErrorMode (uMode=0x1) returned 0x0 [0092.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0092.009] GetLastError () returned 0x0 [0092.009] GetFileType (hFile=0x220) returned 0x1 [0092.009] GetFileType (hFile=0x220) returned 0x1 [0092.010] ReadFile (in: hFile=0x220, lpBuffer=0x250e254, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x250e254*, lpNumberOfBytesRead=0x39ea98*=0xa9, lpOverlapped=0x0) returned 1 [0092.010] GetLastError () returned 0x0 [0092.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", lpFilePart=0x0) returned 0x74 [0092.034] GetLastError () returned 0x0 [0092.034] SetErrorMode (uMode=0x1) returned 0x0 [0092.035] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0092.035] GetLastError () returned 0xb7 [0092.035] GetFileType (hFile=0x220) returned 0x1 [0092.035] GetFileType (hFile=0x220) returned 0x1 [0092.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt", lpFilePart=0x0) returned 0x74 [0092.036] GetLastError () returned 0xb7 [0092.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x80 [0092.036] GetLastError () returned 0xb7 [0092.036] SetErrorMode (uMode=0x1) returned 0x0 [0092.036] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54d8c7b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x54d8c7b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x5b23b80, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0092.036] GetLastError () returned 0xb7 [0092.036] SetErrorMode (uMode=0x0) returned 0x1 [0092.036] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.linkedin[1].txt.lanran2.0.5")) returned 1 [0092.037] GetLastError () returned 0xb7 [0092.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", nBufferLength=0x105, lpBuffer=0x39e53c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", lpFilePart=0x0) returned 0x6f [0092.037] GetLastError () returned 0xb7 [0092.037] SetErrorMode (uMode=0x1) returned 0x0 [0092.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0092.037] GetLastError () returned 0x0 [0092.037] GetFileType (hFile=0x220) returned 0x1 [0092.037] GetFileType (hFile=0x220) returned 0x1 [0092.037] ReadFile (in: hFile=0x220, lpBuffer=0x2598d98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39ea98, lpOverlapped=0x0 | out: lpBuffer=0x2598d98*, lpNumberOfBytesRead=0x39ea98*=0x402, lpOverlapped=0x0) returned 1 [0092.059] GetLastError () returned 0x0 [0092.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", nBufferLength=0x105, lpBuffer=0x39e544, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", lpFilePart=0x0) returned 0x6f [0092.088] GetLastError () returned 0x0 [0092.088] SetErrorMode (uMode=0x1) returned 0x0 [0092.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0092.089] GetLastError () returned 0xb7 [0092.089] GetFileType (hFile=0x220) returned 0x1 [0092.089] GetFileType (hFile=0x220) returned 0x1 [0092.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt", lpFilePart=0x0) returned 0x6f [0092.090] GetLastError () returned 0xb7 [0092.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e668, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.LanRan2.0.5", lpFilePart=0x0) returned 0x7b [0092.090] GetLastError () returned 0xb7 [0092.090] SetErrorMode (uMode=0x1) returned 0x0 [0092.090] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), fInfoLevelId=0x0, lpFileInformation=0x39eae8 | out: lpFileInformation=0x39eae8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4523d1d0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x526fc010, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5b95fa0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x410)) returned 1 [0092.090] GetLastError () returned 0xb7 [0092.090] SetErrorMode (uMode=0x0) returned 0x1 [0092.090] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\5p5nrgjn0js_halpmcxz@www.msn[2].txt.lanran2.0.5")) returned 1 [0092.090] GetLastError () returned 0xb7 [0092.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x4d [0092.090] GetLastError () returned 0xb7 [0092.091] SetErrorMode (uMode=0x1) returned 0x0 [0092.091] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.091] GetLastError () returned 0xb7 [0092.091] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.091] GetLastError () returned 0xb7 [0092.091] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.091] GetLastError () returned 0xb7 [0092.091] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.091] GetLastError () returned 0x12 [0092.091] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.091] SetErrorMode (uMode=0x0) returned 0x1 [0092.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x4d [0092.092] GetLastError () returned 0x12 [0092.092] SetErrorMode (uMode=0x1) returned 0x0 [0092.092] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.092] GetLastError () returned 0x12 [0092.092] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.092] GetLastError () returned 0x12 [0092.092] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.092] GetLastError () returned 0x12 [0092.092] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.092] GetLastError () returned 0x12 [0092.092] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.092] SetErrorMode (uMode=0x0) returned 0x1 [0092.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x51 [0092.092] GetLastError () returned 0x12 [0092.092] SetErrorMode (uMode=0x1) returned 0x0 [0092.092] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.093] GetLastError () returned 0x12 [0092.093] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.093] GetLastError () returned 0x12 [0092.093] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.093] GetLastError () returned 0x12 [0092.093] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.093] SetErrorMode (uMode=0x0) returned 0x1 [0092.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x51 [0092.093] GetLastError () returned 0x12 [0092.093] SetErrorMode (uMode=0x1) returned 0x0 [0092.093] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.093] GetLastError () returned 0x12 [0092.093] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.093] GetLastError () returned 0x12 [0092.094] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.094] GetLastError () returned 0x12 [0092.094] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.094] SetErrorMode (uMode=0x0) returned 0x1 [0092.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x4a [0092.094] GetLastError () returned 0x12 [0092.094] SetErrorMode (uMode=0x1) returned 0x0 [0092.094] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.094] GetLastError () returned 0x12 [0092.094] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.094] GetLastError () returned 0x12 [0092.094] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.094] GetLastError () returned 0x12 [0092.095] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.095] GetLastError () returned 0x12 [0092.095] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.095] GetLastError () returned 0x12 [0092.095] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.095] SetErrorMode (uMode=0x0) returned 0x1 [0092.095] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache", lpFilePart=0x0) returned 0x4a [0092.095] GetLastError () returned 0x12 [0092.095] SetErrorMode (uMode=0x1) returned 0x0 [0092.095] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.095] GetLastError () returned 0x12 [0092.095] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.095] GetLastError () returned 0x12 [0092.095] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.095] GetLastError () returned 0x12 [0092.095] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.095] GetLastError () returned 0x12 [0092.095] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.095] GetLastError () returned 0x12 [0092.095] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.096] SetErrorMode (uMode=0x0) returned 0x1 [0092.096] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x4e [0092.096] GetLastError () returned 0x12 [0092.096] SetErrorMode (uMode=0x1) returned 0x0 [0092.096] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.096] GetLastError () returned 0x12 [0092.096] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.096] GetLastError () returned 0x12 [0092.096] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.096] GetLastError () returned 0x12 [0092.096] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.096] GetLastError () returned 0x12 [0092.096] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.096] SetErrorMode (uMode=0x0) returned 0x1 [0092.096] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low", lpFilePart=0x0) returned 0x4e [0092.096] GetLastError () returned 0x12 [0092.096] SetErrorMode (uMode=0x1) returned 0x0 [0092.096] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.097] GetLastError () returned 0x12 [0092.097] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.097] GetLastError () returned 0x12 [0092.097] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.097] GetLastError () returned 0x12 [0092.097] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.097] GetLastError () returned 0x12 [0092.097] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.097] SetErrorMode (uMode=0x0) returned 0x1 [0092.097] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x49 [0092.097] GetLastError () returned 0x12 [0092.097] SetErrorMode (uMode=0x1) returned 0x0 [0092.097] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.097] GetLastError () returned 0x12 [0092.097] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.097] GetLastError () returned 0x12 [0092.097] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.097] GetLastError () returned 0x12 [0092.097] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.097] GetLastError () returned 0x12 [0092.098] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.098] GetLastError () returned 0x12 [0092.098] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.098] GetLastError () returned 0x12 [0092.098] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.098] GetLastError () returned 0x12 [0092.098] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.098] GetLastError () returned 0x12 [0092.098] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.098] SetErrorMode (uMode=0x0) returned 0x1 [0092.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x49 [0092.098] GetLastError () returned 0x12 [0092.098] SetErrorMode (uMode=0x1) returned 0x0 [0092.098] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.098] GetLastError () returned 0x12 [0092.098] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.098] GetLastError () returned 0x12 [0092.098] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.098] GetLastError () returned 0x12 [0092.098] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.098] GetLastError () returned 0x12 [0092.098] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.098] GetLastError () returned 0x12 [0092.099] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.099] GetLastError () returned 0x12 [0092.099] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.099] GetLastError () returned 0x12 [0092.099] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.099] GetLastError () returned 0x12 [0092.099] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.099] SetErrorMode (uMode=0x0) returned 0x1 [0092.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x51 [0092.099] GetLastError () returned 0x12 [0092.099] SetErrorMode (uMode=0x1) returned 0x0 [0092.099] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.100] GetLastError () returned 0x12 [0092.100] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.100] GetLastError () returned 0x12 [0092.100] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.100] GetLastError () returned 0x12 [0092.100] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.100] SetErrorMode (uMode=0x0) returned 0x1 [0092.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x51 [0092.100] GetLastError () returned 0x12 [0092.100] SetErrorMode (uMode=0x1) returned 0x0 [0092.100] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.100] GetLastError () returned 0x12 [0092.100] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.100] GetLastError () returned 0x12 [0092.100] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.100] GetLastError () returned 0x12 [0092.100] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.100] SetErrorMode (uMode=0x0) returned 0x1 [0092.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x51 [0092.101] GetLastError () returned 0x12 [0092.101] SetErrorMode (uMode=0x1) returned 0x0 [0092.101] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.101] GetLastError () returned 0x12 [0092.101] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.101] GetLastError () returned 0x12 [0092.101] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.101] GetLastError () returned 0x12 [0092.101] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.101] SetErrorMode (uMode=0x0) returned 0x1 [0092.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x51 [0092.101] GetLastError () returned 0x12 [0092.101] SetErrorMode (uMode=0x1) returned 0x0 [0092.101] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.101] GetLastError () returned 0x12 [0092.101] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.101] GetLastError () returned 0x12 [0092.101] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.102] GetLastError () returned 0x12 [0092.102] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.102] SetErrorMode (uMode=0x0) returned 0x1 [0092.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x48 [0092.102] GetLastError () returned 0x12 [0092.102] SetErrorMode (uMode=0x1) returned 0x0 [0092.102] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.102] GetLastError () returned 0x12 [0092.102] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.102] GetLastError () returned 0x12 [0092.102] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.102] GetLastError () returned 0x12 [0092.102] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.103] GetLastError () returned 0x12 [0092.103] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.103] GetLastError () returned 0x12 [0092.103] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.103] SetErrorMode (uMode=0x0) returned 0x1 [0092.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE", lpFilePart=0x0) returned 0x48 [0092.103] GetLastError () returned 0x12 [0092.103] SetErrorMode (uMode=0x1) returned 0x0 [0092.103] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.103] GetLastError () returned 0x12 [0092.103] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.103] GetLastError () returned 0x12 [0092.103] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.103] GetLastError () returned 0x12 [0092.103] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.103] GetLastError () returned 0x12 [0092.103] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.103] GetLastError () returned 0x12 [0092.103] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.103] SetErrorMode (uMode=0x0) returned 0x1 [0092.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x4c [0092.104] GetLastError () returned 0x12 [0092.104] SetErrorMode (uMode=0x1) returned 0x0 [0092.104] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.104] GetLastError () returned 0x12 [0092.104] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.104] GetLastError () returned 0x12 [0092.104] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.104] GetLastError () returned 0x12 [0092.104] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.104] GetLastError () returned 0x12 [0092.104] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.104] SetErrorMode (uMode=0x0) returned 0x1 [0092.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low", lpFilePart=0x0) returned 0x4c [0092.104] GetLastError () returned 0x12 [0092.104] SetErrorMode (uMode=0x1) returned 0x0 [0092.104] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.105] GetLastError () returned 0x12 [0092.105] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.105] GetLastError () returned 0x12 [0092.105] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.105] GetLastError () returned 0x12 [0092.105] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.105] GetLastError () returned 0x12 [0092.105] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.105] SetErrorMode (uMode=0x0) returned 0x1 [0092.105] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x46 [0092.105] GetLastError () returned 0x12 [0092.105] SetErrorMode (uMode=0x1) returned 0x0 [0092.105] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.105] GetLastError () returned 0x12 [0092.105] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.105] GetLastError () returned 0x12 [0092.105] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.105] GetLastError () returned 0x12 [0092.105] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.105] GetLastError () returned 0x12 [0092.105] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.106] GetLastError () returned 0x12 [0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.106] GetLastError () returned 0x12 [0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.106] GetLastError () returned 0x12 [0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.106] GetLastError () returned 0x12 [0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.106] GetLastError () returned 0x12 [0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.106] GetLastError () returned 0x12 [0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.106] GetLastError () returned 0x12 [0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.106] GetLastError () returned 0x12 [0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.106] GetLastError () returned 0x12 [0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.106] GetLastError () returned 0x12 [0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.106] GetLastError () returned 0x12 [0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.106] GetLastError () returned 0x12 [0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.106] GetLastError () returned 0x12 [0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.106] GetLastError () returned 0x12 [0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.106] GetLastError () returned 0x12 [0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.106] GetLastError () returned 0x12 [0092.106] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.107] GetLastError () returned 0x12 [0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.107] GetLastError () returned 0x12 [0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.107] GetLastError () returned 0x12 [0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.107] GetLastError () returned 0x12 [0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.107] GetLastError () returned 0x12 [0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.107] GetLastError () returned 0x12 [0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.107] GetLastError () returned 0x12 [0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.107] GetLastError () returned 0x12 [0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.107] GetLastError () returned 0x12 [0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.107] GetLastError () returned 0x12 [0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.107] GetLastError () returned 0x12 [0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.107] GetLastError () returned 0x12 [0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.107] GetLastError () returned 0x12 [0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.107] GetLastError () returned 0x12 [0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.107] GetLastError () returned 0x12 [0092.107] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.108] GetLastError () returned 0x12 [0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.108] GetLastError () returned 0x12 [0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.108] GetLastError () returned 0x12 [0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.108] GetLastError () returned 0x12 [0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.108] GetLastError () returned 0x12 [0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.108] GetLastError () returned 0x12 [0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.108] GetLastError () returned 0x12 [0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.108] GetLastError () returned 0x12 [0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.108] GetLastError () returned 0x12 [0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.108] GetLastError () returned 0x12 [0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.108] GetLastError () returned 0x12 [0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.108] GetLastError () returned 0x12 [0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.108] GetLastError () returned 0x12 [0092.108] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.108] GetLastError () returned 0x12 [0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.109] GetLastError () returned 0x12 [0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.109] GetLastError () returned 0x12 [0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.109] GetLastError () returned 0x12 [0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.109] GetLastError () returned 0x12 [0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.109] GetLastError () returned 0x12 [0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.109] GetLastError () returned 0x12 [0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.109] GetLastError () returned 0x12 [0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.109] GetLastError () returned 0x12 [0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.109] GetLastError () returned 0x12 [0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.109] GetLastError () returned 0x12 [0092.109] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.109] GetLastError () returned 0x12 [0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.110] GetLastError () returned 0x12 [0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.110] GetLastError () returned 0x12 [0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.110] GetLastError () returned 0x12 [0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.110] GetLastError () returned 0x12 [0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.110] GetLastError () returned 0x12 [0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.110] GetLastError () returned 0x12 [0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.110] GetLastError () returned 0x12 [0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.110] GetLastError () returned 0x12 [0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.110] GetLastError () returned 0x12 [0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.110] GetLastError () returned 0x12 [0092.110] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.110] GetLastError () returned 0x12 [0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.111] GetLastError () returned 0x12 [0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.111] GetLastError () returned 0x12 [0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.111] GetLastError () returned 0x12 [0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.111] GetLastError () returned 0x12 [0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.111] GetLastError () returned 0x12 [0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.111] GetLastError () returned 0x12 [0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.111] GetLastError () returned 0x12 [0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.111] GetLastError () returned 0x12 [0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.111] GetLastError () returned 0x12 [0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.111] GetLastError () returned 0x12 [0092.111] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.111] GetLastError () returned 0x12 [0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.112] GetLastError () returned 0x12 [0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.112] GetLastError () returned 0x12 [0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.112] GetLastError () returned 0x12 [0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.112] GetLastError () returned 0x12 [0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.112] GetLastError () returned 0x12 [0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.112] GetLastError () returned 0x12 [0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.112] GetLastError () returned 0x12 [0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.112] GetLastError () returned 0x12 [0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.112] GetLastError () returned 0x12 [0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.112] GetLastError () returned 0x12 [0092.112] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.112] GetLastError () returned 0x12 [0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.113] GetLastError () returned 0x12 [0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.113] GetLastError () returned 0x12 [0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.113] GetLastError () returned 0x12 [0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.113] GetLastError () returned 0x12 [0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.113] GetLastError () returned 0x12 [0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.113] GetLastError () returned 0x12 [0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.113] GetLastError () returned 0x12 [0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.113] GetLastError () returned 0x12 [0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.113] GetLastError () returned 0x12 [0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.113] GetLastError () returned 0x12 [0092.113] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.114] GetLastError () returned 0x12 [0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.114] GetLastError () returned 0x12 [0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.114] GetLastError () returned 0x12 [0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.114] GetLastError () returned 0x12 [0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.114] GetLastError () returned 0x12 [0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.114] GetLastError () returned 0x12 [0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.114] GetLastError () returned 0x12 [0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.114] GetLastError () returned 0x12 [0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.114] GetLastError () returned 0x12 [0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.114] GetLastError () returned 0x12 [0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.114] GetLastError () returned 0x12 [0092.114] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.115] GetLastError () returned 0x12 [0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.115] GetLastError () returned 0x12 [0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.115] GetLastError () returned 0x12 [0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.115] GetLastError () returned 0x12 [0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.115] GetLastError () returned 0x12 [0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.115] GetLastError () returned 0x12 [0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.115] GetLastError () returned 0x12 [0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.115] GetLastError () returned 0x12 [0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.115] GetLastError () returned 0x12 [0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.115] GetLastError () returned 0x12 [0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.115] GetLastError () returned 0x12 [0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.115] GetLastError () returned 0x12 [0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.115] GetLastError () returned 0x12 [0092.115] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.115] GetLastError () returned 0x12 [0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.116] GetLastError () returned 0x12 [0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.116] GetLastError () returned 0x12 [0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.116] GetLastError () returned 0x12 [0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.116] GetLastError () returned 0x12 [0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.116] GetLastError () returned 0x12 [0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.116] GetLastError () returned 0x12 [0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.116] GetLastError () returned 0x12 [0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.116] GetLastError () returned 0x12 [0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.116] GetLastError () returned 0x12 [0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.116] GetLastError () returned 0x12 [0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.116] GetLastError () returned 0x12 [0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.116] GetLastError () returned 0x12 [0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.116] GetLastError () returned 0x12 [0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.116] GetLastError () returned 0x12 [0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.116] GetLastError () returned 0x12 [0092.116] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.116] GetLastError () returned 0x12 [0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.117] GetLastError () returned 0x12 [0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.117] GetLastError () returned 0x12 [0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.117] GetLastError () returned 0x12 [0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.117] GetLastError () returned 0x12 [0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.117] GetLastError () returned 0x12 [0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.117] GetLastError () returned 0x12 [0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.117] GetLastError () returned 0x12 [0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.117] GetLastError () returned 0x12 [0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.117] GetLastError () returned 0x12 [0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.117] GetLastError () returned 0x12 [0092.117] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 0 [0092.117] GetLastError () returned 0x12 [0092.117] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.117] SetErrorMode (uMode=0x0) returned 0x1 [0092.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x46 [0092.118] GetLastError () returned 0x12 [0092.118] SetErrorMode (uMode=0x1) returned 0x0 [0092.118] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.118] GetLastError () returned 0x12 [0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.118] GetLastError () returned 0x12 [0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.118] GetLastError () returned 0x12 [0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.118] GetLastError () returned 0x12 [0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.118] GetLastError () returned 0x12 [0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.118] GetLastError () returned 0x12 [0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.118] GetLastError () returned 0x12 [0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.118] GetLastError () returned 0x12 [0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.118] GetLastError () returned 0x12 [0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.118] GetLastError () returned 0x12 [0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.118] GetLastError () returned 0x12 [0092.118] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.118] GetLastError () returned 0x12 [0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.119] GetLastError () returned 0x12 [0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.119] GetLastError () returned 0x12 [0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.119] GetLastError () returned 0x12 [0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.119] GetLastError () returned 0x12 [0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.119] GetLastError () returned 0x12 [0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.119] GetLastError () returned 0x12 [0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.119] GetLastError () returned 0x12 [0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.119] GetLastError () returned 0x12 [0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.119] GetLastError () returned 0x12 [0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.119] GetLastError () returned 0x12 [0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.119] GetLastError () returned 0x12 [0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.119] GetLastError () returned 0x12 [0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.119] GetLastError () returned 0x12 [0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.119] GetLastError () returned 0x12 [0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.119] GetLastError () returned 0x12 [0092.119] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.119] GetLastError () returned 0x12 [0092.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.120] GetLastError () returned 0x12 [0092.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.120] GetLastError () returned 0x12 [0092.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.120] GetLastError () returned 0x12 [0092.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.120] GetLastError () returned 0x12 [0092.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.120] GetLastError () returned 0x12 [0092.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.120] GetLastError () returned 0x12 [0092.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.120] GetLastError () returned 0x12 [0092.120] FindNextFileW (in: hFindFile=0x42c4b0, lpFindFileData=0x42ee90 | out: lpFindFileData=0x42ee90) returned 1 [0092.120] GetLastError () returned 0x12 [0092.120] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.120] SetErrorMode (uMode=0x0) returned 0x1 [0092.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpFilePart=0x0) returned 0x5c [0092.121] GetLastError () returned 0x12 [0092.121] SetErrorMode (uMode=0x1) returned 0x0 [0092.121] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.121] GetLastError () returned 0x12 [0092.121] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.121] SetErrorMode (uMode=0x0) returned 0x1 [0092.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations", lpFilePart=0x0) returned 0x5c [0092.121] GetLastError () returned 0x12 [0092.121] SetErrorMode (uMode=0x1) returned 0x0 [0092.121] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.121] GetLastError () returned 0x12 [0092.122] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.122] SetErrorMode (uMode=0x0) returned 0x1 [0092.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpFilePart=0x0) returned 0x59 [0092.122] GetLastError () returned 0x12 [0092.122] SetErrorMode (uMode=0x1) returned 0x0 [0092.122] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.122] GetLastError () returned 0x12 [0092.123] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.123] SetErrorMode (uMode=0x0) returned 0x1 [0092.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations", lpFilePart=0x0) returned 0x59 [0092.123] GetLastError () returned 0x12 [0092.123] SetErrorMode (uMode=0x1) returned 0x0 [0092.123] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.124] GetLastError () returned 0x12 [0092.124] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.125] SetErrorMode (uMode=0x0) returned 0x1 [0092.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x46 [0092.125] GetLastError () returned 0x12 [0092.125] SetErrorMode (uMode=0x1) returned 0x0 [0092.125] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.125] GetLastError () returned 0x12 [0092.125] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.126] SetErrorMode (uMode=0x0) returned 0x1 [0092.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x46 [0092.126] GetLastError () returned 0x12 [0092.126] SetErrorMode (uMode=0x1) returned 0x0 [0092.126] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.127] GetLastError () returned 0x12 [0092.127] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.130] SetErrorMode (uMode=0x0) returned 0x1 [0092.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x4a [0092.130] GetLastError () returned 0x12 [0092.130] SetErrorMode (uMode=0x1) returned 0x0 [0092.130] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.130] GetLastError () returned 0x12 [0092.130] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.130] SetErrorMode (uMode=0x0) returned 0x1 [0092.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x4a [0092.130] GetLastError () returned 0x12 [0092.130] SetErrorMode (uMode=0x1) returned 0x0 [0092.130] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.130] GetLastError () returned 0x12 [0092.131] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.131] SetErrorMode (uMode=0x0) returned 0x1 [0092.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x53 [0092.131] GetLastError () returned 0x12 [0092.131] SetErrorMode (uMode=0x1) returned 0x0 [0092.131] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.131] GetLastError () returned 0x12 [0092.131] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.131] SetErrorMode (uMode=0x0) returned 0x1 [0092.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x53 [0092.131] GetLastError () returned 0x12 [0092.131] SetErrorMode (uMode=0x1) returned 0x0 [0092.131] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.131] GetLastError () returned 0x12 [0092.131] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.132] SetErrorMode (uMode=0x0) returned 0x1 [0092.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x5f [0092.132] GetLastError () returned 0x12 [0092.132] SetErrorMode (uMode=0x1) returned 0x0 [0092.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.132] GetLastError () returned 0x12 [0092.132] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.132] SetErrorMode (uMode=0x0) returned 0x1 [0092.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x5f [0092.132] GetLastError () returned 0x12 [0092.132] SetErrorMode (uMode=0x1) returned 0x0 [0092.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.132] GetLastError () returned 0x12 [0092.132] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.132] SetErrorMode (uMode=0x0) returned 0x1 [0092.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x39e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x6d [0092.133] GetLastError () returned 0x12 [0092.133] SetErrorMode (uMode=0x1) returned 0x0 [0092.133] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.133] GetLastError () returned 0x12 [0092.133] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.133] SetErrorMode (uMode=0x0) returned 0x1 [0092.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", nBufferLength=0x105, lpBuffer=0x39e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility", lpFilePart=0x0) returned 0x6d [0092.133] GetLastError () returned 0x12 [0092.133] SetErrorMode (uMode=0x1) returned 0x0 [0092.133] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.133] GetLastError () returned 0x12 [0092.133] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.133] SetErrorMode (uMode=0x0) returned 0x1 [0092.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x39e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x6c [0092.133] GetLastError () returned 0x12 [0092.133] SetErrorMode (uMode=0x1) returned 0x0 [0092.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.134] GetLastError () returned 0x12 [0092.134] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.134] SetErrorMode (uMode=0x0) returned 0x1 [0092.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", nBufferLength=0x105, lpBuffer=0x39e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools", lpFilePart=0x0) returned 0x6c [0092.134] GetLastError () returned 0x12 [0092.134] SetErrorMode (uMode=0x1) returned 0x0 [0092.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.134] GetLastError () returned 0x12 [0092.134] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.134] SetErrorMode (uMode=0x0) returned 0x1 [0092.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x68 [0092.134] GetLastError () returned 0x12 [0092.134] SetErrorMode (uMode=0x1) returned 0x0 [0092.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.134] GetLastError () returned 0x12 [0092.134] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.134] SetErrorMode (uMode=0x0) returned 0x1 [0092.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools", lpFilePart=0x0) returned 0x68 [0092.135] GetLastError () returned 0x12 [0092.135] SetErrorMode (uMode=0x1) returned 0x0 [0092.135] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.135] GetLastError () returned 0x12 [0092.135] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.135] SetErrorMode (uMode=0x0) returned 0x1 [0092.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x5f [0092.135] GetLastError () returned 0x12 [0092.135] SetErrorMode (uMode=0x1) returned 0x0 [0092.135] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.135] GetLastError () returned 0x12 [0092.135] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.135] SetErrorMode (uMode=0x0) returned 0x1 [0092.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x5f [0092.135] GetLastError () returned 0x12 [0092.135] SetErrorMode (uMode=0x1) returned 0x0 [0092.135] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.135] GetLastError () returned 0x12 [0092.136] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.136] SetErrorMode (uMode=0x0) returned 0x1 [0092.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0092.136] GetLastError () returned 0x12 [0092.136] SetErrorMode (uMode=0x1) returned 0x0 [0092.136] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.136] GetLastError () returned 0x12 [0092.136] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.136] SetErrorMode (uMode=0x0) returned 0x1 [0092.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x5b [0092.136] GetLastError () returned 0x12 [0092.136] SetErrorMode (uMode=0x1) returned 0x0 [0092.136] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.136] GetLastError () returned 0x12 [0092.136] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.137] SetErrorMode (uMode=0x0) returned 0x1 [0092.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x49 [0092.137] GetLastError () returned 0x12 [0092.137] SetErrorMode (uMode=0x1) returned 0x0 [0092.137] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.137] GetLastError () returned 0x12 [0092.137] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.137] SetErrorMode (uMode=0x0) returned 0x1 [0092.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates", lpFilePart=0x0) returned 0x49 [0092.137] GetLastError () returned 0x12 [0092.137] SetErrorMode (uMode=0x1) returned 0x0 [0092.138] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.138] GetLastError () returned 0x12 [0092.138] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.138] SetErrorMode (uMode=0x0) returned 0x1 [0092.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x46 [0092.138] GetLastError () returned 0x12 [0092.138] SetErrorMode (uMode=0x1) returned 0x0 [0092.138] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.138] GetLastError () returned 0x12 [0092.138] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.139] SetErrorMode (uMode=0x0) returned 0x1 [0092.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes", lpFilePart=0x0) returned 0x46 [0092.139] GetLastError () returned 0x12 [0092.139] SetErrorMode (uMode=0x1) returned 0x0 [0092.139] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c4b0 [0092.139] GetLastError () returned 0x12 [0092.139] FindClose (in: hFindFile=0x42c4b0 | out: hFindFile=0x42c4b0) returned 1 [0092.139] SetErrorMode (uMode=0x0) returned 0x1 [0092.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFilePart=0x0) returned 0x5e [0092.139] GetLastError () returned 0x12 [0092.139] SetErrorMode (uMode=0x1) returned 0x0 [0092.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0092.139] GetLastError () returned 0x0 [0092.139] GetFileType (hFile=0x220) returned 0x1 [0092.139] SetErrorMode (uMode=0x0) returned 0x1 [0092.139] GetFileType (hFile=0x220) returned 0x1 [0092.141] ReadFile (in: hFile=0x220, lpBuffer=0x37b5e28, nNumberOfBytesToRead=0x9cfab, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x37b5e28*, lpNumberOfBytesRead=0x39eaf8*=0x9cfab, lpOverlapped=0x0) returned 1 [0092.148] GetLastError () returned 0x0 [0092.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFilePart=0x0) returned 0x5e [0092.224] GetLastError () returned 0x0 [0092.224] SetErrorMode (uMode=0x1) returned 0x0 [0092.224] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0092.229] GetLastError () returned 0xb7 [0092.229] GetFileType (hFile=0x220) returned 0x1 [0092.229] SetErrorMode (uMode=0x0) returned 0x1 [0092.230] GetFileType (hFile=0x220) returned 0x1 [0092.242] CloseHandle (hObject=0x220) returned 1 [0092.244] GetLastError () returned 0xb7 [0092.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFilePart=0x0) returned 0x5e [0092.244] GetLastError () returned 0xb7 [0092.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.LanRan2.0.5", lpFilePart=0x0) returned 0x6a [0092.244] GetLastError () returned 0xb7 [0092.244] SetErrorMode (uMode=0x1) returned 0x0 [0092.244] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x5d12d60, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x9cfb0)) returned 1 [0092.244] GetLastError () returned 0xb7 [0092.244] SetErrorMode (uMode=0x0) returned 0x1 [0092.244] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.lanran2.0.5")) returned 1 [0092.245] GetLastError () returned 0xb7 [0092.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x3c [0092.245] GetLastError () returned 0xb7 [0092.245] SetErrorMode (uMode=0x1) returned 0x0 [0092.245] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430 [0092.262] GetLastError () returned 0xb7 [0092.262] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1 [0092.262] SetErrorMode (uMode=0x0) returned 0x1 [0092.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x3c [0092.262] GetLastError () returned 0x12 [0092.263] SetErrorMode (uMode=0x1) returned 0x0 [0092.263] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430 [0092.263] GetLastError () returned 0x12 [0092.263] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1 [0092.263] SetErrorMode (uMode=0x0) returned 0x1 [0092.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", lpFilePart=0x0) returned 0x44 [0092.264] GetLastError () returned 0x12 [0092.264] SetErrorMode (uMode=0x1) returned 0x0 [0092.264] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430 [0092.264] GetLastError () returned 0x12 [0092.265] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1 [0092.265] SetErrorMode (uMode=0x0) returned 0x1 [0092.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", lpFilePart=0x0) returned 0x44 [0092.265] GetLastError () returned 0x12 [0092.265] SetErrorMode (uMode=0x1) returned 0x0 [0092.265] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430 [0092.266] GetLastError () returned 0x12 [0092.266] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1 [0092.266] SetErrorMode (uMode=0x0) returned 0x1 [0092.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", lpFilePart=0x0) returned 0x35 [0092.266] GetLastError () returned 0x12 [0092.266] SetErrorMode (uMode=0x1) returned 0x0 [0092.266] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430 [0092.267] GetLastError () returned 0x12 [0092.268] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1 [0092.268] SetErrorMode (uMode=0x0) returned 0x1 [0092.268] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", lpFilePart=0x0) returned 0x35 [0092.268] GetLastError () returned 0x12 [0092.268] SetErrorMode (uMode=0x1) returned 0x0 [0092.268] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430 [0092.268] GetLastError () returned 0x12 [0092.269] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1 [0092.269] SetErrorMode (uMode=0x0) returned 0x1 [0092.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", lpFilePart=0x0) returned 0x40 [0092.269] GetLastError () returned 0x12 [0092.269] SetErrorMode (uMode=0x1) returned 0x0 [0092.269] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430 [0092.270] GetLastError () returned 0x12 [0092.270] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1 [0092.270] SetErrorMode (uMode=0x0) returned 0x1 [0092.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", lpFilePart=0x0) returned 0x40 [0092.270] GetLastError () returned 0x12 [0092.270] SetErrorMode (uMode=0x1) returned 0x0 [0092.271] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430 [0092.271] GetLastError () returned 0x12 [0092.271] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1 [0092.271] SetErrorMode (uMode=0x0) returned 0x1 [0092.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3d [0092.271] GetLastError () returned 0x12 [0092.271] SetErrorMode (uMode=0x1) returned 0x0 [0092.272] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430 [0092.272] GetLastError () returned 0x12 [0092.273] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1 [0092.273] SetErrorMode (uMode=0x0) returned 0x1 [0092.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x39e690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3d [0092.273] GetLastError () returned 0x12 [0092.273] SetErrorMode (uMode=0x1) returned 0x0 [0092.273] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430 [0092.274] GetLastError () returned 0x12 [0092.274] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1 [0092.275] SetErrorMode (uMode=0x0) returned 0x1 [0092.275] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpFilePart=0x0) returned 0x4b [0092.275] GetLastError () returned 0x12 [0092.275] SetErrorMode (uMode=0x1) returned 0x0 [0092.275] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430 [0092.276] GetLastError () returned 0x12 [0092.276] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1 [0092.276] SetErrorMode (uMode=0x0) returned 0x1 [0092.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpFilePart=0x0) returned 0x4b [0092.277] GetLastError () returned 0x12 [0092.277] SetErrorMode (uMode=0x1) returned 0x0 [0092.277] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c430 [0092.277] GetLastError () returned 0x12 [0092.278] FindClose (in: hFindFile=0x42c430 | out: hFindFile=0x42c430) returned 1 [0092.278] SetErrorMode (uMode=0x0) returned 0x1 [0092.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332", nBufferLength=0x105, lpBuffer=0x39e59c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332", lpFilePart=0x0) returned 0x65 [0092.278] GetLastError () returned 0x12 [0092.278] SetErrorMode (uMode=0x1) returned 0x0 [0092.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0092.279] GetLastError () returned 0x0 [0092.279] GetFileType (hFile=0x220) returned 0x1 [0092.279] SetErrorMode (uMode=0x0) returned 0x1 [0092.279] GetFileType (hFile=0x220) returned 0x1 [0092.279] ReadFile (in: hFile=0x220, lpBuffer=0x24c31ac, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x39eaf8, lpOverlapped=0x0 | out: lpBuffer=0x24c31ac*, lpNumberOfBytesRead=0x39eaf8*=0xa, lpOverlapped=0x0) returned 1 [0092.280] GetLastError () returned 0x0 [0092.280] CloseHandle (hObject=0x220) returned 1 [0092.280] GetLastError () returned 0x0 [0092.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332", nBufferLength=0x105, lpBuffer=0x39e5a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332", lpFilePart=0x0) returned 0x65 [0092.338] GetLastError () returned 0x0 [0092.338] SetErrorMode (uMode=0x1) returned 0x0 [0092.339] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x220 [0092.339] GetLastError () returned 0xb7 [0092.339] GetFileType (hFile=0x220) returned 0x1 [0092.339] GetFileType (hFile=0x220) returned 0x1 [0092.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332", lpFilePart=0x0) returned 0x65 [0092.340] GetLastError () returned 0xb7 [0092.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332.LanRan2.0.5", nBufferLength=0x105, lpBuffer=0x39e6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332.LanRan2.0.5", lpFilePart=0x0) returned 0x71 [0092.340] GetLastError () returned 0xb7 [0092.340] SetErrorMode (uMode=0x1) returned 0x0 [0092.340] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332"), fInfoLevelId=0x0, lpFileInformation=0x39eb48 | out: lpFileInformation=0x39eb48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5df75a0, ftLastWriteTime.dwHighDateTime=0x1d41169, nFileSizeHigh=0x0, nFileSizeLow=0x10)) returned 1 [0092.340] GetLastError () returned 0xb7 [0092.340] SetErrorMode (uMode=0x0) returned 0x1 [0092.341] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\InstallTime20131025151332.LanRan2.0.5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\installtime20131025151332.lanran2.0.5")) returned 1 [0092.341] GetLastError () returned 0xb7 [0092.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x46 [0092.341] GetLastError () returned 0xb7 [0092.341] SetErrorMode (uMode=0x1) returned 0x0 [0092.341] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.342] GetLastError () returned 0xb7 [0092.342] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.342] SetErrorMode (uMode=0x0) returned 0x1 [0092.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x39e630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x46 [0092.342] GetLastError () returned 0x12 [0092.342] SetErrorMode (uMode=0x1) returned 0x0 [0092.342] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.343] GetLastError () returned 0x12 [0092.343] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.343] SetErrorMode (uMode=0x0) returned 0x1 [0092.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x57 [0092.343] GetLastError () returned 0x12 [0092.343] SetErrorMode (uMode=0x1) returned 0x0 [0092.343] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.371] GetLastError () returned 0x12 [0092.372] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.373] SetErrorMode (uMode=0x0) returned 0x1 [0092.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", nBufferLength=0x105, lpBuffer=0x39e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x57 [0092.373] GetLastError () returned 0x12 [0092.373] SetErrorMode (uMode=0x1) returned 0x0 [0092.373] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.373] GetLastError () returned 0x12 [0092.373] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.374] SetErrorMode (uMode=0x0) returned 0x1 [0092.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", lpFilePart=0x0) returned 0x67 [0092.374] GetLastError () returned 0x12 [0092.374] SetErrorMode (uMode=0x1) returned 0x0 [0092.374] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.385] GetLastError () returned 0x12 [0092.385] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.386] SetErrorMode (uMode=0x0) returned 0x1 [0092.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", lpFilePart=0x0) returned 0x67 [0092.386] GetLastError () returned 0x12 [0092.386] SetErrorMode (uMode=0x1) returned 0x0 [0092.386] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.387] GetLastError () returned 0x12 [0092.387] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.387] SetErrorMode (uMode=0x0) returned 0x1 [0092.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", lpFilePart=0x0) returned 0x61 [0092.387] GetLastError () returned 0x12 [0092.387] SetErrorMode (uMode=0x1) returned 0x0 [0092.387] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.388] GetLastError () returned 0x12 [0092.388] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.388] SetErrorMode (uMode=0x0) returned 0x1 [0092.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", lpFilePart=0x0) returned 0x61 [0092.388] GetLastError () returned 0x12 [0092.388] SetErrorMode (uMode=0x1) returned 0x0 [0092.388] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.388] GetLastError () returned 0x12 [0092.389] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.389] SetErrorMode (uMode=0x0) returned 0x1 [0092.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", nBufferLength=0x105, lpBuffer=0x39e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", lpFilePart=0x0) returned 0x75 [0092.389] GetLastError () returned 0x12 [0092.389] SetErrorMode (uMode=0x1) returned 0x0 [0092.389] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.389] GetLastError () returned 0x12 [0092.389] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.389] SetErrorMode (uMode=0x0) returned 0x1 [0092.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", nBufferLength=0x105, lpBuffer=0x39e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", lpFilePart=0x0) returned 0x75 [0092.389] GetLastError () returned 0x12 [0092.389] SetErrorMode (uMode=0x1) returned 0x0 [0092.389] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.390] GetLastError () returned 0x12 [0092.390] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.390] SetErrorMode (uMode=0x0) returned 0x1 [0092.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", nBufferLength=0x105, lpBuffer=0x39e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", lpFilePart=0x0) returned 0x79 [0092.390] GetLastError () returned 0x12 [0092.390] SetErrorMode (uMode=0x1) returned 0x0 [0092.390] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.411] GetLastError () returned 0x12 [0092.411] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.411] SetErrorMode (uMode=0x0) returned 0x1 [0092.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", nBufferLength=0x105, lpBuffer=0x39e4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", lpFilePart=0x0) returned 0x79 [0092.412] GetLastError () returned 0x12 [0092.412] SetErrorMode (uMode=0x1) returned 0x0 [0092.412] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.412] GetLastError () returned 0x12 [0092.413] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.413] SetErrorMode (uMode=0x0) returned 0x1 [0092.414] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", nBufferLength=0x105, lpBuffer=0x39e450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpFilePart=0x0) returned 0x8c [0092.414] GetLastError () returned 0x12 [0092.414] SetErrorMode (uMode=0x1) returned 0x0 [0092.414] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.415] GetLastError () returned 0x12 [0092.415] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.415] SetErrorMode (uMode=0x0) returned 0x1 [0092.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", nBufferLength=0x105, lpBuffer=0x39e450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpFilePart=0x0) returned 0x8c [0092.416] GetLastError () returned 0x12 [0092.416] SetErrorMode (uMode=0x1) returned 0x0 [0092.416] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.416] GetLastError () returned 0x12 [0092.416] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.416] SetErrorMode (uMode=0x0) returned 0x1 [0092.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", lpFilePart=0x0) returned 0x61 [0092.416] GetLastError () returned 0x12 [0092.416] SetErrorMode (uMode=0x1) returned 0x0 [0092.416] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.417] GetLastError () returned 0x12 [0092.417] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.417] SetErrorMode (uMode=0x0) returned 0x1 [0092.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", lpFilePart=0x0) returned 0x61 [0092.417] GetLastError () returned 0x12 [0092.417] SetErrorMode (uMode=0x1) returned 0x0 [0092.417] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.417] GetLastError () returned 0x12 [0092.417] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.417] SetErrorMode (uMode=0x0) returned 0x1 [0092.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", lpFilePart=0x0) returned 0x5f [0092.417] GetLastError () returned 0x12 [0092.418] SetErrorMode (uMode=0x1) returned 0x0 [0092.418] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.418] GetLastError () returned 0x12 [0092.418] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.418] SetErrorMode (uMode=0x0) returned 0x1 [0092.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", nBufferLength=0x105, lpBuffer=0x39e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", lpFilePart=0x0) returned 0x5f [0092.418] GetLastError () returned 0x12 [0092.419] SetErrorMode (uMode=0x1) returned 0x0 [0092.419] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.419] GetLastError () returned 0x12 [0092.419] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.419] SetErrorMode (uMode=0x0) returned 0x1 [0092.419] SHGetFolderPathW (in: hwnd=0x0, csidl=6, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned 0x0 [0092.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", lpFilePart=0x0) returned 0x27 [0092.420] GetLastError () returned 0x3f0 [0092.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28 [0092.420] GetLastError () returned 0x3f0 [0092.420] SetErrorMode (uMode=0x1) returned 0x0 [0092.420] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.420] GetLastError () returned 0x3f0 [0092.421] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.421] SetErrorMode (uMode=0x0) returned 0x1 [0092.421] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28 [0092.421] GetLastError () returned 0x12 [0092.421] SetErrorMode (uMode=0x1) returned 0x0 [0092.421] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.421] GetLastError () returned 0x12 [0092.421] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.421] SetErrorMode (uMode=0x0) returned 0x1 [0092.421] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d [0092.421] GetLastError () returned 0x12 [0092.421] SetErrorMode (uMode=0x1) returned 0x0 [0092.421] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.422] GetLastError () returned 0x12 [0092.422] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.422] SetErrorMode (uMode=0x0) returned 0x1 [0092.422] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d [0092.422] GetLastError () returned 0x12 [0092.422] SetErrorMode (uMode=0x1) returned 0x0 [0092.422] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.422] GetLastError () returned 0x12 [0092.422] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.422] SetErrorMode (uMode=0x0) returned 0x1 [0092.422] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a [0092.422] GetLastError () returned 0x12 [0092.422] SetErrorMode (uMode=0x1) returned 0x0 [0092.428] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.458] GetLastError () returned 0x12 [0092.458] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.459] SetErrorMode (uMode=0x0) returned 0x1 [0092.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a [0092.459] GetLastError () returned 0x12 [0092.459] SetErrorMode (uMode=0x1) returned 0x0 [0092.459] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.460] GetLastError () returned 0x12 [0092.460] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.460] SetErrorMode (uMode=0x0) returned 0x1 [0092.460] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34 [0092.460] GetLastError () returned 0x12 [0092.461] SetErrorMode (uMode=0x1) returned 0x0 [0092.461] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.469] GetLastError () returned 0x12 [0092.469] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.470] SetErrorMode (uMode=0x0) returned 0x1 [0092.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34 [0092.470] GetLastError () returned 0x12 [0092.470] SetErrorMode (uMode=0x1) returned 0x0 [0092.470] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.471] GetLastError () returned 0x12 [0092.471] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.471] SetErrorMode (uMode=0x0) returned 0x1 [0092.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x34 [0092.471] GetLastError () returned 0x12 [0092.471] SetErrorMode (uMode=0x1) returned 0x0 [0092.472] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.473] GetLastError () returned 0x12 [0092.473] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.473] SetErrorMode (uMode=0x0) returned 0x1 [0092.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x34 [0092.474] GetLastError () returned 0x12 [0092.474] SetErrorMode (uMode=0x1) returned 0x0 [0092.474] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.474] GetLastError () returned 0x12 [0092.474] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.475] SetErrorMode (uMode=0x0) returned 0x1 [0092.475] SHGetFolderPathW (in: hwnd=0x0, csidl=6, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned 0x0 [0092.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", nBufferLength=0x105, lpBuffer=0x39e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", lpFilePart=0x0) returned 0x27 [0092.475] GetLastError () returned 0x3f0 [0092.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28 [0092.475] GetLastError () returned 0x3f0 [0092.475] SetErrorMode (uMode=0x1) returned 0x0 [0092.476] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.476] GetLastError () returned 0x3f0 [0092.476] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.476] SetErrorMode (uMode=0x0) returned 0x1 [0092.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x39e750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28 [0092.476] GetLastError () returned 0x12 [0092.476] SetErrorMode (uMode=0x1) returned 0x0 [0092.476] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.476] GetLastError () returned 0x12 [0092.476] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.476] SetErrorMode (uMode=0x0) returned 0x1 [0092.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d [0092.477] GetLastError () returned 0x12 [0092.477] SetErrorMode (uMode=0x1) returned 0x0 [0092.477] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.477] GetLastError () returned 0x12 [0092.477] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.477] SetErrorMode (uMode=0x0) returned 0x1 [0092.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d [0092.477] GetLastError () returned 0x12 [0092.477] SetErrorMode (uMode=0x1) returned 0x0 [0092.477] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.477] GetLastError () returned 0x12 [0092.478] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.478] SetErrorMode (uMode=0x0) returned 0x1 [0092.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a [0092.478] GetLastError () returned 0x12 [0092.478] SetErrorMode (uMode=0x1) returned 0x0 [0092.478] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.479] GetLastError () returned 0x12 [0092.479] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.479] SetErrorMode (uMode=0x0) returned 0x1 [0092.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a [0092.479] GetLastError () returned 0x12 [0092.479] SetErrorMode (uMode=0x1) returned 0x0 [0092.479] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.480] GetLastError () returned 0x12 [0092.480] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.481] SetErrorMode (uMode=0x0) returned 0x1 [0092.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34 [0092.481] GetLastError () returned 0x12 [0092.481] SetErrorMode (uMode=0x1) returned 0x0 [0092.481] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.482] GetLastError () returned 0x12 [0092.482] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.482] SetErrorMode (uMode=0x0) returned 0x1 [0092.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34 [0092.482] GetLastError () returned 0x12 [0092.482] SetErrorMode (uMode=0x1) returned 0x0 [0092.483] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.483] GetLastError () returned 0x12 [0092.483] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.484] SetErrorMode (uMode=0x0) returned 0x1 [0092.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x34 [0092.484] GetLastError () returned 0x12 [0092.484] SetErrorMode (uMode=0x1) returned 0x0 [0092.484] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.485] GetLastError () returned 0x12 [0092.485] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.486] SetErrorMode (uMode=0x0) returned 0x1 [0092.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", nBufferLength=0x105, lpBuffer=0x39e6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live", lpFilePart=0x0) returned 0x34 [0092.486] GetLastError () returned 0x12 [0092.486] SetErrorMode (uMode=0x1) returned 0x0 [0092.486] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x42eea8 | out: lpFindFileData=0x42eea8) returned 0x42c630 [0092.489] GetLastError () returned 0x12 [0092.489] FindClose (in: hFindFile=0x42c630 | out: hFindFile=0x42c630) returned 1 [0092.490] SetErrorMode (uMode=0x0) returned 0x1 [0092.511] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x42ee78 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0092.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x39e7dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d [0092.511] GetLastError () returned 0x3f0 [0092.523] GdipGetImageRawFormat (image=0x682230, format=0x39ecf4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0092.523] GetLastError () returned 0x3f0 [0092.532] GdipGetImageEncodersSize (numEncoders=0x39eca4, size=0x39eca0) returned 0x0 [0092.532] GetLastError () returned 0x3f0 [0092.533] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x451b30 [0092.534] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x451b30 | out: encoders=0x451b30) returned 0x0 [0092.534] GetLastError () returned 0x3f0 [0092.550] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0092.551] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451cac, Length=0x26 | out: Destination=0x42ee78) [0092.551] lstrlenW (lpString="BMP") returned 3 [0092.551] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451cd2, Length=0x8 | out: Destination=0x42ee78) [0092.551] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0092.551] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451cda, Length=0x24 | out: Destination=0x42ee78) [0092.551] lstrlenW (lpString="image/bmp") returned 9 [0092.551] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451cfe, Length=0x14 | out: Destination=0x42ee78) [0092.551] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0092.551] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451d16, Length=0x28 | out: Destination=0x42ee78) [0092.552] lstrlenW (lpString="JPEG") returned 4 [0092.552] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451d3e, Length=0xa | out: Destination=0x42ee78) [0092.552] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0092.552] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451d48, Length=0x34 | out: Destination=0x42ee78) [0092.552] lstrlenW (lpString="image/jpeg") returned 10 [0092.552] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451d7c, Length=0x16 | out: Destination=0x42ee78) [0092.552] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0092.552] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451d96, Length=0x26 | out: Destination=0x42ee78) [0092.552] lstrlenW (lpString="GIF") returned 3 [0092.552] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451dbc, Length=0x8 | out: Destination=0x42ee78) [0092.552] lstrlenW (lpString="*.GIF") returned 5 [0092.552] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451dc4, Length=0xc | out: Destination=0x42ee78) [0092.552] lstrlenW (lpString="image/gif") returned 9 [0092.552] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451dd0, Length=0x14 | out: Destination=0x42ee78) [0092.552] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0092.552] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451dfc, Length=0x28 | out: Destination=0x42ee78) [0092.552] lstrlenW (lpString="TIFF") returned 4 [0092.553] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451e24, Length=0xa | out: Destination=0x42ee78) [0092.553] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0092.553] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451e2e, Length=0x1a | out: Destination=0x42ee78) [0092.553] lstrlenW (lpString="image/tiff") returned 10 [0092.553] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451e48, Length=0x16 | out: Destination=0x42ee78) [0092.553] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0092.553] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451e66, Length=0x26 | out: Destination=0x42ee78) [0092.553] lstrlenW (lpString="PNG") returned 3 [0092.553] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451e8c, Length=0x8 | out: Destination=0x42ee78) [0092.553] lstrlenW (lpString="*.PNG") returned 5 [0092.553] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451e94, Length=0xc | out: Destination=0x42ee78) [0092.553] lstrlenW (lpString="image/png") returned 9 [0092.553] RtlMoveMemory (in: Destination=0x42ee78, Source=0x451ea0, Length=0x14 | out: Destination=0x42ee78) [0092.553] LocalFree (hMem=0x451b30) returned 0x0 [0092.554] GetLastError () returned 0x7f [0092.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\img.jpg", nBufferLength=0x105, lpBuffer=0x39e788, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\img.jpg", lpFilePart=0x0) returned 0x35 [0092.555] GetLastError () returned 0x7f [0092.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\img.jpg", nBufferLength=0x105, lpBuffer=0x39e75c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\img.jpg", lpFilePart=0x0) returned 0x35 [0092.555] GetLastError () returned 0x7f [0092.556] GdipSaveImageToFile (image=0x682230, filename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\img.jpg", clsidEncoder=0x39ecb8*(Data1=0x557cf401, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0094.010] GetLastError () returned 0x0 [0094.015] SystemParametersInfoA (in: uiAction=0x14, uiParam=0x0, pvParam=0x39ea84, fWinIni=0x1 | out: pvParam=0x39ea84) returned 1 [0094.337] GetLastError () returned 0x6 [0094.365] CLSIDFromProgIDEx (in: lpszProgID="sapi.spvoice", lpclsid=0x39eb6c | out: lpclsid=0x39eb6c*(Data1=0x96749377, Data2=0x3391, Data3=0x11d2, Data4=([0]=0x9e, [1]=0xe3, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x79, [6]=0x73, [7]=0x96))) returned 0x0 [0094.570] CoGetClassObject (in: rclsid=0x44dca4*(Data1=0x96749377, Data2=0x3391, Data3=0x11d2, Data4=([0]=0x9e, [1]=0xe3, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x79, [6]=0x73, [7]=0x96)), dwClsContext=0x15, pvReserved=0x0, riid=0x74dca3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x39e9dc | out: ppv=0x39e9dc*=0x56609f0) returned 0x0 [0095.432] SpVoice:IUnknown:QueryInterface (in: This=0x56609f0, riid=0x74eb7ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x39e80c | out: ppvObject=0x39e80c*=0x0) returned 0x80004002 [0095.433] SpVoice:IClassFactory:CreateInstance (in: This=0x56609f0, pUnkOuter=0x0, riid=0x74e47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x39e844 | out: ppvObject=0x39e844*=0x5660a20) returned 0x0 [0096.310] IUnknown:QueryInterface (in: This=0x5660a20, riid=0x74e47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x39e5e8 | out: ppvObject=0x39e5e8*=0x5660a20) returned 0x0 [0096.310] IUnknown:QueryInterface (in: This=0x5660a20, riid=0x74e64204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x39e5a4 | out: ppvObject=0x39e5a4*=0x0) returned 0x80004002 [0098.872] IUnknown:QueryInterface (in: This=0x5660a20, riid=0x74d90b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x39e498 | out: ppvObject=0x39e498*=0x5660a48) returned 0x0 [0098.872] IProvideClassInfo:GetClassInfo (in: This=0x5660a48, ppTI=0x39e490 | out: ppTI=0x39e490*=0x4c98ec) returned 0x0 [0098.876] ITypeInfo:RemoteGetTypeAttr (in: This=0x4c98ec, ppTypeAttr=0x39e4a4, pDummy=0xe4f2e4a1 | out: ppTypeAttr=0x39e4a4, pDummy=0xe4f2e4a1) returned 0x0 [0098.877] ITypeInfo:LocalReleaseTypeAttr (This=0x4c98ec) returned 0x439d30 [0098.877] IUnknown:Release (This=0x5660a48) returned 0x2 [0098.877] IUnknown:Release (This=0x4c98ec) returned 0x1 [0098.877] IUnknown:AddRef (This=0x5660a20) returned 0x3 [0098.877] CoGetContextToken (in: pToken=0x39e430 | out: pToken=0x39e430) returned 0x0 [0098.877] CoGetContextToken (in: pToken=0x39e3f4 | out: pToken=0x39e3f4) returned 0x0 [0098.877] CObjectContext::QueryInterface () returned 0x0 [0098.891] CObjectContext::GetCurrentApartmentType () returned 0x0 [0098.891] Release () returned 0x0 [0098.891] CoGetObjectContext (in: riid=0x74e47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4aca3c | out: ppv=0x4aca3c*=0x419488) returned 0x0 [0098.891] IUnknown:QueryInterface (in: This=0x5660a20, riid=0x74d423cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x39e418 | out: ppvObject=0x39e418*=0x44f868) returned 0x0 [0098.891] IMarshal:GetUnmarshalClass (in: This=0x44f868, riid=0x74e47714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x39e420 | out: pCid=0x39e420*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0098.892] IUnknown:Release (This=0x44f868) returned 0x3 [0098.892] CoGetContextToken (in: pToken=0x39e428 | out: pToken=0x39e428) returned 0x0 [0098.892] IUnknown:AddRef (This=0x5660a20) returned 0x4 [0098.892] IUnknown:QueryInterface (in: This=0x5660a20, riid=0x74d9767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x39e49c | out: ppvObject=0x39e49c*=0x0) returned 0x80004002 [0098.892] IUnknown:Release (This=0x5660a20) returned 0x3 [0098.892] IUnknown:Release (This=0x5660a20) returned 0x2 [0098.892] SpVoice:IUnknown:Release (This=0x56609f0) returned 0x1 [0098.892] IUnknown:Release (This=0x5660a20) returned 0x1 [0098.934] CoGetContextToken (in: pToken=0x39e868 | out: pToken=0x39e868) returned 0x0 [0098.934] IUnknown:AddRef (This=0x5660a20) returned 0x2 [0098.934] IUnknown:QueryInterface (in: This=0x5660a20, riid=0x74dbf5fc*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x39e8c4 | out: ppvObject=0x39e8c4*=0x5660a38) returned 0x0 [0098.934] IUnknown:Release (This=0x5660a20) returned 0x2 [0098.934] IDispatch:GetIDsOfNames (in: This=0x5660a38, riid=0x74dbf910*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x39e8c0*="speak", cNames=0x1, lcid=0x409, rgDispId=0x39e8b0 | out: rgDispId=0x39e8b0*=12) returned 0x0 [0098.940] IDispatch:Invoke (in: This=0x5660a38, dispIdMember=12, riid=0x74dbf910*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x39e950*(rgvarg=([0]=0x39e8d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Your documents, photos, databases and other important files have been encrypted !, Your documents, photos, databases and other important files have been encrypted , Your documents, photos, databases and other important files have been encrypted !, Your documents, photos, databases and other important files have been encrypted !, Your documents, photos, databases and other important files have been encrypted ! ", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x39e7a8, puArgErr=0x39e848 | out: pDispParams=0x39e950*(rgvarg=([0]=0x39e8d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Your documents, photos, databases and other important files have been encrypted !, Your documents, photos, databases and other important files have been encrypted , Your documents, photos, databases and other important files have been encrypted !, Your documents, photos, databases and other important files have been encrypted !, Your documents, photos, databases and other important files have been encrypted ! ", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x39e7a8*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x39e848*=0x39e884) returned 0x0 [0114.664] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0114.787] NtdllDefWindowProc_W () returned 0x1 [0125.657] IUnknown:Release (This=0x5660a38) returned 0x1 [0125.684] GetUserNameW (in: lpBuffer=0x42ee78, pcbBuffer=0x39ed14 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x39ed14) returned 1 [0125.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", nBufferLength=0x105, lpBuffer=0x39e6dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt", lpFilePart=0x0) returned 0x38 [0125.686] GetLastError () returned 0x0 [0125.686] SetErrorMode (uMode=0x1) returned 0x0 [0125.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\@___readme___@.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x48c [0125.687] GetLastError () returned 0x0 [0125.687] GetFileType (hFile=0x48c) returned 0x1 [0125.687] SetErrorMode (uMode=0x0) returned 0x1 [0125.688] GetFileType (hFile=0x48c) returned 0x1 [0125.692] WriteFile (in: hFile=0x48c, lpBuffer=0x2582ee0*, nNumberOfBytesToWrite=0x697, lpNumberOfBytesWritten=0x39ec34, lpOverlapped=0x0 | out: lpBuffer=0x2582ee0*, lpNumberOfBytesWritten=0x39ec34*=0x697, lpOverlapped=0x0) returned 1 [0125.692] GetLastError () returned 0x0 [0125.692] CloseHandle (hObject=0x48c) returned 1 [0125.693] GetLastError () returned 0x0 [0125.693] SendMessageW (hWnd=0x301ce, Msg=0x10, wParam=0x0, lParam=0x0) returned 0x0 [0125.716] DestroyCursor (hCursor=0x700f9) returned 1 [0125.716] GetLastError () returned 0x0 [0125.716] GetWindowLongW (hWnd=0x301ce, nIndex=-20) returned 327680 [0125.717] DestroyWindow (hWnd=0x301ce) returned 1 [0125.717] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0125.730] PostThreadMessageW (idThread=0xa50, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0125.730] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0125.731] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0125.731] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301da, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0125.731] CallWindowProcW (lpPrevWndFunc=0x77e625dd, hWnd=0x301ce, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0125.738] OleInitialize (pvReserved=0x0) returned 0x0 [0125.738] GetLastError () returned 0x7f [0125.738] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x39f1ac | out: lplpMessageFilter=0x39f1ac*=0x0) returned 0x0 [0125.739] PeekMessageW (in: lpMsg=0x39f184, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x39f184) returned 1 [0125.739] GetMessageA (in: lpMsg=0x39f184, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x39f184) returned 0 [0125.739] GetCurrentThreadId () returned 0xa50 [0125.739] EnumThreadWindows (dwThreadId=0xa50, lpfn=0x921952, lParam=0x0) returned 1 [0125.744] IsWindowVisible (hWnd=0x301ca) returned 0 [0125.744] IsWindowVisible (hWnd=0x301c8) returned 0 [0125.744] GetCurrentThreadId () returned 0xa50 [0125.746] GetCurrentThreadId () returned 0xa50 [0125.746] EnumThreadWindows (dwThreadId=0xa50, lpfn=0x921a6a, lParam=0x0) returned 1 [0125.746] IsWindowVisible (hWnd=0x301ca) returned 0 [0125.746] IsWindowVisible (hWnd=0x301c8) returned 0 [0125.746] OleUninitialize () [0125.746] GetLastError () returned 0x7f [0125.746] CloseHandle (hObject=0x198) returned 1 [0125.746] GetLastError () returned 0x7f [0125.747] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1ba00001) returned 1 [0125.748] CoGetContextToken (in: pToken=0x39fd3c | out: pToken=0x39fd3c) returned 0x0 [0125.748] IUnknown:QueryInterface (in: This=0x419488, riid=0x74e63ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x39fd70 | out: ppvObject=0x39fd70*=0x419494) returned 0x0 [0125.748] IComThreadingInfo:GetCurrentThreadType (in: This=0x419494, pThreadType=0x39fde0 | out: pThreadType=0x39fde0*=1) returned 0x0 [0125.748] IUnknown:Release (This=0x419494) returned 0x1 [0125.749] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x3fc120*=0x98, lpdwindex=0x39fba8 | out: lpdwindex=0x39fba8) returned 0x0 [0125.764] CoGetContextToken (in: pToken=0x39f130 | out: pToken=0x39f130) returned 0x0 [0125.764] CoGetContextToken (in: pToken=0x39f100 | out: pToken=0x39f100) returned 0x0 [0125.764] CoGetContextToken (in: pToken=0x39f090 | out: pToken=0x39f090) returned 0x0 [0125.764] IUnknown:Release (This=0x5660a20) returned 0x0 Thread: id = 13 os_tid = 0xa8c Thread: id = 15 os_tid = 0xa94 [0071.827] CoGetContextToken (in: pToken=0xc4f588 | out: pToken=0xc4f588) returned 0x800401f0 [0071.827] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0125.751] SetWindowLongW (hWnd=0x201d4, nIndex=-4, dwNewLong=2011571677) returned 9570954 [0125.753] SetClassLongW (hWnd=0x201d4, nIndex=-24, dwNewLong=2011571677) returned 0x92094a [0125.753] PostMessageW (hWnd=0x201d4, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0125.753] GetModuleHandleW (lpModuleName=0x0) returned 0xc80000 [0125.754] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.378734a", hInstance=0xc80000) returned 0 [0125.754] GetLastError () returned 0x584 [0125.755] DeleteAtom (nAtom=0xc000) returned 0x0 [0125.755] GetLastError () returned 0x584 [0125.755] FindAtomW (lpString="GDI+Atom_2636_1") returned 0x0 [0125.755] GetLastError () returned 0x2 [0125.756] IsWindow (hWnd=0x301ca) returned 1 [0125.756] GetModuleHandleW (lpModuleName="user32.dll") returned 0x763e0000 [0125.757] GetProcAddress (hModule=0x763e0000, lpProcName="DefWindowProcW") returned 0x77e625dd [0125.758] SetWindowLongW (hWnd=0x301ca, nIndex=-4, dwNewLong=2011571677) returned 9573482 [0125.758] SetClassLongW (hWnd=0x301ca, nIndex=-24, dwNewLong=2011571677) returned 0x92146a [0125.758] IsWindow (hWnd=0x301ca) returned 1 [0125.758] DestroyWindow (hWnd=0x301ca) returned 0 [0125.759] PostMessageW (hWnd=0x301ca, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0125.759] SetConsoleCtrlHandler (HandlerRoutine=0x92143a, Add=0) returned 1 [0125.760] FindAtomW (lpString="GDI+Atom_2636_1") returned 0x0 [0125.760] GetLastError () returned 0x2 [0125.760] FindAtomW (lpString="GDI+Atom_2636_1") returned 0x0 [0125.760] GetLastError () returned 0x2 [0125.761] DeleteObject (ho=0xe0a0284) returned 1 [0125.761] GetLastError () returned 0x2 [0125.761] DestroyCursor (hCursor=0x11019f) returned 1 [0125.761] GetLastError () returned 0x2 [0125.762] RegCloseKey (hKey=0x80000004) returned 0x0 [0125.762] CloseHandle (hObject=0x194) returned 1 [0125.762] GetLastError () returned 0x2 [0125.763] CoGetContextToken (in: pToken=0xc4dfbc | out: pToken=0xc4dfbc) returned 0x0 [0125.763] IUnknown:QueryInterface (in: This=0x419488, riid=0x74efbeb4*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0xc4df90 | out: ppvObject=0xc4df90*=0x419498) returned 0x0 [0125.764] CObjectContext::ContextCallback () returned 0x0 [0125.875] IUnknown:Release (This=0x419498) returned 0x1 [0125.875] IUnknown:Release (This=0x419488) returned 0x0 Thread: id = 22 os_tid = 0xae4 Thread: id = 23 os_tid = 0xb24 Thread: id = 24 os_tid = 0xb28 Thread: id = 25 os_tid = 0xb2c Thread: id = 26 os_tid = 0xb30 Thread: id = 27 os_tid = 0xb34 Thread: id = 28 os_tid = 0xb38 Thread: id = 36 os_tid = 0xb64 Thread: id = 37 os_tid = 0xb68 Thread: id = 38 os_tid = 0xb84 Thread: id = 39 os_tid = 0x5c4 Process: id = "4" image_name = "notepad.exe" filename = "c:\\windows\\system32\\notepad.exe" page_root = "0x32add000" os_pid = "0xa58" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x964" cmd_line = "\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\@___README___@.txt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:000104d7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 477 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 478 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 479 start_va = 0x40000 end_va = 0x41fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 480 start_va = 0xd0000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 481 start_va = 0x77c50000 end_va = 0x77df8fff entry_point = 0x77c50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 482 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 483 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 484 start_va = 0xffc90000 end_va = 0xffcc4fff entry_point = 0xffc90000 region_type = mapped_file name = "notepad.exe" filename = "\\Windows\\System32\\notepad.exe" (normalized: "c:\\windows\\system32\\notepad.exe") Region: id = 485 start_va = 0x7fefff70000 end_va = 0x7fefff70fff entry_point = 0x7fefff70000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 486 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 487 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 488 start_va = 0x7fffffde000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 489 start_va = 0x340000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 490 start_va = 0x77a30000 end_va = 0x77b4efff entry_point = 0x77a30000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 491 start_va = 0x7fefde60000 end_va = 0x7fefdecafff entry_point = 0x7fefde60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 492 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 493 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 494 start_va = 0x77b50000 end_va = 0x77c49fff entry_point = 0x77b50000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 495 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 496 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 497 start_va = 0x7fef7db0000 end_va = 0x7fef7e20fff entry_point = 0x7fef7db0000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 498 start_va = 0x7fefc670000 end_va = 0x7fefc863fff entry_point = 0x7fefc670000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 499 start_va = 0x7fefcd60000 end_va = 0x7fefcd6bfff entry_point = 0x7fefcd60000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 500 start_va = 0x7fefdf70000 end_va = 0x7fefe172fff entry_point = 0x7fefdf70000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 501 start_va = 0x7fefe180000 end_va = 0x7fefef07fff entry_point = 0x7fefe180000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 502 start_va = 0x7fefefb0000 end_va = 0x7feff0dcfff entry_point = 0x7fefefb0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 503 start_va = 0x7feff210000 end_va = 0x7feff2aefff entry_point = 0x7feff210000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 504 start_va = 0x7feff2b0000 end_va = 0x7feff38afff entry_point = 0x7feff2b0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 505 start_va = 0x7feff390000 end_va = 0x7feff3aefff entry_point = 0x7feff390000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 506 start_va = 0x7feff3b0000 end_va = 0x7feff3bdfff entry_point = 0x7feff3b0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 507 start_va = 0x7feff910000 end_va = 0x7feff976fff entry_point = 0x7feff910000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 508 start_va = 0x7feff980000 end_va = 0x7feff9f0fff entry_point = 0x7feff980000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 509 start_va = 0x7feffb10000 end_va = 0x7feffbe6fff entry_point = 0x7feffb10000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 510 start_va = 0x7feffdd0000 end_va = 0x7feffe66fff entry_point = 0x7feffdd0000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 511 start_va = 0x7feffe90000 end_va = 0x7fefff58fff entry_point = 0x7feffe90000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 512 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 513 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 514 start_va = 0x150000 end_va = 0x152fff entry_point = 0x150000 region_type = mapped_file name = "notepad.exe.mui" filename = "\\Windows\\System32\\en-US\\notepad.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\notepad.exe.mui") Region: id = 515 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 516 start_va = 0x170000 end_va = 0x17ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 517 start_va = 0x180000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 518 start_va = 0x280000 end_va = 0x280fff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 519 start_va = 0x2a0000 end_va = 0x2a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 520 start_va = 0x440000 end_va = 0x5c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 521 start_va = 0x5d0000 end_va = 0x750fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 522 start_va = 0x760000 end_va = 0x1b5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 523 start_va = 0x1b90000 end_va = 0x1c0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b90000" filename = "" Region: id = 524 start_va = 0x1c10000 end_va = 0x1ceefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c10000" filename = "" Region: id = 525 start_va = 0x1cf0000 end_va = 0x1cfffff entry_point = 0x0 region_type = private name = "private_0x0000000001cf0000" filename = "" Region: id = 526 start_va = 0x7fefc090000 end_va = 0x7fefc0a7fff entry_point = 0x7fefc090000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 527 start_va = 0x7fefc4c0000 end_va = 0x7fefc515fff entry_point = 0x7fefc4c0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 528 start_va = 0x7fefda90000 end_va = 0x7fefda9efff entry_point = 0x7fefda90000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 529 start_va = 0x7feff3c0000 end_va = 0x7feff3edfff entry_point = 0x7feff3c0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 530 start_va = 0x7feffa00000 end_va = 0x7feffb08fff entry_point = 0x7feffa00000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Thread: id = 12 os_tid = 0xa5c Process: id = "5" image_name = "dllhost.exe" filename = "c:\\windows\\syswow64\\dllhost.exe" page_root = "0x1c8fd000" os_pid = "0xb3c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0xa4c" cmd_line = "C:\\Windows\\SysWOW64\\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:000104d7" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 769 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 770 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 771 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 772 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 773 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 774 start_va = 0x60000 end_va = 0xc6fff entry_point = 0x60000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 775 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 776 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 777 start_va = 0xf0000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 778 start_va = 0x130000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 779 start_va = 0x190000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 780 start_va = 0x1f0000 end_va = 0x1fffff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 781 start_va = 0x200000 end_va = 0x23ffff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 782 start_va = 0x240000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 783 start_va = 0x2a0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 784 start_va = 0x2e0000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 785 start_va = 0x3b0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 786 start_va = 0x400000 end_va = 0x4fffff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 787 start_va = 0x500000 end_va = 0x687fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 788 start_va = 0x690000 end_va = 0x810fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 789 start_va = 0x820000 end_va = 0x85ffff entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 790 start_va = 0x860000 end_va = 0xb2efff entry_point = 0x860000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 791 start_va = 0xbb0000 end_va = 0xbb4fff entry_point = 0xbb0000 region_type = mapped_file name = "dllhost.exe" filename = "\\Windows\\SysWOW64\\dllhost.exe" (normalized: "c:\\windows\\syswow64\\dllhost.exe") Region: id = 792 start_va = 0xbc0000 end_va = 0x1fbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bc0000" filename = "" Region: id = 793 start_va = 0x1fd0000 end_va = 0x200ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 794 start_va = 0x2030000 end_va = 0x206ffff entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 795 start_va = 0x20c0000 end_va = 0x20fffff entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 796 start_va = 0x21b0000 end_va = 0x21effff entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 797 start_va = 0x2290000 end_va = 0x22cffff entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 798 start_va = 0x22d0000 end_va = 0x23aefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000022d0000" filename = "" Region: id = 799 start_va = 0x74430000 end_va = 0x7443dfff entry_point = 0x74430000 region_type = mapped_file name = "msttsdecwrp.dll" filename = "\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSDecWrp.dll" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\msttsdecwrp.dll") Region: id = 800 start_va = 0x746d0000 end_va = 0x7472efff entry_point = 0x746d0000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Region: id = 801 start_va = 0x74ca0000 end_va = 0x74cdafff entry_point = 0x74ca0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 802 start_va = 0x74ce0000 end_va = 0x74cf5fff entry_point = 0x74ce0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 803 start_va = 0x752d0000 end_va = 0x7534ffff entry_point = 0x752d0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 804 start_va = 0x75360000 end_va = 0x75367fff entry_point = 0x75360000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 805 start_va = 0x75370000 end_va = 0x753cbfff entry_point = 0x75370000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 806 start_va = 0x753d0000 end_va = 0x7540efff entry_point = 0x753d0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 807 start_va = 0x75410000 end_va = 0x7541dfff entry_point = 0x75410000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 808 start_va = 0x75980000 end_va = 0x7598bfff entry_point = 0x75980000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 809 start_va = 0x75990000 end_va = 0x759effff entry_point = 0x75990000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 810 start_va = 0x75a30000 end_va = 0x75a48fff entry_point = 0x75a30000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 811 start_va = 0x75bb0000 end_va = 0x75bf5fff entry_point = 0x75bb0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 812 start_va = 0x75fd0000 end_va = 0x760dffff entry_point = 0x75fd0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 813 start_va = 0x760e0000 end_va = 0x7617ffff entry_point = 0x760e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 814 start_va = 0x763c0000 end_va = 0x763c9fff entry_point = 0x763c0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 815 start_va = 0x763e0000 end_va = 0x764dffff entry_point = 0x763e0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 816 start_va = 0x764e0000 end_va = 0x7656efff entry_point = 0x764e0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 817 start_va = 0x76670000 end_va = 0x7671bfff entry_point = 0x76670000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 818 start_va = 0x76720000 end_va = 0x767ebfff entry_point = 0x76720000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 819 start_va = 0x76890000 end_va = 0x76912fff entry_point = 0x76890000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 820 start_va = 0x77570000 end_va = 0x775cffff entry_point = 0x77570000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 821 start_va = 0x775d0000 end_va = 0x776bffff entry_point = 0x775d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 822 start_va = 0x776c0000 end_va = 0x7781bfff entry_point = 0x776c0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 823 start_va = 0x77820000 end_va = 0x778affff entry_point = 0x77820000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 824 start_va = 0x77990000 end_va = 0x77a2cfff entry_point = 0x77990000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 825 start_va = 0x77a30000 end_va = 0x77b4efff entry_point = 0x0 region_type = private name = "private_0x0000000077a30000" filename = "" Region: id = 826 start_va = 0x77b50000 end_va = 0x77c49fff entry_point = 0x0 region_type = private name = "private_0x0000000077b50000" filename = "" Region: id = 827 start_va = 0x77c50000 end_va = 0x77df8fff entry_point = 0x77c50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 828 start_va = 0x77e30000 end_va = 0x77faffff entry_point = 0x77e30000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 829 start_va = 0x7efa7000 end_va = 0x7efa9fff entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 830 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 831 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 832 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 833 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 834 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 835 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 836 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 837 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 838 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 839 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 840 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 841 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 842 start_va = 0x72070000 end_va = 0x72127fff entry_point = 0x72070000 region_type = mapped_file name = "wmspdmod.dll" filename = "\\Windows\\SysWOW64\\WMSPDMOD.DLL" (normalized: "c:\\windows\\syswow64\\wmspdmod.dll") Region: id = 843 start_va = 0x74660000 end_va = 0x7466afff entry_point = 0x74660000 region_type = mapped_file name = "msdmo.dll" filename = "\\Windows\\SysWOW64\\msdmo.dll" (normalized: "c:\\windows\\syswow64\\msdmo.dll") Region: id = 844 start_va = 0x75a50000 end_va = 0x75a55fff entry_point = 0x75a50000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 845 start_va = 0x76380000 end_va = 0x763b4fff entry_point = 0x76380000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 846 start_va = 0x72010000 end_va = 0x72068fff entry_point = 0x72010000 region_type = mapped_file name = "mfplat.dll" filename = "\\Windows\\SysWOW64\\mfplat.dll" (normalized: "c:\\windows\\syswow64\\mfplat.dll") Region: id = 847 start_va = 0x74390000 end_va = 0x74396fff entry_point = 0x74390000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\SysWOW64\\avrt.dll" (normalized: "c:\\windows\\syswow64\\avrt.dll") Region: id = 848 start_va = 0x76180000 end_va = 0x761d6fff entry_point = 0x76180000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Thread: id = 29 os_tid = 0xb58 Thread: id = 30 os_tid = 0xb54 Thread: id = 31 os_tid = 0xb50 Thread: id = 32 os_tid = 0xb4c Thread: id = 33 os_tid = 0xb48 Thread: id = 34 os_tid = 0xb44 Thread: id = 35 os_tid = 0xb40